How to filter by SIP header in capture plan

[aiiksveryown]

I would like to know how to filter packets by SIP header, or by string match. I am unable to determine how to do this, or if it is possible.

[lmangani]

Hi @aiiksveryown there's an example in the default capture plan:

https://github.com/sipcapture/captagent/blob/master/conf/captureplans/sip_capture_plan.cfg

I hope this helps!

[aiiksveryown]

Hello,

That didn't help so much. I found the function header_regexp_match that kind of looks like what I need, but

1. I'm not sure how to use it. Looks like it takes 2 arguments, header and regex. The header has 3 entries in the function definition, useragent, custom and body. What header does custom match? body?
2. I have tried to test useragent matching, but I get this error protocol_sip.c:636 PATTERN BAD: [n▒▒], and it ends up ignoring the match condition and processes all packets anyway. I tried several variations of the match string.
3. The header I'm trying to match is the Via header. How do I achieve this?

Here is my capture plan

    capture[pcap] {

            # here we can check source/destination IP/port, message size
            if(msg_check("size", "100")) {

                #Do parsing
                if(parse_sip()) {
                    #Can be defined many profiles in transport_hep.xml
                    if(header_regexp_match("useragent","OpenSIPS")) {
                            if(!send_hep("hepsocket")) {
                                    clog("ERROR", "Error sending HEP!!!!");
                            }
                    }

                    #if(!send_hep("hepsocket")) {
                    #    clog("ERROR", "Error sending HEP!!!!");
                    #}

                    # if(sip_has_sdp())
                    # {
                    #       #Activate it for RTCP checks
                    #       if(!check_rtcp_ipport())
                    #       {
                    #               clog("ERROR", "ALREADY EXIST");
                    #       }
                    # }

                    #Duplicate all INVITEs to JSON transport
                    # if(sip_is_method() && sip_check("method","INVITE")) {
                    #    #Can be defined many profiles in transport_json.xml
                    #    if(!send_json("jsonsocket")) {
                    #       clog("ERROR", "Error sending JSON!!!");
                    #    }
                    # }
                }
            }
            drop;
    }

[lmangani]

Perhaps you should explain what you want to achieve exactly in order to get help?

[aiiksveryown]

Okay. Say I have a softswitch that receives VoIP calls from multiple sources and forwards (proxies) these calls to multiple other sources. We will call this SBC. I have two customers, A and B. Call initiation flow is as follows: A >> SBC, SBC >> B B >> SBC, SBC >> A

In this scenario, both sides of the call have the same call id (i.e A >> SBC and SBC >> B). Now, I would like to get stats for each side individually. I have added the IP addresses of these targets in heplify server config (PromTarget), but the originated and terminated calls are combined for each customer (i.e A >> SBC is combined with SBC >> A) in heplify server / grafana.

I want these separate, so I figure that discarding one side of the dialog will help. The call initiator is specified in the Via header, so I am attempting to filter out calls initiated by SBC, and have Heplify Server do the rest.

I hope my explanation is sufficient.

[lmangani]

Ok. Actual SBCs and proxies acting as SBC are quite different and this definitely acts like a proxy and based on your example it's OpenSIPS so you're approaching this curiously. OpenSIPS supports HEP internally (possibly one of the best HEP integrations out there!) and can perform this type of filtering/tagging internally to very creative extents without the any passive approach.

I doubt using captagent and dropping part of the dialog is the way to go here, quite honestly there are more elegant and effective ways to do this in general but I understand your corner case and limitations better now. The good news is what you are describing is a ready to use feature of hepic our professional stack sponsoring 100% the HOMER development and the bad new is despite the filtering, this result really can't be easily achieved with the OSS capture servers as of yet it is considered a sponsored feature, so you would have to get creative with HEP inside OpenSIPS.

If you'd like to debug the filtering rules we're happy to help out, but it won't do what you expect it would, most likely.

[aiiksveryown]

We will put hepic into consideration, but I will like to be able to do this with OSS. Perhaps I will try with OpenSIPS as you suggested. Thank you for responding, this was helpful.