Automated network capture and analysis?

Question

I was curious to know if anyone has done any work on automated network analysis such as starting network traffic capture (to file) before executing some test, perform some test, then stop capture, then parse capture file for known patterns to look for (expected data, errors that should not appear, etc.).

Using pcap libraries for whatever programming/scripting language, using tshark, tcpdump, etc.

I had planned to do some work in this area for SIP/VoIP testing but never got the time at work to look into it. But it should be theoretically possible, so just wanted to see if there were real life implementations of it by others (whether made open source or not).

Answer 1

There are a few different solutions off the top of my head. There are several proxies that others have already mentioned that have APIs that can be made to listen on whatever port you need. They may not get granular enough though for what you need. If I were looking in this area I'd maybe take a look at Python's socket module.: http://docs.python.org/2/library/socket.html

This even gives an example of sniffing and then parsing: http://www.binarytides.com/python-packet-sniffer-code-linux/

Answer 2

I know that it is doable, one of my previous employers integrated Wireshark (Ethereal then) analysis into its VoIP automation, using Perl AFAIK.

I did some hacks by grepping on tcpdump and a filter, catching a packet or event I was looking for.

Answer 3

You might want to take a look at Fiddler

Answer 4

If I understand your question correctly, there should be. I've had some success with BrowserMob Proxy and have started doing a little of experimentation during my space time with FiddlerCore. Both of these are with general web application testing though. I'm not certain how either of these would work with a VOIP solution, but, I think that Rsf's idea of Wireshark sounds very promising.