[sip-clf] FW: I-D Action:draft-kaplan-sipping-clf-pcap-00.txt

[Hadriel Kaplan <[e-mail]>]

Howdy,
I have submitted an I-D for Yet Another SIP-CLF Format.  This one is pure binary, and follows the libpcap/PCAP file format, encoding the fields into a format which just happens to be decode-able as RADIUS messages by PCAP decoders.  One of the advantages to this format is off-line decoders such as Wireshark can decode it right now, with only a dictionary for the VSA used for SIP-CLF.  For wireshark, for example, this can be done without re-compiling/upgrading wireshark.  Just a 30-second procedure and restarting Wireshark enables one to view, filter, and search through the SIP-CLF fields as is.

The I-D's link is below, and there's a sample CLF file and dictionary file and Wireshark instructions (and even screenshot!) available on:
https://sourceforge.net/projects/sip-clf/

There's also an open-source C-code library implementation available there.

-hadriel

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]]
> On Behalf Of [e-mail]
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> 
> 	Title           : PCAP-compatible Binary Syntax for SIP Common Log
> File Format
> 	Author(s)       : H. Kaplan
> 	Filename        : draft-kaplan-sipping-clf-pcap-00.txt
> 	Pages           : 20
> 	Date            : 2009-06-16
> 
> This document proposes a libpcap/PCAP-compatible binary syntax for
> the SIP common log format (CLF).  It does not cover semantic
> issues, and is meant to be evaluated in the context of the other
> efforts discussing SIP CLF.
> 
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-kaplan-sipping-clf-pcap-00.txt