If you have the certs, sure you can decrypt it all. (And you must have, since FS can manage the traffic).
Otherwise, look at the profile’s
Capture-server to some ip fs will
Simply send there a copy of all messages. You can then catch them on that side.
Hello David!
On 09.11.21 at 00:19 David Villasmil wrote:
> Then why not just run tcpdump filtering for the signaling port and rotate
> every N bytes or Mb or whatever? And then simply pushing those files
> somewhere you can later use them?
>
> Maybe I misunderstood something
Yes. See my initial post: SIP (and RTP) is TLS'd and I don't have any certificate
because the VoIP provider owns it.
>
> If what you want is to go at some on-demand time to trace, then just do it
> like that.
That's exactly what I'm doing with Asterisk. Asterisk is able to write pcap files.
Therefore no problem.
Just out of curiosity, I tested the actual Homer version (with Asterisk). But I
gave up, because:
- correlation does work only partly (maybe an Asterisk problem)
- correlation of ongoing calls doesn't work (~5 minutes e.g. and much more)
- for me, the basic list of result is highly confusing (single call legs
aren't correlated. Even Invite and answer 401 isn't correlated)
- registers aren't correlated
- search for something like CID's doesn't work reliably (it's working 2 or 3 times
- afterwards no more - tested w/ FF and Chromium - I wasn't able to search for 2
CIDs at the same time)
- The GUI makes the browser going crazy (-> one CPU is used 100% after some time)
sngrep is able to correlate single call legs over hours *out of the box* - why
can't homer do the same? I don't think, a result list based on single methods is a
good solution - or did I miss something? This could be very possible, because I
wasn't able to find any reliable and complete and actual documentation.
If sngrep could safe regular pcap files based on HEP data, sngrep would be the way
to go - unfortunately, sngrep writes broken pcap files if the input data stream is
HEP. That's a known missing feature at this time. Even sngrep itself can't read
those pcap files any more.
Thanks
Gregor
Regards,
David Villasmil
phone: +34669448337