search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
186 stars 66 forks source link

Probably fragmented messages not forwarded #249

Closed tietzsg closed 1 year ago

tietzsg commented 1 year ago

Hi,

we observe with using heplify that some messages are missing. In fact we assume that fragmented packets are missing. We get the SIP-messages via TCP or TLS and forward them with Kamailio via UDP to a next hop. We assumed, that we shoul d see the UDP messages in hepic, but they are not even sent out from the server where heplify is running. We can see messages between the kamailio and the next hop if they are not so big like ACKs or 180 Ringing. We also tried to send HEP Packets to hepic with -nt tcp but also, no messages.

SIP client === TCP/TLS ===> Kamailio with heplify === UDP ===> Next SIP hop

Do you know any problems in this part?

we start heplify 1.65.2 with: /usr/local/bin/heplify -i any -t af_packet -hs 1.2.3.4:9060 -m SIP -dim OPTIONS,INFO,PUBLISH,TIMETRACKING,PDDTRACKING,KDMQ,ACCOUNTING,PING,ASR -bpf "port 5060 " -hi 1337

Funfact: the captagent just does the job!

kYroL01 commented 1 year ago

Hello @tietzsg are these packets actually seen by heplify ? Does Kamailio send the pkt to heplify with TCP or UDP ? If heplify receives TCP packets, try to use the -tcpassembly in your command Can you try to add additional debug information with -d fragment ?

Anyway you don't need to specify -bpf "port 5060 " as by default the port range for SIP is 5060-5090

tietzsg commented 1 year ago

We assume the issues comes from the bpf filter option. We removed it completely and reley on the -pr param default The fragments seems to be filtered by BPF filter before they are combined.

We try to find a nice bpf option to keep fragements.