skinny

Documentation

Overview

Package skinny decodes the Skinny Client Control Protocol (SCCP) — the Cisco-proprietary signalling protocol between a Cisco IP phone and a CallManager / CUCM (TCP 2000). It is a VoIP-reconnaissance target: SCCP is unencrypted in many deployments, so a captured exchange reveals the call flow (register, off-hook, dial, ring, connect, hang-up) and — via the KeypadButton messages — the actual digits the user dials, i.e. the numbers being called. Decoding it surfaces that activity. It joins the project's other VoIP / signalling decoders (internal/sip, rtp, rtcp).

Wrap-vs-native judgement

Native. A Skinny message is a trivial little-endian frame: a 4-octet
length, a 4-octet reserved field, a 4-octet message ID, then the
message body. The length makes the stream self-delimiting, so
decoding is a framed walk + an ID lookup — a dependency is not
justified. stdlib only, no new go.mod dep.

Verifiable / no confidently-wrong output

The frame structure and the message IDs were verified against
scapy's Skinny layer, and the 132-entry message-name table is
code-generated from scapy.contrib.skinny (not hand-transcribed).
The KeypadButton message (the dialed digit) is decoded because its
body is a simple fixed layout. Every other message body is surfaced
as raw hex with the message named — Skinny has ~130 message types
with varied, version-specific bodies, so decoding them all would
invite confidently-wrong output.

Code generated from scapy.contrib.skinny's message-ID table. DO NOT EDIT BY HAND.

Index

• type Message
• type Result
  • func Decode(input string) (*Result, error)

Types

type Message

type Message struct {
	Length      int    `json:"length"`
	MessageID   string `json:"message_id"`
	MessageName string `json:"message_name"`
	DialedDigit string `json:"dialed_digit,omitempty"` // KeypadButton
	BodyHex     string `json:"body_hex,omitempty"`
}

Message is one decoded Skinny message.

type Result

type Result struct {
	Messages []Message `json:"messages"`
	Notes    []string  `json:"notes,omitempty"`
}

Result is the decoded view of one or more Skinny messages.

func Decode

func Decode(input string) (*Result, error)

Decode parses one or more concatenated Skinny messages from hex (whitespace / ':' / '-' / '_' separators and a '0x' prefix tolerated).