search

sipcapture / captagent

100% Open-Source Packet Capture Agent for HEP
https://sipcapture.org
GNU Affero General Public License v3.0
167 stars 75 forks source link

[ERR] protocol_sip.c:132 Couldnot find this call #181

Closed arainero closed 6 years ago

arainero commented 6 years ago

Hello,

I recently downloaded and installed the most current version of captagent and I am seeing this error get outputted when starting captagent. I compared all of the config files and they are identical to my other server that is running captagent that was installed in October of 2017 with no issues.

When doing some Googling on this issue it seems to stem from RTCP, but everything is enabled and appears to be in good order.

Does anyone have any idea what may be wrong?

captanget.xml:

<?xml version="1.0"?>
<document type="captagent/xml">
        <configuration name="core.conf" description="CORE Settings" serial="2014024212">
            <settings>
                <param name="debug" value="5"/>
                <param name="version" value="2"/>
                <param name="serial" value="2014056501"/>
                <param name="uuid" value="00781a4a-5b69-11e4-9522-bb79a8fcf0f3"/>
                <param name="daemon" value="false"/>
                <param name="syslog" value="false"/>
                <param name="pid_file" value="/var/run/captagent.pid"/>
                <!-- Configure using installation path if different from default -->
                <param name="module_path" value="/usr/local/captagent/lib/captagent/modules"/>
                <param name="config_path" value="/usr/local/captagent/etc/captagent/"/>
                <param name="capture_plans_path" value="/usr/local/captagent/etc/captagent/captureplans"/>
                <param name="backup" value="/usr/local/captagent/etc/captagent/backup"/>
                <param name="chroot" value="/usr/local/captagent/etc/captagent"/>
            </settings>
        </configuration>
        <configuration name="modules.conf" description="Modules">
            <modules>

                <load module="transport_hep" register="local"/>
                <load module="protocol_sip" register="local"/>
                <load module="database_hash" register="local"/>
                <load module="protocol_rtcp" register="local"/>
                <load module="socket_pcap" register="local"/>

                <!-- NOTE: Block required for RTCPXR socket + RTCPXR protocol -->
                <!--
                        <load module="protocol_rtcpxr" register="local"/>
                        <load module="socket_collector" register="local"/>
                -->

                <!--
                <load module="socket_tzsp" register="local"/>
                <load module="protocol_ss7" register="local"/>
                <load module="protocol_tcp" register="local"/>
                <load module="output_json" register="local"/>
                <load module="protocol_rtcp" register="local"/>
                <load module="interface_http" register="local"/>
                <load module="database_redis" register="local"/>
                <load module="socket_pfring" register="local"/>
                -->
        </modules>
        </configuration>
</document>

protocol_rtcp.xml:

<?xml version="1.0"?>
<document type="captagent_module/xml">
    <module name="protocol_rtcp" description="RTCP Protocol" serial="2014010402">
        <profile name="proto_rtcp" description="PROTO RTCP" enable="true" serial="2014010402">
            <settings>
                <param name="rtcp-version" value="2"/>
            </settings>
        </profile>
    </module>
</document>

socket_pcap.xml:

<?xml version="1.0"?>
<document type="captagent_module/xml">
    <module name="socket_pcap" description="HEP Socket" serial="2014010402">
        <profile name="socketspcap_sip" description="HEP Socket" enable="true" serial="2014010402">
            <settings>
                <param name="dev" value="any"/>
                <param name="promisc" value="true"/>
                <param name="reasm" value="false"/>
                <param name="tcpdefrag" value="false"/>
                <param name="capture-plan" value="sip_capture_plan.cfg"/>
                <param name="filter">
                    <value>port 5060</value>
                </param>
            </settings>
        </profile>
        <profile name="socketspcap_tls" description="TLS Socket" enable="false" serial="2014010402">
            <settings>
                <param name="dev" value="any"/>
                <param name="promisc" value="true"/>
                <param name="reasm" value="false"/>
                <param name="tcpdefrag" value="true"/>
                <param name="capture-plan" value="tcp_capture_plan.cfg"/>
                <param name="filter">
                    <value>tcp port 5061</value>
                </param>
            </settings>
        </profile>
        <profile name="socketspcap_rtcp" description="RTCP Socket" enable="true" serial="2014010402">
            <settings>
                <param name="dev" value="any"/>
                <param name="promisc" value="true"/>
                <param name="reasm" value="false"/>
                <!-- size in MB -->
                <param name="ring-buffer" value="20"/>
                <!-- for rtp && rtcp < 250 -->
                <param name="snap-len" value="256"/>
                <param name="capture-filter" value="rtcp"/>
                <param name="capture-plan" value="rtcp_capture_plan.cfg"/>
                <param name="filter">
                    <value>portrange 10000-50000 and len >=50 </value>
                </param>
            </settings>
        </profile>
    </module>
</document>

rtcp_capture_plan.cfg:

capture[pcap] {

        # here we can check source/destination IP/port, message size
        if(msg_check("size", "30")) {

                #Check for correct version
                if(is_rtcp()) {
                        #Only for redis!

                        if(is_rtcp_exist()) {

                                #Convert to JSON if needed.
                                if(parse_rtcp_to_json()) {

                                        #Can be defined many profiles in transport_hep.xml
                                        if(!send_hep("hepsocket")) {
                                                clog("ERROR", "Error sending HEP!!!!");
                                        }

                                } else {
                                        clog("ERROR", "couldn't parse RTCP to json");
                                }

                        } else {
                                clog("ERROR", "Couldnot find this call");
                        }
                } else {
                        clog("ERROR", "This is not RTCP");
                }
        }
        drop;
}

sip_capture_plan.cfg:

capture[pcap] {

        # here we can check source/destination IP/port, message size
        if(msg_check("size", "100")) {

            #Do parsing
            if(parse_sip()) {
                #Can be defined many profiles in transport_hep.xml

                if(!send_hep("hepsocket")) {
                    clog("ERROR", "Error sending HEP!!!!");
                }

                if(sip_has_sdp())
                {
                        #Activate it for RTCP checks
                        if(!check_rtcp_ipport())
                        {
                                clog("ERROR", "ALREADY EXIST");
                        }
                }

                #Duplicate all INVITEs to JSON transport
                # if(sip_is_method() && sip_check("method","INVITE")) {
                #    #Can be defined many profiles in transport_json.xml
                #    if(!send_json("jsonsocket")) {
                #       clog("ERROR", "Error sending JSON!!!");
                #    }
                # }
            }
        }
        drop;
}

transport_hep.xml:

<?xml version="1.0"?>
<document type="captagent_module/xml">
    <module name="transport_hep" description="HEP Protocol" serial="2014010402">
        <profile name="hepsocket" description="Transport HEP" enable="true" serial="2014010402">
            <settings>
                <param name="version" value="3"/>
                <param name="capture-host" value="10.10.34.220"/>
                <param name="capture-port" value="9060"/>
                <param name="capture-proto" value="udp"/>
                <param name="capture-id" value="3444"/>
                <param name="capture-password" value=""/>
                <param name="payload-compression" value="false"/>
            </settings>
        </profile>
    </module>
</document>

output_json.xml:

<?xml version="1.0"?>
<document type="captagent_module/xml">
    <module name="output_json" description="JSON Protocol" serial="2014010402">
        <profile name="jsonsocket" description="Output JSON" enable="true" serial="2014010402">
            <settings>
                <param name="capture-version" value="1"/>
                <param name="capture-host" value="10.10.34.220"/>
                <param name="capture-port" value="9060"/>
                <param name="capture-proto" value="udp"/>
                <param name="capture-id" value="3444"/>
                <param name="payload-send" value="true"/>
            </settings>
        </profile>
    </module>
</document>

Thank you!

lmangani commented 6 years ago

Hi.

Not an issue but rather an expected behavior. The agent is correlating SIP sessions and RTCP reports based on SDP details captured within a session. If RTCP reports are received for a SIP session the agent has not captured (or for INVITES arrived before an agent restart, etc) the above message might be displayed, indicating the agent is processing reports for a session it does not know about.

I hope this helps.

arainero commented 6 years ago

You are right.

What was throwing me off was the way time works in the Homer UI. I was searching for a timeframe where I should've seen results, but didn't (because I forgot I have to change searched time to GMT), so I assumed this was causing a problem.

Thanks for clearing that up.

On Wed, Aug 1, 2018 at 4:06 PM, Lorenzo Mangani notifications@github.com wrote:

Hi.

Not an issue but rather an expected behavior. The agent is correlating SIP sessions and RTCP reports based on SDP details captured within a session. If RTCP reports are received for a SIP session the agent has not captured (or for INVITES arrived before an agent restart, etc) the above message might be displayed, indicating the agent is processing reports for a session it does not know about.

I hope this helps.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/sipcapture/captagent/issues/181#issuecomment-409704439, or mute the thread https://github.com/notifications/unsubscribe-auth/AZZyZ2hniMYCG0qPUs12knHVQ-h5xYJ-ks5uMgo2gaJpZM4VrJjc .

--

//CIO alonzo@arbeitsoftware.com | | 8444444401 www.arbeitsoftware.com