MikroTIK and TZSP

[adubovikov]

During last workshop at AsterConf.RU we have found that packet's pointer doesn't show to begin of the ethernet header and therefore we have some garbage during SIP parsing. Need to check and fix.

[adubovikov]

if the guys can provide us a pcap with tzsp (SIP) data , that we have tried convert to HEP during Aserconf, it will be awesome.

[adubovikov]

Just to show the latest "working scenario" https://mum.mikrotik.com/presentations/NL16/presentation_3876_1479372782.pdf

[adubovikov]

so, after some time we have received the TZSP packets from our partner and all works as expected: here is the configuration:

/ip firewall mangle add action=sniff-tzsp chain=prerouting log=yes log-prefix="Sip Sniff " \ port=5060 protocol=udp sniff-target=XXX.XXX.XXX.XXX sniff-target-port=\ 37008

So, all to all users of mikroTIK, please take the latest git of captagent and retest it.

Thank you and thank you our friends from Voicenter.co.il.

[swoga]

Hello,

I tried to send SIP data with MikroTik to captagent and had the problem that the data could not be parsed, because the link_offset was wrong. [DEBUG] socket_pcap.c:764 Link offset interface type [113] [113] [16]

After setting <param name="dev" value="any"/> to <param name="dev" value="eth0"/> in the socket_pcap.xml it worked. [DEBUG] socket_pcap.c:764 Link offset interface type [1] [1] [14]

Now I only have a problem with the IP addresses...

[adubovikov]

you should use socket_collector to get all TZSP packets, not a raw socket.

On Oct 25, 2017 07:42, "Peter" notifications@github.com wrote:

Hello,

I tried to send SIP data with MikroTik to captagent and had the problem that the data could not be parsed, because the link_offset was wrong. [DEBUG] socket_pcap.c:764 Link offset interface type [113] [113] [16]

After setting to <param name="dev" value="eth0"/> in the socket_pcap.xml it worked. [DEBUG] socket_pcap.c:764 Link offset interface type [1] [1] [14]

Now I only have a problem with the IP addresses... [image: image] https://user-images.githubusercontent.com/3697291/31996389-a065a6d2-b988-11e7-8153-14c81c8670ec.png

— You are receiving this because you were assigned. Reply to this email directly, view it on GitHub https://github.com/sipcapture/captagent/issues/153#issuecomment-339302521, or mute the thread https://github.com/notifications/unsubscribe-auth/AETdJcsCzeSQUcV4l-mmORO2fQ8p9pzMks5svx6RgaJpZM4PiYDR .

[ameurbendriss]

hello, i have the same problem when ysing tzsp, IP adresse are not displayed correctly. did you solve the issue?

[adubovikov]

do you use the collector or raw socket ?

[ameurbendriss]

I have tried to load socket_collector , but got the same issue, here is the configuration

[Requium]

Got the same problem, and the config as above on captagent.xml, as anyone solved and can share the solution :S, thanks in advancement.