<div>Hello! </div><br><div>Thanks everyone</div><br><div>Actually setting</div><div><font style="font-family:monospace">listen=</font><font style="font-family:monospace"><span style="color:rgb(178, 24, 24)">udp:127.0.0.1:5060</span></font></div><br><div><font style="font-family:monospace">modparam("sipcapture", "raw_socket_listen", "127.0.0.1:5060")</font></div><div><font style="font-family:monospace">modparam("sipcapture", "raw_moni_capture_on", 1)</font></div><div><font style="font-family:monospace">modparam("sipcapture", "raw_interface", "lo")</font></div><div><font style="font-family:monospace">modparam("sipcapture", "promiscious_on", 1)</font></div><br><div>And setting one iptables rule</div><br><div><font style="font-family:monospace">iptables -A PREROUTING -t mangle -i eth0 -p udp --dport 5060 -j TEE --gateway 127.0.0.1</font></div><br><div>helps to get what I want exactly.</div><div> So, Kamailio is just receiving mirrored traffic I can analyze with.</div><div class="gmail_quote_attribution">On Oct 28 2019, at 8:20 am, Daniel-Constantin Mierla <miconda@gmail.com> wrote:</div><blockquote><div><br><div>Hello,</div><br><div><div>network sniffers (such as wireshark, ngrep, tcpdump, sngrep, ...) capture the traffic at network interface layer (well, using some kernel hooks), before getting to application layer (even before the firewall) and I expect is the same for heplify. They do not "receive" the packets like an application that does "listen", just take a copy of the traffic via those kernel hooks and then the packets are sent to the application layer. In other words, heplify doesn't received the sip traffic and then resends it locally, just gets a copy of the traffic.</div></div><br><div><div>Cheers,</div><div>Daniel</div></div><br><div class="moz-cite-prefix"><div>On 27.10.19 09:16, Igor Olhovskiy wrote:</div></div><blockquote><div> </div><div><div><div>So, at the end it would be like </div><div>Heplify captures traffic and sending it to localhost, where Kamailio listens. </div><div>Thanks, will give it a try. </div></div></div><div><br><div>Regards, Igor</div></div><div><div>On 26 Oct 2019, 21:21 +0200, Federico Cabiddu <a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/0?redirect=mailto%3Afederico.cabiddu%40gmail.com&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="mailto:federico.cabiddu@gmail.com"><federico.cabiddu@gmail.com></a>, wrote:</div><blockquote><div><div>Just use heplify or captagent for this:</div><div><div><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/1?redirect=https%3A%2F%2Fgithub.com%2Fsipcapture%2Fheplify&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://github.com/sipcapture/heplify">https://github.com/sipcapture/heplify</a></div></div><div><br></div><div><div><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/2?redirect=https%3A%2F%2Fgithub.com%2Fsipcapture%2Fcaptagent&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://github.com/sipcapture/captagent">https://github.com/sipcapture/captagent</a></div></div><div>You can run them on the same machines where you're running your sip services and send the captured traffic to a homer instance. </div><div><br></div><div>Cheers, </div><div><br></div><div>Federico </div></div><br><div class="gmail_quote"><div class="gmail_attr"><div>On Sat, 26 Oct 2019, 20:40 Igor Olhovskiy, <<a href="mailto:igorolhovskiy@gmail.com" title="mailto:igorolhovskiy@gmail.com">igorolhovskiy@gmail.com</a>> wrote:</div></div><blockquote><div>I'm trying to avoid SIP packet touching at all. Plus, I can't move third-party soft to other port/interface or so.</div><br><div>Idea is I don't want for Kamailio to be a proxy, but a sip packet analyzer for mirrored port, but on same machine.</div><br><div>On Oct 26 2019, at 6:40 pm, David Villasmil <<a href="mailto:david.villasmil.work@gmail.com" title="mailto:david.villasmil.work@gmail.com">david.villasmil.work@gmail.com</a>> wrote:</div><blockquote><div><div><div>Why not just receiving with kamailio and transparently proxying to the pbx after capturing? I.e.: kamailio in the middle</div></div><div><br><div class="gmail_quote"><div class="gmail_attr"><div>On Sat, 26 Oct 2019 at 14:46, Igor Olhovskiy <<a href="mailto:igorolhovskiy@gmail.com" title="mailto:igorolhovskiy@gmail.com">igorolhovskiy@gmail.com</a>> wrote:</div></div><blockquote><div>Hi!</div><br><div>I'm trying to get Kamailio working as a traffic capture on a same machine with other PBX software installed.</div><br><div>Actually, traffic is mirrored with</div><br><div><div>iptables -A PREROUTING -t mangle -i eth0 -p udp --dport 5060 -j TEE --gateway <a href="https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/0?redirect=127.0.0.2&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/0?redirect=127.0.0.2&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn">127.0.0.2</a></div><div>iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 5060 -j DNAT --to <a href="https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/1?redirect=127.0.0.1%3A5062&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/1?redirect=127.0.0.1%3A5062&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn">127.0.0.1:5062</a></div></div><br><div>Kamailio request route is super simple</div><div>request_route {</div><div>    xlog("L_ALERT", "[SIP-PACKET] Got packet [F=$fu R=$ru D=$du M=$rm IP=($si:$sp $Ri:$Rp) ID=$ci]\n");</div><div>    drop;</div><div>}</div><br><div>I was trying to get Kamailio just listen on interface <a href="http://127.0.0.1:5062" title="http://127.0.0.1:5062">127.0.0.1:5062</a>, but no luck</div><br><div>listen=udp:<a href="http://127.0.0.1:5062" title="http://127.0.0.1:5062">127.0.0.1:5062</a></div><br><div>Next was to use sipcapture module with following parameters</div><br><div>loadmodule "sipcapture.so"</div><div>modparam("sipcapture", "db_url", "text:///tmp/")</div><div>modparam("sipcapture", "raw_socket_listen", "127.0.0.1:5060-5062")</div><div>modparam("sipcapture", "raw_interface", "lo")</div><div>modparam("sipcapture", "promiscious_on", 1)</div><br><div>Also no luck. Means Kamailio can't see packets, but I see em with wireshark on lo interface.</div><br><div>What is best way to get it working? Or I'm missing something?</div><br><div>Thanks!</div><div>_______________________________________________</div><div>Kamailio (SER) - Users Mailing List</div><div><a href="mailto:sr-users@lists.kamailio.org" title="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a></div><div><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" title="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></div></blockquote></div></div><div>--</div><div><div><div>Regards,</div><div><br></div><div>David Villasmil</div><div>email: <a href="https://link.getmailspring.com/link/440604DA-8F73-4D71-9038-78658920F906@getmailspring.com/0?redirect=mailto%3Adavid.villasmil.work%40gmail.com&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://link.getmailspring.com/link/440604DA-8F73-4D71-9038-78658920F906@getmailspring.com/0?redirect=mailto%3Adavid.villasmil.work%40gmail.com&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn">david.villasmil.work@gmail.com</a></div><div>phone: +34669448337</div></div></div><div>_______________________________________________</div><div>Kamailio (SER) - Users Mailing List</div><div><a href="mailto:sr-users@lists.kamailio.org" title="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a></div><div><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" title="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></div></div></blockquote><div>_______________________________________________</div><div>Kamailio (SER) - Users Mailing List</div><div><a href="mailto:sr-users@lists.kamailio.org" title="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a></div><div><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" title="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></div></blockquote></div><div>_______________________________________________</div><div>Kamailio (SER) - Users Mailing List</div><div><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/3?redirect=mailto%3Asr-users%40lists.kamailio.org&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a></div><div><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/4?redirect=https%3A%2F%2Flists.kamailio.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fsr-users&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></div></blockquote></div><br><code><pre style="background-color:rgba(0,0,0,0.05);padding:0.2em 1em">_______________________________________________<br>Kamailio (SER) - Users Mailing List<br><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/5?redirect=mailto%3Asr-users%40lists.kamailio.org&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/6?redirect=https%3A%2F%2Flists.kamailio.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fsr-users&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a></pre></code></blockquote><code><pre style="background-color:rgba(0,0,0,0.05);padding:0.2em 1em">-- <br>Daniel-Constantin Mierla -- <a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/7?redirect=http%3A%2F%2Fwww.asipto.com&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="http://www.asipto.com">www.asipto.com</a><a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/8?redirect=http%3A%2F%2Fwww.twitter.com%2Fmiconda&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="http://www.twitter.com/miconda">www.twitter.com/miconda</a> -- <a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/9?redirect=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fmiconda&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="http://www.linkedin.com/in/miconda">www.linkedin.com/in/miconda</a><br>Kamailio Advanced Training, Oct 21-23, 2019, Berlin, Germany -- <a href="https://link.getmailspring.com/link/FC58412C-7C8D-41F2-B71C-F5829686C3D8@getmailspring.com/10?redirect=https%3A%2F%2Fasipto.com%2Fu%2Fkat&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn" title="https://asipto.com/u/kat">https://asipto.com/u/kat</a></pre></code></div></blockquote>