Merge regular text logs (as info) and packet captures

edit

I created a perl script to convert the log file to a pcap file with syslog messages. Available here: https://gist.github.com/mdeweerd/47ea... .

After conversion, I just need to drag & drop the pcap files to wireshark to see them all.

Version at the time of this post - I'll probably add the possibility to apply a timeshift:

#!/bin/perl
# SCRIPT TO CONVERT TEXT LOG TO PCAP FILE
# READS DATES FROM LOG FILE
# WHEN READING FROM PIPE (UNTESTED) WITHOUT DATES,
# THE CURRENT TIMESTAMP IS USED.
#
# 0, 1 or 2 parameters to the script:
#  - When 0 parameters: uses STDIN, and writes to file.pcap.
#  - When 1 parameters: Depends on extension: either .pcap file or log file.
#  - When 2 parameters: One of the files should have the .pcap extension
use File::PCAP::Writer;
use Time::HiRes qw(gettimeofday);
use Time::Piece;
use Date::Parse;
use Socket;

use List::Util qw(sum);
use POSIX qw(locale_h);
use locale;

# Make sure text is in English.
setlocale(LC_CTYPE);

my $fname='file.pcap'; # Default output file name
my $logname='';        # Default log file, when '', use STDIN

# Check CLI paramaters
if(scalar(@ARGV)==2) {
   if( $ARGV[0] =~ /.pcap$/ ) {
      $fname=$ARGV[0];
      $logname=$ARGV[1];
   } elsif( $ARGV[1] =~ /.pcap$/ ) {
      $fname=$ARGV[1];
      $logname=$ARGV[0];
   }

} elsif(scalar(@ARGV)==1) {
   if( $ARGV[0] =~ /.pcap$/ ) {
      $fname=$ARGV[0];
   } else {
      $logname=$ARGV[0];
   }
}

# Delete the output file
unlink($fname);
# Open the output file
my $fpw = File::PCAP::Writer->new( {
    fname => $fname,
    dlt => 1,
} );

# Open the input file
my $fh;
my $timeFromFile=0;
if($logname ne '') {
   open( $fh => $logname) || die "Cannot open $logname: $!";
   $timeFromFile=1;
} else {
   $fh=*STDIN;
   $logname="STDIN";
}

# Inform about what we are doing
print "Convert $logname to $fname";

# Do conversion
my $t=0;
my $usec;
while( my $line = <$fh> ) {
    chomp;
    if(length($line)==0||$line=~/^\s*$/) {
        next;
    }


    #print $t;
    if($line=~/^\[([^[]*?)\]\s?(.*)/) {
       my $timestr=$1;
       $line=$2;
       $t=str2time($1,"+0000");
       #print $timestr." ".$t;
       $usec = 0;
       $timeFromFile=1;
    } elsif(!$timeFromFile) {
       ($t, $usec) = gettimeofday();
    }
    $line="<134>".$line;
    #$line=gmtime($t)->strftime("%M %b %H:%M:%S")." ".$line;
    #print $line."\n";
    $buf=getPacketForText($line);
    $blen=$plen=length($buf);
    $fpw->packet( 0+$t, $usec, $blen, $plen, $buf );
}
#$fpw->close();


# Helper functions, adapted from  https://stackoverflow.com/questions/51061864/sending-spoofed-syslog-messages-in-perl


sub udp_checksum {
    # thanks to ikegami in post https://stackoverflow.com/questions/46181281/udp-checksum-function-in-perl
    my $packed_src_addr = shift;  # As 4-char string, e.g. as returned by inet_aton.
     my $packed_dst_addr = shift;  # As 4-char string, e.g. as returned by inet_aton.
    my $udp_packet      = shift;  # UDP header and data as a string.

    my $sum = sum(
    IPPROTO_UDP,
    length($udp_packet),
    map({ unpack('n*', $_) }
        $packed_src_addr,
        $packed_dst_addr,
        $udp_packet."\0",  # Extra byte ignored if length($udp_packet) is even.
        ),
    );

    while (my $hi = $sum >> 16) {
        $sum = ($sum & 0xFFFF) + $hi;
    }

    return ~$sum & 0xFFFF;
}

sub getPacketForText {
    $data=shift;

    $src_host = "localhost";
    $dst_host = 127.0.0.1;
    $src_port = 33333;
    $dest_port = 514;
    $cksum = 0; #initialise, we will sort this later

    #$udp_len is the udp packet length in the udp header. Its just 8 plus the length of the data
    #for this test harness we ...