pcap 분석하며 적어뒀던 메모

이번에 Alexa이슈 대응하면서 처음 써본 Wireshark.

이슈 분석을 위해 몇가지 메모해둔 걸 보관 겸 정리해둔다.

 

<pcap 뜨는 명령어>

tcpdump -i lo -w /tmp/capture.pcap

 

+@ 한국에서 테스트 시에는 현재 시간 설정을 임의로 해주어야 함. 따라서 아래와 같은 명령어도 추가로 입력

date -s "2020-05-15 17:09:00"

 

<Alexa에서 POST 시 전달하는 uuid> - 해당 uuid를 통해 pcn에 접근한다.
5472c06d-11cf-4d10-bb19-e7a7b2c24abc
f9277396-c31c-4b3d-b3e7-2e6f8db37cc8
2d3d4604-c7c8-413e-ac21-f47cd389212b
fd4795c1-957a-4ca9-8bc5-d30a19b1e9b1
d74052ed-56c6-404c-b01a-6509702e973b
2453649e-e596-4271-b138-1f2a462e7250
80079986-c5d6-4cd3-a0d6-72931858e933
33e1c951-5a83-4c2b-8afa-a9ab1bfc701c
2cd017ea-79af-4d4b-91de-7e4a5f1bdabc
193d2a64-8042-4ecb-8410-7e708ab876ae
c366af5f-0f82-4f12-a644-56eedafa4690
f135ebaa-4902-4f55-a1cd-e0d615f07466
47aa8d27-0871-4e49-ae9a-9c797e7f4557
6dec0a97-7bd9-4c5f-8ac7-f7eb5a65d3a3
2962093a-6b62-4e97-af60-fc21c4554824
9791a730-3cef-48d6-b1bd-28c79f5b520b
7443fbaa-1758-4f03-aaa0-fe5b92a80b60  <<< -------- 당시 여기에서 문제 발생
202b41d9-c811-4111-ae79-7880f28fa6d8
bc2a433c-2911-4712-80ca-b6fd86e1a56f
ae34a296-bd9c-41fc-9d68-668ff2236b11
e3bb4452-ecd4-4956-99a2-c2c42fe0e505
ec56ca45-9896-45bf-a421-7d5a1f0de1c4
76feab2d-b753-4266-a1c2-5dd42292586a

 

<WireShark 필터>
phonemecontentnetwork 포트번호 : 48659
speech 포트번호 : 49671

 

<위 정보 기반으로 당시 사용했던 필터들>

frame.number == 23574 || frame.number == 26438

(tcp.dstport == 48659 && (http.request.method == GET)) || tcp.srcport == 48659

(tcp.dstport == 48659 && (http.request.method == GET)) || (tcp.srcport == 48659 && http)

(tcp.dstport == 49671 || tcp.dstport == 48659) && http.request.method == POST

(tcp.dstport == 49671 && http) || (tcp.srcport == 49671 && (http.response.code == 200 || http.response.code == 201))

(tcp.dstport == 49671 && http) || (tcp.srcport == 49671 && (http))

(((tcp.dstport == 49670 || tcp.srcport == 49670) && (tcp.dstport == 59968 || tcp.srcport == 59970)) && (http.request.method == GET || http.request.method == POST)) && http.request.uri contains recognizers
(((tcp.dstport == 49670 || tcp.srcport == 49670) && (tcp.dstport == 59968 || tcp.srcport == 59970)) && (http.request.method == GET || http.request.method == POST)) && (http.request.uri contains recognizers || http.response_for.uri contains recognizers)
(tcp.dstport == 49670 && tcp.srcport == 59970) && (http.request.method == POST && http.request.uri contains recognizers)

 

<로그>
// wakeup phrase POST 전달 로그 (Alexa -> Speech)
02:48:46.151455 127.0.0.1 127.0.0.1 46842 49671 HTTP 540 POST /speechactivationcontroller/wakeUpPhrases/ HTTP/1.1  (application/json)

 

<uuid 기반으로 pcn에서 GET으로 땡겨오던 정보>

Frame 9331: 618 bytes on wire (4944 bits), 618 bytes captured (4944 bits)

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Transmission Control Protocol, Src Port: 48659, Dst Port: 57850, Seq: 1, Ack: 208, Len: 528

Hypertext Transfer Protocol

    HTTP/1.1 200 OK\r\n

    X-Powered-By: Express\r\n
    Vary: Origin, Accept-Encoding\r\n
    Access-Control-Expose-Headers: Location\r\n
    Content-Type: application/json; charset=utf-8\r\n
    Content-Length: 243\r\n
    ETag: W/"cb-R+pCWRJ/Uqf9Foki9cDTtV+RQxU"\r\n
    Date: Thu, 05 Sep 2019 02:48:46 GMT\r\n
    Connection: keep-alive\r\n

    \r\n
    [HTTP response 1/49]
    [Time since request: 0.108534000 seconds]
    [Request in frame: 9200]
    [Next request in frame: 9355]
    [Next response in frame: 9368]

    [Request URI: http://127.0.0.1:48659/phonemecontentnetwork/phonemes/fd4795c1-957a-4ca9-8bc5-d30a19b1e9b1]

    File Data: 243 bytes
JavaScript Object Notation: application/json
    Object

        Member Key: status
            String value: ok
            Key: status
        Member Key: data
            Object
                Member Key: name
                    String value: alexa
                    Key: name
                Member Key: language
                    String value: bg-BG
                    Key: language
                Member Key: alphabet
                    String value: LH+
                    Key: alphabet
                Member Key: primaryPhonemes

                    String value: 'E.lEk.sa

                    Key: primaryPhonemes
                Member Key: id
                    String value: 5472c06d-11cf-4d10-bb19-e7a7b2c24abc
                    Key: id
                Member Key: uri
                    String value: /phonemecontentnetwork/phonemes/5472c06d-11cf-4d10-bb19-e7a7b2c24abc

                    Key: uri
            Key: data
        Member Key: timestamp
            Number value: 4980
            Key: timestamp