[Serusers] Formal SIP message logging

[Hendrik Scholz]

Hi!

Sahria Hao wrote:
> I want to get ONLY formal SIP message (ex. INVITE, REGISTER and more) by
> SER,
> like Cisco AS5300 debug mode (ex. # debug ccsip message).

You can use xlog() from the xlog module to save certain messages, i.e.
if (method=="REGISTER") {
  xlog("L_NOTICE", "%mb\n");
}

%mb = message body

The implemented specifiers are quite powerful so you might get around
logging full messages.

I started writing a passive 'IDS' based on SER for fun. Among other
features it has a pcap module that allows writing arbitrary SIP messages
to a common pcap file. It updates most IP+UDP headers but obviously
won't be able to reconstruct everything. If people are interested
I'd publish a patch.

Cheers,
 Hendrik

-- 
Hendrik Scholz
VoIP Systems Engineer

----------------------------------------------------------------------------
Telefon: + 49 (0) 431 90 20 552
Telefax: + 49 (0) 431 90 20 559
E-Mail: hendrik.scholz at freenet.ag
Website:  www.freenet.de; www.mobilcom.de
----------------------------------------------------------------------------
freenet Cityline GmbH
Ein Unternehmen der freenet AG
Hamburger Chaussee 2-4
24114 Kiel
----------------------------------------------------------------------------
Geschäftsführer: Eckhard Spoerr, Axel Krieger
Amtsgericht Kiel, HRB 6202