New protocol support: SIP

CHANGELOG.next.asciidoc

@@ -447,6 +447,8 @@ field. You can revert this change by configuring tags for the module and omittin
 
 *Packetbeat*
 
+- Added support for decoding SIP protocol. {pull}7181[7181]
+
 *Functionbeat*
 
 

packetbeat/_meta/sample_outputs/sip.json

@@ -0,0 +1,123 @@
+{
+  "@timestamp": "2018-05-27T07:45:15.115Z",
+  "transport": "udp",
+  "sip": {
+    "src": "192.168.122.1:5061",
+    "dst": "192.168.122.1:5060",
+    "cseq": "1 INVITE",
+    "call-id": "[email protected]",
+    "raw": "INVITE sip:[email protected]:5060 SIP/2.0\r\nVia: SIP/2.0/UDP 127.0.1.1:5061;branch=z9hG4bK-6831-1-0\r\nFrom: sipp <sip:[email protected]:5061>;tag=6831SIPpTag001\r\nTo: service <sip:[email protected]:5060>\r\nCall-ID: [email protected]\r\nCSeq: 1 INVITE\r\nContact: sip:[email protected]:5061\r\nMax-Forwards: 70\r\nSubject: Performance Test\r\nContent-Type: application/sdp\r\nContent-Length:   129\r\n\r\nv=0\r\no=user1 53655765 2353687637 IN IP4 127.0.1.1\r\ns=-\r\nc=IN IP4 127.0.1.1\r\nt=0 0\r\nm=audio 6000 RTP/AVP 0\r\na=rtpmap:0 PCMU/8000\r\n",
+    "request-uri": "sip:[email protected]:5060",
+    "from": "sipp <sip:[email protected]:5061>;tag=6831SIPpTag001",
+    "body": {
+      "application/sdp": {
+        "c": [
+          "IN IP4 127.0.1.1"
+        ],
+        "t": [
+          "0 0"
+        ],
+        "m": [
+          "audio 6000 RTP/AVP 0"
+        ],
+        "a": [
+          "rtpmap:0 PCMU/8000"
+        ],
+        "v": [
+          "0"
+        ],
+        "o": [
+          "user1 53655765 2353687637 IN IP4 127.0.1.1"
+        ],
+        "s": [
+          "-"
+        ]
+      }
+    },
+    "request-uri-user": "service",
+    "request-uri-port": 5060,
+    "method": "INVITE",
+    "to": "service <sip:[email protected]:5060>",
+    "headers": {
+      "to": [
+        {
+          "port": 5060,
+          "raw": "service <sip:[email protected]:5060>",
+          "display": "service",
+          "user": "service",
+          "host": "192.168.122.1"
+        }
+      ],
+      "subject": [
+        {
+          "raw": "Performance Test"
+        }
+      ],
+      "content-length": [
+        {
+          "raw": "129",
+          "number": 129
+        }
+      ],
+      "cseq": [
+        {
+          "raw": "1 INVITE",
+          "number": 1,
+          "method": "INVITE"
+        }
+      ],
+      "content-type": [
+        {
+          "raw": "application/sdp"
+        }
+      ],
+      "from": [
+        {
+          "params": [
+            "tag=6831SIPpTag001"
+          ],
+          "raw": "sipp <sip:[email protected]:5061>;tag=6831SIPpTag001",
+          "display": "sipp",
+          "user": "sipp",
+          "host": "127.0.1.1",
+          "port": 5061
+        }
+      ],
+      "call-id": [
+        {
+          "raw": "[email protected]"
+        }
+      ],
+      "via": [
+        {
+          "raw": "SIP/2.0/UDP 127.0.1.1:5061;branch=z9hG4bK-6831-1-0"
+        }
+      ],
+      "contact": [
+        {
+          "user": "sipp",
+          "host": "127.0.1.1",
+          "port": 5061,
+          "raw": "sip:[email protected]:5061"
+        }
+      ],
+      "max-forwards": [
+        {
+          "raw": "70",
+          "number": 70
+        }
+      ]
+    },
+    "request-uri-host": "192.168.122.1"
+  },
+  "type": "sip",
+  "unixtimenano": 1527407115115924000,
+  "beat": {
+    "name": "beathost",
+    "hostname": "beathost",
+    "version": "7.0.0-alpha1"
+  }
+}
+
+
+

packetbeat/docs/fields.asciidoc

@@ -35,6 +35,7 @@ grouped in the following categories:
 * <<exported-fields-process>>
 * <<exported-fields-raw>>
 * <<exported-fields-redis>>
+* <<exported-fields-sip>>
 * <<exported-fields-thrift>>
 * <<exported-fields-tls_detailed>>
 * <<exported-fields-trans_event>>
@@ -10294,6 +10295,154 @@ The return value of the Redis command in a human readable format.
 If the Redis command has resulted in an error, this field contains the error message returned by the Redis server.
 
 
+--
+
+[[exported-fields-sip]]
+== SIP fields
+
+SIP-specific event fields.
+
+
+
+*`sip.method`*::
++
+--
+SIP Request Method
+
+
+type: keyword
+
+example: INVITE
+
+--
+
+*`sip.request-uri`*::
++
+--
+SIP Request URI
+
+
+type: keyword
+
+example: sip:[email protected]:5060;transport=udp
+
+--
+
+*`sip.status-code`*::
++
+--
+SIP Response code, status code
+
+
+type: long
+
+example: 200
+
+--
+
+*`sip.status-phrase`*::
++
+--
+SIP Response, status phrase
+
+
+type: keyword
+
+example: OK
+
+--
+
+*`sip.from`*::
++
+--
+SIP From header value
+
+
+type: keyword
+
+example: "sipp" <sip:[email protected]>;tag=2363SIPpTag001
+
+--
+
+*`sip.to`*::
++
+--
+SIP To header value
+
+
+type: keyword
+
+example: "sut" <sip:[email protected]>;tag=16489SIPpTag012
+
+--
+
+*`sip.call-id`*::
++
+--
+SIP Call-ID header value
+
+
+type: keyword
+
+example: 
+
+--
+
+*`sip.cseq`*::
++
+--
+SIP CSeq header value
+
+
+type: keyword
+
+example: 1 INVITE
+
+--
+
+*`sip.body`*::
++
+--
+The body of the SIP message.
+
+type: object
+
+--
+
+*`sip.src`*::
++
+--
+Source IP address and port
+
+
+type: keyword
+
+example: 192.168.0.1:5060
+
+--
+
+*`sip.dst`*::
++
+--
+Destination IP address and port
+
+
+type: keyword
+
+example: 192.168.0.1:5060
+
+--
+
+*`unixtimenano`*::
++
+--
+unixtime as nanosec
+
+
+type: long
+
+example: 1516199666016756000
+
 --
 
 [[exported-fields-thrift]]