Re: [Freeswitch-users] Question regarding continuous SIP trace with Freeswitch
Then why not just run tcpdump filtering for the signaling port and rotate every N bytes or Mb or whatever? And then simply pushing those files somewhere you can later use them? Maybe I misunderstood something If what you want is to go at some on-demand time to trace, then just do it like that. On Mon, 8 Nov 2021 at 18:46, Gregor Maier via FreeSWITCH-users < freeswitch-users@lists.freeswitch.org> wrote:
---------- Forwarded message ---------- From: Gregor Maier <freeswitch13@mailbox.org> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Cc: Bcc: Date: Sat, 6 Nov 2021 10:16:41 +0100 Subject: Re: [Freeswitch-users] Question regarding continuous SIP trace with Freeswitch
On 06.11.21 at 03:03 David Villasmil wrote:
At the risk of repressing myself: Homer? :)
Yes, David, I already heard it - but I don't know the way from Homer to pcap - I want to analyze SIP packages with sngrep! Because it's extremely handy and powerful! Especially if it comes to compare different messages and measure time between arbitrary packages.
And Homer is bloatware *compared to my requirement*.
sngrep would be the desired and best solution *for me* if it would be able to write correct pcap files while acting as HEP server.
Thanks Gregor
---------- Forwarded message ---------- From: Gregor Maier via FreeSWITCH-users < freeswitch-users@lists.freeswitch.org> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Cc: Bcc: Date: Mon, 08 Nov 2021 10:46:08 -0800 (PST) Subject: Re: [Freeswitch-users] Question regarding continuous SIP trace with Freeswitch _________________________________________________________________________
The FreeSWITCH project is sponsored by SignalWire https://signalwire.com Enhance your FreeSWITCH install with disruptive priced SMS and PSTN services. Build your next product on our scalable cloud platform.
Join our online community to chat in real time https://signalwire.community
Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
-- Regards, David Villasmil email: david.villasmil.work@gmail.com phone: +34669448337
Hello David! On 09.11.21 at 00:19 David Villasmil wrote:
Then why not just run tcpdump filtering for the signaling port and rotate every N bytes or Mb or whatever? And then simply pushing those files somewhere you can later use them?
Maybe I misunderstood something
Yes. See my initial post: SIP (and RTP) is TLS'd and I don't have any certificate because the VoIP provider owns it.
If what you want is to go at some on-demand time to trace, then just do it like that.
That's exactly what I'm doing with Asterisk. Asterisk is able to write pcap files. Therefore no problem. Just out of curiosity, I tested the actual Homer version (with Asterisk). But I gave up, because: - correlation does work only partly (maybe an Asterisk problem) - correlation of ongoing calls doesn't work (~5 minutes e.g. and much more) - for me, the basic list of result is highly confusing (single call legs aren't correlated. Even Invite and answer 401 isn't correlated) - registers aren't correlated - search for something like CID's doesn't work reliably (it's working 2 or 3 times - afterwards no more - tested w/ FF and Chromium - I wasn't able to search for 2 CIDs at the same time) - The GUI makes the browser going crazy (-> one CPU is used 100% after some time) sngrep is able to correlate single call legs over hours *out of the box* - why can't homer do the same? I don't think, a result list based on single methods is a good solution - or did I miss something? This could be very possible, because I wasn't able to find any reliable and complete and actual documentation. If sngrep could safe regular pcap files based on HEP data, sngrep would be the way to go - unfortunately, sngrep writes broken pcap files if the input data stream is HEP. That's a known missing feature at this time. Even sngrep itself can't read those pcap files any more. Thanks Gregor
participants (2)
-
David Villasmil
-
Gregor Maier