search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
179 stars 64 forks source link

-diip flag not working #251

Closed idanam-del closed 6 months ago

idanam-del commented 1 year ago

hey, i have a native agent on fs that sends SIP on localhost to HEP collector

on the Hep collector i configured the following:

heplify -e -hs "Homer-ip" -hin udp:127.0.0.1:9060 -nt tls -diip "ip-to-discard" -dd

on homer, i dont see any change in the flow. Does it mean -diip doesnt help when heplify is in collector mode?

If so, what can help?

lmangani commented 1 year ago

i dont see any change in the flow. Does it mean -diip doesnt help when heplify is in collector mode?

Good point. I think you're right, the -diip would only apply to traffic sniffed by heplify and not to any HEP passed in relay mode.

idanam-del commented 1 year ago

That's unfortunate to be honest. So how else can i discard the ip im trying to?

Its the NAT ip behind a sip gateway after my FS. (FS -> NAT IP -> SIP GATEWAY IP).

I dont need to see the NAT IP in homer sip flow. Could the LuaJIT scripting at heplify server help?

If so is there a simple script to just discard a certain destination ip coming from certains source ips?

Thank you

lmangani commented 1 year ago

Hard to suggest anything without knowing your scenario and goals, in general our platform is not designed conceal data and the relay is not designed to perform filtering but feel free to open a PR to implement such filtering capability if useful, but the performance impact will be significant as the relay would have to parse each HEP packet. Not optimal.

idanam-del commented 1 year ago

Its the NAT ip behind a sip gateway after my FS. (FS -> NAT IP -> SIP GATEWAY real IP). -> My Scenario

My goal is not to see the leg from FS to NAT IP in the call flow at homer app.

idanam-del commented 1 year ago

@lmangani it doesn't seem to work either in a normal mode and not as collector in this setup:

Asterisk -> FS

In Asterisk - heplify -e -hs "Homer-ip" -nt tls -dd -diip "ip-of-FS"

In FS -heplify -e -hs "Homer-ip" -hin udp:127.0.0.1:9060 -nt tls -dd

On Homer i see duplicate msgs in call flow , 1 with capture id of Asterisk the other with Capture ID of FS

lmangani commented 1 year ago

That's the intended behavior of a monitoring system and quite normal. In most cases, agents will capture same packet on both ends of a trunk. I think what you're looking for is perhaps deduplication.

idanam-del commented 1 year ago

@lmangani Yes, this exactly what im looking for sorry if i wasn't clear enough.

I saw a hint in the issues and homer google group about a Dedup cfg in heplify-server.toml . ive set it to true and it seems it solved the problem for the Asterisk Scenario But not for the NAT IP scenario unfortunately.

I see msgs from NAT IP and Private IP. i would like to discard the NAT IP ones.

The agent in question is a HEP collector, collecting from native FS agent.

adubovikov commented 10 months ago

https://github.com/sipcapture/heplify/releases/tag/v1.65.10

adubovikov commented 10 months ago

please verify and let us know

thank you