search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
185 stars 66 forks source link

Heplify logs showing entries with "No or fishy Call-ID" #209

Closed Gasmanz closed 2 years ago

Gasmanz commented 3 years ago

We are running a heplify (v1.67) capture server to capture calls between a few SIP systems and an SBC. We have noticed that there are a bunch of calls missing from the database and was wondering why they are not showing up.

Looking at the heplify logs we can see a bunch of lines starting with "No or fishy Call-ID" and they seem to marry up with the missing calls. Is this a known issue and can anything be done to stop these calls from being filtered out?

Here is a sample call-id that gets tagged as fishy

CALL-ID: 0cdda0b0d8da5f0c8cbceb953f29a114

What I have noticed is that the SIP header field names are all in caps (CALL-ID, FROM, TO etc.) on the SIP messages that seem to be getting filtered out. RFC 3261 (https://tools.ietf.org/html/rfc3261#page-32) states that field names are always case-insensitive so that should technically not be the reason.

Anyway please let me know if this is possible to resolve.

negbie commented 3 years ago

Please add your Call-ID notation here https://github.com/sipcapture/heplify/blob/master/decoder/util.go#L312 and make a pr. Thank you!

Gasmanz commented 3 years ago

@negbie I have submitted a pr now.

https://github.com/sipcapture/heplify/pull/210

Thanks

Gasmanz commented 3 years ago

The proposed change allows for adherence to RFC 3261 where section 7.3.1 states,

When comparing header fields, field names are always case- insensitive. Unless otherwise stated in the definition of a particular header field, field values, parameter names, and parameter values are case-insensitive.

https://tools.ietf.org/html/rfc3261#page-32