How to Capture sip packets in Homer7

[PJ111288]

Hello Fella's,

I am very new in homer and however i was able to install homer7 by github help..........:) but i am not able find that how can configure homer so that it can capture sip packets.

i believe someone can help me on this...

Installation help from this : https://github.com/sipcapture/homer/wiki/Quick-Install

============================================================ I have installed homer server and HEP agent "heplify" and tried ./heplify on terminal but nothing happened. this is my homer-server-conf.

GNU nano 5.4 /etc/heplify-server.toml HEPAddr = "0.0.0.0:9060" HEPTCPAddr = "" HEPTLSAddr = "0.0.0.0:9060" HEPWSAddr = "0.0.0.0:3000" ESAddr = "http://127.0.0.1:9200/" ESDiscovery = true LokiURL = "" LokiBulk = 200 LokiTimer = 4 LokiBuffer = 100000 LokiHEPFilter = [1,5,100] ForceHEPPayload = [] PromAddr = "" PromTargetIP = "" PromTargetName = "" DBShema = "homer7" DBDriver = "postgres" DBAddr = "localhost:5432" DBUser = "postgres" DBPass = "postgres" DBDataTable = "homer_data" DBConfTable = "homer_config" DBBulk = 200 DBTimer = 4 DBBuffer = 400000 DBWorker = 8 DBRotate = true DBPartLog = "2h" DBPartSip = "1h" DBPartQos = "6h" DBDropDays = 14 DBDropDaysCall = 0 DBDropDaysRegister = 0 DBDropDaysDefault = 0 DBDropOnStart = false DBUsageProtection = true DBUsageScheme = "percentage" DBPercentageUsage = "80%" DBMaxSize = "30MB" Dedup = false DiscardMethod = ["OPTIONS","NOTIFY"] AlegIDs = ["X-CID","P-Charging-Vector,icid-value="?(.*?)(?:"|;|$)","X-BroadWorks-Correlation-Info"] CustomHeader = [] SIPHeader = ["callid","callid_aleg","method","ruri_user","ruri_domain","from_user","from_domain","from_tag","to_user","to_domain","to_tag","via",> LogDbg = "hep,sql,loki" LogLvl = "info" LogStd = false LogSys = false Config = "./heplify-server.toml" ConfigHTTPAddr = ""

Examples:

ESAddr = "http://127.0.0.1:9200/" DBShema = "homer7" DBDriver = "postgres" LokiURL = "http://localhost:3100/api/prom/push" LokiHEPFilter = [1,5,100] PromAddr = "0.0.0.0:8899" PromTargetIP = "10.1.2.111,10.1.2.4,10.1.2.5,10.1.2.6,10.12.44.222" PromTargetName = "sbc_access,sbc_core,kamailio,asterisk,pstn_gateway" AlegIDs = ["X-CID","P-Charging-Vector,icid-value="?(.*?)(?:"|;|$)","X-BroadWorks-Correlation-Info"] DiscardMethod = ["OPTIONS","NOTIFY"] CustomHeader = ["X-CustomerIP","X-Billing"] SIPHeader = ["callid","callid_aleg","method","ruri_user","ruri_domain","from_user","from_domain","from_tag","to_user","to_domain","to_tag","via","con> LogDbg = "hep,sql,loki" LogLvl = "warning" ConfigHTTPAddr = "0.0.0.0:9876"

To hot reload PromTargetIP and PromTargetName run: killall -HUP heplify-server

============================================================================

output from asterisk server only where heplify client installed but when i run this command on homer-server so nothing happened.

root@HomerServer-Debian11:~# ngrep -W byline port 9060 -d any interface: any filter: ( port 9060 ) and (ip || ip6)

=====================================================

[root@Asterisk-Client ~]# ngrep -W byline port 9060 -d any interface: any filter: ( port 9060 ) and (ip || ip6)

U 192.168.2.47:51943 -> 192.168.1.12:9060 https://github.com/sipcapture/homer-app/issues/1 HEP3..................................... c..:... . ..#............. ......... .../..... ..........myhep.....#OPTIONS sip:49.23.18.52 SIP/2.0. Via: SIP/2.0/UDP 192.168.2.47:5060;branch=z9hG4bK466fbd92;rport. Max-Forwards: 70. From: "asterisk" sip:asterisk@192.168.2.47;tag=as05dbe27c. To: sip:49.23.18.52. Contact: sip:asterisk@192.168.2.47:5060. Call-ID: 0861fd442754922f0000be1a1d6b674b@192.168.2.47:5060. CSeq: 102 OPTIONS. User-Agent: Asterisk PBX 16.28.0. Date: Mon, 12 Sep 2022 07:43:54 GMT. Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE. Supported: replaces, timer. Content-Length: 0. .

[github-actions[bot]]

Your report is appreciated. Please star this repository to motivate its developers! :star:

[lmangani]

Hello @PJ111288

Please share your OS/version and as many details as possible for things to make sense.

Are you actually trying to use this with Elasticsearch? That's not a good idea (see our project qryn.dev) I would suggest you start simple and make sure all works before enabling other integrations and features.

[PJ111288]

Hello @lmangani

i have installed Homer Server on Debian-11 and heplify client installed on Centos 7 asterisk server. just only this setup.

No elastic search or anyother.

I hv followed the same https://github.com/sipcapture/heplify-server/blob/master/example/homer7_config/heplify-server.toml. As it is very new for me.

---

/etc/asterisk/hep.conf ### file config.

; All settings are currently set in the general section. [general] enabled = yes

capture_address = 192.168.2.45:9060 ; homer server ;capture_password = foo
capture_id = 1234 . uuid_type = call-id

---

[lmangani]

If you have no elastic I don't understand why the settings are in your config.

ESAddr = "http://127.0.0.1:9200/"

Please confirm you have clean settings before restarting the example.

On the monitored host (Asterisk, etc) use EITHER heplify or the built-in hep feature - not both. NOTE: heplify tends to be simpler and faster as long as you don't do TLS encryption it works just fine.

1) start watching for incoming HEP packets on the server ngrep -W byline port 9060 -d any 2) perform a call on your Asterisk 3) make sure you see HEP traffic including the INVITEs, etc

If you see the packets, the call should appear. Make SURE you select a matching time-range from the UI. If that still doesn't work, this means you have a firewall/iptables/etc rule blocking the traffic locally.

[PJ111288]

Hello @lmangani

yes, i got packets now but when i run this, "./heplify -hs 192.168.2.45:9060 -nt tls" otherwise no luck.

so, is there any setting through which sip packets can route automatically to homer server?

Are these setting is, ok?

HEPAddr = "0.0.0.0:9060" HEPTCPAddr = "" HEPTLSAddr = "0.0.0.0:9060" HEPWSAddr = "0.0.0.0:3000"

Many Thanks

[lmangani]

@PJ111288 tls, which requires certificates to work and should use a different port. Use a normal udp/tcp HEP socket and then go from there once you have some HEP successfully inserted you can enable all the other preferences if needed.

[PJ111288]

@lmangani >> Something like this ?

HEPTCPAddr = "0.0.0.0:9060" HEPTLSAddr = ""

But in this case when i run. /heplify -hs 192.168.2.45:9060 -nt tls so packets get captured and display on homer UI which is "tls" so as i am confused as tls is working here and the problem is auto forwarding sip packets to homer server or UI is not happening?

[lmangani]

Start simple. This is the most basic command sending UDP to port 9060

./heplify -e -hs 192.168.1.1:9060

[PJ111288]

@lmangani Good Morning,

It is working fine like yesterday but problem is that i had to run it manually and then captures are forwarding to Homer server. I need to set automatically sip captures forward to homer server. how can i do it ?

./heplify -e -hs 192.168.1.1:9060

[PJ111288]

@lmangani

Many thanks for your help. I found a way to run auto this ./heplify -e -hs 192.168.1.1:9060 and packets are forwarding too homer srv.

one more imp thing that right now captures are displaying on homer UI in multiple (sip events (trying/invite etc)) of a single call. how could i make a single consolidate capture only for each call? The following screenshot has two calls but 8 dialogs with each sip event so how could be consolidate in two sip capture for two calls only.

[lmangani]

Follow the example to run heplify as a service. There are no "calls" in HOMER, just SIP signaling sessions and correlation - click the call-id to see the full transaction flow.

That's how this works. If you need a call tracking system, that's hepic also from QXIP.

[PJ111288]

@lmangani Hello,

Many thanks for your great instant support during my homer journey. It is very very appreciated. I have successfully installed and able to capture packets in production.

But there is some issue or configuration setting that only 200 events are displaying in homer UI, i have monitor two days. So can you please advise on this? Screenshot for your reference of yesterday.

[lmangani]

Hello @PJ111288 you're most welcome. About your question - super simple - just add the "limit" parameter to the search form and change the limit to any.

[PJ111288]

Ok. Thanks.