search

sipcapture / heplify

Portable and Lightweight HEP Capture Agent for HOMER
https://sipcapture.org
GNU Affero General Public License v3.0
179 stars 64 forks source link

Missing packets when high traffic #293

Open Zsm1982 opened 1 week ago

Zsm1982 commented 1 week ago

Hi all

I encountered the same problem as it，my heplify version is 1.66.6 but the problem still exists https://github.com/sipcapture/heplify/issues/86

My packet capture architecture is like this heplify---->UDP---->heplify-server the heplify run like this: heplify -i any -t af_packet -m SIP -hs XXX,XXX.XX.XX:XXXX -l error -p /var/log/heplify -pr 7060-7062 -b 640 Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second

Zsm1982 commented 1 week ago

![Uploading 20240702165618.png…]()

lmangani commented 1 week ago

Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s

Check your linux system network for UDP drops and most likely switch to TCP hep.

Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second

The limit is your system, and there's no magic way to tell without knowing everything about your resources and traffic.

Zsm1982 commented 1 week ago

Everything is normal when the traffic is low, but serious packet loss occurs when the SIP signaling traffic exceeds 50M/s

Check your linux system network for UDP drops and most likely switch to TCP hep. I can confirm that my Linux system has not lost any packets，Not related to TCP hep

Is it due to Heplify's insufficient performance? How many SIP packets can she catch per second i use heplify -wf save the pcap file, it's missing packets as the same time. The limit is your system, and there's no magic way to tell without knowing everything about your resources and traffic.

my question like https://github.com/sipcapture/heplify/issues/86

lmangani commented 1 week ago

my question like #86

Precisely. Make sure the interface you are sniffing on has no packet drops. The issue is your system and its performance.

Zsm1982 commented 1 week ago

my question like #86

Precisely. Make sure the interface you are sniffing on has no packet drops. The issue is your system and its performance.

How do we need to make sure? Can you give me an example? Thank you very much

kYroL01 commented 1 week ago

You can if your interface has drops with this command, for example ifconfig eth0 | grep -i "drop" - assuming eth0 is the name

Anyway it's always a good requirement to switch from UDp to TCP in this case heplify---->TCP---->heplify-server