search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
188 stars 68 forks source link

Missing packets when high traffic #293

Closed Zsm1982 closed 2 months ago

Zsm1982 commented 5 months ago

Hi all

I encountered the same problem as it，my heplify version is 1.66.6 but the problem still exists https://github.com/sipcapture/heplify/issues/86

My packet capture architecture is like this heplify---->UDP---->heplify-server the heplify run like this: heplify -i any -t af_packet -m SIP -hs XXX,XXX.XX.XX:XXXX -l error -p /var/log/heplify -pr 7060-7062 -b 640 Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second

Zsm1982 commented 5 months ago

![Uploading 20240702165618.png…]()

lmangani commented 5 months ago

Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s

Check your linux system network for UDP drops and most likely switch to TCP hep.

Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second

The limit is your system, and there's no magic way to tell without knowing everything about your resources and traffic.

Zsm1982 commented 5 months ago

Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s

Check your linux system network for UDP drops and most likely switch to TCP hep. I can confirm that my Linux system has not lost any packets，Not related to TCP hep

Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second i use heplify -wf save the pcap file, it's missing packets as the same time. The limit is your system, and there's no magic way to tell without knowing everything about your resources and traffic.

my question like https://github.com/sipcapture/heplify/issues/86

lmangani commented 5 months ago

my question like #86

Precisely. Make sure the interface you are sniffing on has no packet drops. The issue is your system and its performance.

Zsm1982 commented 5 months ago

my question like #86

Precisely. Make sure the interface you are sniffing on has no packet drops. The issue is your system and its performance.

How do we need to make sure? Can you give me an example? Thank you very much

kYroL01 commented 5 months ago

You can check if your interface has packet drops with this command, for example ifconfig eth0 | grep -i "drop" - assuming eth0 is the name

Anyway it's always a good requirement to switch from UDP to TCP in this case heplify---->TCP---->heplify-server