NAME

       sipgrep - sip packet grep

SYNOPSIS

       sipgrep  <-ahNViwgGJpevxlDTRMmqCJj> <-IO pcap_dump > < -n num > < -d dev > < -A num > < -s snaplen > < -S
       limitlen > < -c contact user > < -j user agent > < -f from user > < -t to user > < -H capture URL > <  -q
       seconds > < -P portrange > < -F file > < match expression > < bpf filter >

DESCRIPTION

       sipgrep  strives  to  provide  most  of  GNU  grep's  common features, applying them to the SIP signaling
       protocol.  sipgrep is a pcap-aware tool that will allow you to specify extended  regular  expressions  to
       match  against  data  payloads  of  SIP  packets  with  application specific filtering options.  The tool
       understands filter logic common to other packet sniffing tools, such as tcpdump(8) and sipgrep(1).

OPTIONS

       -h     Display help/usage information.

       -V     Display version information.

       -e     Display empty packets.

       -i     Ignore case.

       -v     Invert match.

       -R     Do not try to drop privileges to the DROPPRIVS_USER.

              sipgrep makes no effort to validate input from live or offline sources as it is  focused  more  on
              performance  and  handling  large amounts of data than protocol correctness, which is most often a
              fair assumption to make.  However, sometimes it matters and thus as a rule sipgrep will try to  be
              defensive and drop any root privileges it might have.

              There  exist  scenarios where this behaviour can become an obstacle, so this option is provided to
              end-users who want to disable this feature, but must do so with an  understanding  of  the  risks.
              Packets  can  be  randomly  malformed  or even specifically designed to overflow sniffers and take
              control of them, and revoking root privileges  is  currently  the  only  risk  mitigation  sipgrep
              employs against such an attack.  Use this option and turn it off at your own risk.

       -w     Match the regex expression as a word.

       -p     Don't put the interface into promiscuous mode.

       -l     Make stdout line buffered.

       -D     When reading pcap_dump files, replay them at their recorded time intervals (mimic realtime).

       -T     Print a timestamp in the form of +S.UUUUUU, indicating the delta between packet matches.

       -m     Disable SIP Dialog matching.

       -M     Disable multi-line match (prefers single-line match instead).

       -I pcap_dump
              Input  file pcap_dump into sipgrep.  Works with any pcap-compatible dump file format.  This option
              is useful for searching for a wide range of different patterns over the same packet stream.

       -O pcap_dump
              Output matched packets to a pcap-compatible dump file.   This  feature  does  not  interfere  with
              normal output to stdout.

       -n num Match only num packets total, then exit.

       -A num Dump num packets of trailing context after matching a packet.

       -s snaplen
              Set the bpf caplen to snaplen (default 65536).

       -S limitlen
              Set  the upper limit on the size of packets that sipgrep will look at.  Useful for looking at only
              the first N bytes of packets without changing the BPF snaplen.

       -C     Do not use colors in stdout.

       -c     Match user in Contact: SIP header.

       -f     Match user in From: SIP header.

       -t     Match user in To: SIP header.

       -F file
              Read in the bpf filter from the specified filename.  This is  a  compatibility  option  for  users
              familiar  with tcpdump.  Please note that specifying ``-F'' will override any bpf filter specified
              on the command-line.

       -H ip:port
              Duplicate matching traffic to HEP Capture Server / HOMER.

       -N     Show sub-protocol number along with single-character identifier  (useful  when  observing  raw  or
              unknown protocols).

       -g     Disable clean-up of Dialogs during trace.

       -G     Print Dialogs report during trace.

       -J     Automatically send SIP packet-of-death to SipVicious scanners (kill).

       -j     For matching user-agent strings send SIP packet-of-death to SipVicious scanners (kill).

       -q     Terminate sipgrep after a specified number of seconds.

       -a     Enable packet re-assemblation.

       -P     Specify SIP port range (default 5060-5061).

       -d dev By default sipgrep will select a default interface to listen on.  Use this option to force sipgrep
              to listen on interface dev.

DIAGNOSTICS

       Errors from sipgrep, libpcap, and the GNU regex library are all output to stderr.

AUTHOR

       Written by Alexandr Dubovikov <alexandr.dubovikov@gmail.com>.

REPORTING BUGS

       Please report bugs to the sipgrep Bug Tracker, located at

           https://github.com/sipcapture/sipgrep/issues

       Non-bug, non-feature-request general feedback should be sent to the author directly by email.

NOTES

       ALL YOUR BASE ARE BELONG TO HOMER.

*nux                                               March 2014                                         SIPGREP(8)