Content-type: text/html
spyAgent - SipSpy Agent
spyAgent <-h> < -d dev > < -S > < -w passwords_file > < -p port > < -g debug_level > < -l listening_ip > < -f file > < bpf filter >
SpyAgent is the daemon monitor which works with VozTelecom's SipSpy.
SpyAgent is a daemon server which monitors all incoming/outgoing traffic in a computer, and searches packets which look like SIP messages. Furthermore, it opens a ServerSocket to accept incoming clients. These clients register with a username and password, and then provide a Regular Expression. ADMIN clients can instruct spyAgent to change the interface on which it is capturing, and also to change the BPF filter. NORMAL clients can only provide a Regular Expression. For every packet SipAgent considers is a SIP Message, it will apply the Regex provided by each of the clients, and if it matches, the client will receive a XML structure containing info about the message and the message itself.
boss:mypass:admin:.* userA:hispass:user:.*domainA.com.* userB:theirpass:user:.*domainB.com.*
here, boss would be an admin (thus he could change the Interface and BPF filter on which spyAgent is listening and capturing packets). He can provide any regex he wants, because hish "meta-regex" is .*, which matches against everything. userA would be a normal user, (identified by 'hipass' password). He is noly allowed to use regular expressions that include domainA.com, for excample, he couldn't be capturing all the SIP messages, because the regexp ".*" doesn't match against ".*domainA.com.*" so he has to provide regexps that contain domainA.com, for example "sip:.*@domainA.com" which would notify him of all the messages which comtain a sip-URI of the form sip:xxx@domainA.com. UserB is similar to userA.
SpyAgent will only monitor packets that match this filter. (it can be changed dinamically by ADMIN users).
take a look at tcpdump or ngrep manual for an explanation of BPF filters.
VozTelecom Sistemas SL Ronda Can Fatjo, 9, 1p Parc Tecnologic del Valles Cerdanyola
Written by Elias Baixas <elias.baixas@voztele.com>.