search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
179 stars 64 forks source link

Can’t get -dim to work on multiple methods #278

Closed ajb142 closed 4 months ago

ajb142 commented 4 months ago

Looking for some clarification on the -dim option.

I would like to pass “OPTIONS,NOTIFY,REGISTER” but can only seem to make one work, no combination of the three.

Should it be possible to filter out more than one?

Is this syntax correct on the command line -dim “OPTIONS,NOTIFY,REGISTER “ ?

I can see that these sip methods are still sent to the hep server when more than one method is specified.

Thanks in advance

lmangani commented 4 months ago

The documented example syntax is not using any quotes and no extra whitespace should be included. Are you using Docker?

./heplify -dim OPTIONS,NOTIFY

The devil is often in the details. Please include your actual configuration and if the issue persists we'll try to replicate it.

ajb142 commented 4 months ago

Thanks for the clarity.

I will give this a go later / tomorrow, was not expecting such a fast response!!

ajb142 commented 4 months ago

Thanks for the suggestion but no luck.

I copied the example, changed the target ip address and I can still see OPTIONS and NOTIFIES being sent to the HEP server.

what -dim does seem to be doing successfully if filtering out status messages where the cseq contains the relevant method. It is not filtering the original request despite the cseq header in there also containing the correct method.

lmangani commented 4 months ago

dim filters traffic exclusively by CSE as you can also confirm from the source. Details matter. Please attach the actual config + examples for the unfiltered messages or we won't be able to reproduce and assist.

ajb142 commented 4 months ago

Thanks for the clarification.

Getting examples is going to be tricky.

For now I have a work around using both -dim and -di

I will close this issue as I have enough info for now.

I will try and have another look at this in the future.

lmangani commented 4 months ago

@ajb142 I do not exclude this being a bug but without some examples it's hard to tell. BTW If you want to show an example for a message that's not fltered, you can and should anonymize any user details, they are not important.