Looking at the ACCounting output from 0.8.10, the UA has the ability to hide the source. For example,
Jun 16 15:51:17 rave ser[25425]: ACC: transaction answered: method=INVITE, i-uri=sip:233200@addaline.com;user=phone, o-uri=sip:233200@64.90.42.10:5060;user=phone;transport=udp, call_id= 5f695344-4242-c6f9-2ec3-13fc1601e299@192.168.0.2, from= Anonymous sip:who@private.org;user=phone;tag=26a4758b-baa2-b388-8a63-25bb3019fb86, code=200
This actually came from the user '231146@addaline.com'. Is there some way to report the actual source, instead of the 'reported' source, in the accounting records? This was an authenticated call, and 231146 had to authenticate with a password before the INVITE was processed. The accounting modules is printing:
if (usesyslog) { LOG( log_level, "ACC: transaction answered: " "method=%.*s, i-uri=%.*s, o-uri=%.*s, call_id=%.*s, " "from=%.*s, code=%d\n", rq->first_line.u.request.method.len, rq->first_line.u.request.method.s, rq->first_line.u.request.uri.len, rq->first_line.u.request.uri.s, rq->new_uri.len, rq->new_uri.s, rq->callid->body.len, rq->callid->body.s, rq->from->body.len, rq->from->body.s, /* take a reply from message -- that's safe and we don't need to be worried about TM reply status being changed concurrently */ code ); }
How can I get the real source to print out on this LOG message?
Thanks, ---greg
I don't know what you mean by "real source" -- I mean acc prints what is in From and content of From header field is determined by user. If you mean digest identity, then there are several options: - upgrade to 8.11; acc module there can print digest id - enforce content of from to be same as digest identity; drop requests with anynymous/bizzar From and allow and report only such where From==digest_id
-Jiri
At 11:54 PM 6/16/2003, Greg Fausak wrote:
Looking at the ACCounting output from 0.8.10, the UA has the ability to hide the source. For example,
Jun 16 15:51:17 rave ser[25425]: ACC: transaction answered: method=INVITE, i-uri=sip:233200@addaline.com;user=phone, o-uri=sip:233200@64.90.42.10:5060;user=phone;transport=udp, call_id= 5f695344-4242-c6f9-2ec3-13fc1601e299@192.168.0.2, from= Anonymous <sip:who@private.org;user=phone>;tag=26a4758b-baa2-b388-8a63-25bb3019fb86, code=200This actually came from the user '231146@addaline.com'. Is there some way to report the actual source, instead of the 'reported' source, in the accounting records? This was an authenticated call, and 231146 had to authenticate with a password before the INVITE was processed. The accounting modules is printing:
if (usesyslog) { LOG( log_level, "ACC: transaction answered: " "method=%.*s, i-uri=%.*s, o-uri=%.*s, call_id=%.*s, " "from=%.*s, code=%d\n", rq->first_line.u.request.method.len, rq->first_line.u.request.method.s, rq->first_line.u.request.uri.len, rq->first_line.u.request.uri.s, rq->new_uri.len, rq->new_uri.s, rq->callid->body.len, rq->callid->body.s, rq->from->body.len, rq->from->body.s, /* take a reply from message -- that's safe and we don't need to be worried about TM reply status being changed concurrently */ code ); }
How can I get the real source to print out on this LOG message?
Thanks, ---greg
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
-- Jiri Kuthan http://iptel.org/~jiri/
Thanks,
I flipped to the 0.8.11, conversion is fairly easy.
How do I get the digest identity?
Also, when I include the gro I get this: Jun 16 23:35:46 rave /usr/new/sbin/ser[27993]: 412. N address=0x80c34e0 frag=0x80c34c8 size=8 Jun 16 23:35:46 rave /usr/new/sbin/ser[27991]: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Jun 16 23:35:46 rave /usr/new/sbin/ser[27990]: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Jun 16 23:35:46 rave /usr/new/sbin/ser[27992]: start check=f0f0f0f0, end check= c0c0c0c0, abcdefed Jun 16 23:35:46 rave /usr/new/sbin/ser[27989]: alloc'd from fifo_server.c: register_fifo_cmd(122) Jun 16 23:35:46 rave /usr/new/sbin/ser[27993]: alloc'd from name_ali
And ultimately a core dump. How do the groups work?
---greg
-----Original Message----- From: Jiri Kuthan [mailto:jiri@iptel.org] Sent: Monday, June 16, 2003 5:03 PM To: Greg Fausak; serusers@lists.iptel.org Cc: sip@august.net Subject: Re: [Serusers] ACC hiding source.
I don't know what you mean by "real source" -- I mean acc prints what is in From and content of From header field is determined by user. If you mean digest identity, then there are several options:
- upgrade to 8.11; acc module there can print digest id
- enforce content of from to be same as digest identity; drop requests with anynymous/bizzar From and allow and report only such where From==digest_id
-Jiri
At 11:54 PM 6/16/2003, Greg Fausak wrote:
Looking at the ACCounting output from 0.8.10, the UA has the ability to hide the source. For example,
Jun 16 15:51:17 rave ser[25425]: ACC: transaction answered: method=INVITE, i-uri=sip:233200@addaline.com;user=phone,o-uri=sip:233200@64.90.42.10:5060;user=phone;transport=udp, call_id=
5f695344-4242-c6f9-2ec3-13fc1601e299@192.168.0.2,from= Anonymous
sip:who@private.org;user=phone;tag=26a4758b-baa2-b388-8a63-2 5bb3019fb86,
code=200This actually came from the user '231146@addaline.com'. Is there some way to report the actual source, instead of the 'reported' source, in the accounting records? This was an authenticated call, and 231146 had to authenticate with a password before the INVITE was processed. The accounting modules is printing:
if (usesyslog) { LOG( log_level, "ACC: transaction answered: " "method=%.*s, i-uri=%.*s, o-uri=%.*s, call_id=%.*s, " "from=%.*s, code=%d\n", rq->first_line.u.request.method.len, rq->first_line.u.request.method.s, rq->first_line.u.request.uri.len, rq->first_line.u.request.uri.s, rq->new_uri.len, rq->new_uri.s, rq->callid->body.len, rq->callid->body.s, rq->from->body.len, rq->from->body.s, /* take a reply from message -- that's safe and
we don't need to be
worried about TM reply status being changedconcurrently */
code );}
How can I get the real source to print out on this LOG message?
Thanks, ---greg
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
-- Jiri Kuthan http://iptel.org/~jiri/
At 06:46 AM 6/17/2003, Greg Fausak wrote:
Thanks,
I flipped to the 0.8.11, conversion is fairly easy.
How do I get the digest identity?
Change the ("acc","log_fmt") parameter from default "miocfs" (each letter stands for a part of request, see acc/README) to include "u" (u stands for user) additionaly. If digest identity was not verified in script, "n/a" is printed instead.
And ultimately a core dump. How do the groups work?
Apparently, they don't :(
Are you sure you are using 8.11 core and modules? If not, there should be a warning in logs ("no version info", or "module version mismatch"). Otherwise, please be kind enough and send us your logs, and source+binaries+core (http://www.iptel.org/ser/bugs/), we will fix it.
Thanks,
-Jiri
-
Greg Fausak -
Jiri Kuthan -
lgfausakļ¼ august.net