sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
185 stars 66 forks source link

Heplify installed on 3cx vm #252

Closed francesco-amato-argo closed 1 year ago

francesco-amato-argo commented 1 year ago

Hi to all I'm trying to collect SIP traffic from a 3cx vm I have setup the heplify-server and the heplify agent on different vms When I run the heplify agent, I saw the traffic captured by th eagent but I can't see any packet transfer to the vm with heplify-server There is someone that can help me?

lmangani commented 1 year ago

Hello @francesco-amato-argo Hard to tell without knowing the details of your setup and how you configured what. Focus on the sending agent (heplify) and its configuration until you see HEP packets going to the collector (heplify-server). The factors preventing packets from being captured might be thousands, for instance your traffic might be vlan tagged or otherwise encapsulated, etc.

francesco-amato-argo commented 1 year ago

Hello lmangani, the two server are in cloud They talk each other and can communicate without restriction (firewall, vlan, etc ... ) I followed the instructions for their installation. I installed the prerequisites to compile their source and I configured golang on system The binaries run without error I can see with the command "netstat -ln" that heplify-server listen for connection I run the agent with the command below: /opt/heplify/heplify -i any -hs "[heplify-server IP]:9060" -m SIPRTCP -l debug -p /var/log -n heplify.log If I look in the log file, I see the traffic being captured

In the other server, I can't see any packet from the agent I try to look even with tcpdump command on port 9060

The server with the agent is a Debian 10 (3cx VM) The other one is an Ubuntu 22.04

Which are other informations do you need to help me?

Regards Francesco

lmangani commented 1 year ago

if you see heplify sending traffic on 9060 and nothing arrives on the other side, you have a firewall issue.

francesco-amato-argo commented 1 year ago

You are right The problem was the provider firewall

Thank you for your help