Closed sincejune closed 3 years ago
Could you enumerate with more details as of your specific condition and configuration? Generally speaking, HEP packets SHOULD never appear to a SIP dedicated port quite simply put. Is this your case?
I'm using HEPlify(1.56) with such options cuz I have several components running on the box. And some of my components are sending traces to homer(another host).
I suspected the ports my components used to send traces are also in the range 5060-10000
so I also got HEP3 packets in HEPlify(debug output).
heplify -m SIP -pr 5060-10000 -dim ...
@sincejune since this is quite special I won't even think about to implement it but to help you I suggest you following. Use:
-pr "5060-10000 and not port 9060" -dim ....
You can even be more creative if you lookup how the flag is implemented.
Thanks @negbie
Actually, I think the port my components used is not 9060
.
But the solution you provided inspired me. Maybe we can add (
and )
around sniffer.config.PortRange
so that we can specify ports like
-pr "5060-5061 or portrange 9999-10000" -dim ...
Be creative you can use any BPF filter in -pr. Good luck!
I think heplify should exclude HEP3 packets when running in SIP mode but it didn't.
Do we have a workaround for this? :)