sipcapture / heplify-server

HEP Capture Server for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
184 stars 85 forks source link

heplify-server truncates and ignores HEPv3 packets from kamailio above 8192 bytes #429

Closed jose-lopes closed 4 years ago

jose-lopes commented 4 years ago

Hello all,

Before I describe the issue, I want to thank you for the good work on the project Homer.

I am using the siptrace module on Kamailio 5.3.5 and I am trying to monitor the SIP over websockets traffic with Homer 7.8.1 (heplify-server).

I notice a strange behavior, some packets are not presented on Homer. I checked heplify-server and I notice the next warning: heplify-server: 2020/07/22 18:41:09.425513 decoder.go:103: WARN HEP packet length is 8192 but should be 11663

I have done a tcpdump on the Homer machine and I had the next output, where I saw some packets with size greater than 8192.

19:58:29.788927 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, bad length 11658 > 1472 19:58:29.793539 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, length 626 19:58:29.810733 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, length 579 19:58:29.811121 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, length 579 19:58:29.838824 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, bad length 11953 > 1472 19:58:29.852286 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, length 473 19:58:29.865388 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, bad length 3521 > 1472 19:58:29.875311 IP X.X.X.X.6666 > Y.Y.Y.Y.9060: UDP, length 562

I analysed the code from heplify-server, I changed the next code and I have tested and now it is working with packets above 8192 bytes. diff --git a/server/server.go b/server/server.go

index c17d5d8..1ae3d30 100644
--- a/server/server.go
+++ b/server/server.go
@@ -47,7 +47,7 @@ type HEPStats struct {
        PktCount uint64
 }

-const maxPktLen = 8192
+const maxPktLen = 65507

 func NewHEPInput() *HEPInput {
        h := &HEPInput{

Should the maxPktLen be a configuration? Or can we change this value to 65507 which is the max data length for UDP?

negbie commented 4 years ago

It's an leftover from early days could you please send a pr with max UDP packet length? Configuration would be ok too but I'm not the biggest fan of software with millions of flags.

jose-lopes commented 4 years ago

Thanks for the feedback. I created pr.

negbie commented 4 years ago

Merged. Thank you very much!