Consider SIP callflow

[rafapcarvalho]

Is your feature request related to a problem? Please describe.

It's not a problem

Describe the solution you'd like

Would it be possible to add a callflow for traffic analysis in SIP?
Something like callflow, (example view) would be very interesting for analyzing SIP traffic. With thermShark I can analyze a lot without having to download pcap to my personal computer. However, in some cases it is important to see the callflow to complement the analysis. In this case I cannot leave the file on the server, being forced to download the pcap.

Describe alternatives you've considered

Something like callflow, (example view) would be very interesting for analyzing SIP traffic.

Additional context

wireshark example:

[gcla]

hi @rafapcarvalho - I'll investigate!

[rakotomandimby]

sip calflow can be view with another already existing tool; sngrep

[rafapcarvalho]

@rakotomandimby In this case, the proposal would be not to go to another tool. Something similar to what termshark gives us, since now I no longer need to download the file from a server to my personal machine to analyze a trace.

[rakotomandimby]

I really think we should leverage the use of existing. I work in the callcenter field and sngrerp does a really good job. May I suggest you try it, take a look at the codebase used to achieve that and you might conclude it is not worth it to start another work from scratch. I am not saying rewiting will result in same amount of code.

[rafapcarvalho]

ok! thanks.

[gcla]

Hi @rakotomandimby and @rafapcarvalho - I didn't know about sngrep - I tried it out and it's very nice! I agree with your opinion that it would be better to use it directly. Maybe termshark could loosely integrate with it. Something like

• if sngrep is available (e.g. PATH), then present a termshark menu option to do SIP analysis, and make it clear it's using sngrep
• if invoked, pass the pcap to sngrep behind the scenes by launching it as a child process, and hand the terminal over to sngrep until the user terminates sngrep

Do you think that would provide extra value? I don't think it would be a lot of work on the termshark side of things.

(The termshark log viewer works similarly - it just launches a gowid terminal widget within termshark and opens the log file with the user's pager)

[rafapcarvalho]

@gcla In my opinion, it provide extra value.