[SR-Users] Kamailio to capture mirrored traffic

[Henning Westerholt]

Hello Igor,

both methods (just capturing/logging with Kamailio or using sipcapture module) should work as well.

You listen statement looks ok. Do you actually see the packets entering Kamailio when you activate debug logging?

Cheers,

Henning

Am 26.10.19 um 15:45 schrieb Igor Olhovskiy:
Hi!

I'm trying to get Kamailio working as a traffic capture on a same machine with other PBX software installed.

Actually, traffic is mirrored with

iptables -A PREROUTING -t mangle -i eth0 -p udp --dport 5060 -j TEE --gateway 127.0.0.2<https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/0?redirect=127.0.0.2&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn>
iptables -t nat -A PREROUTING -d 127.0.0.2 -p udp --dport 5060 -j DNAT --to 127.0.0.1:5062<https://link.getmailspring.com/link/AB5F9D36-533D-4A52-ADE3-FB76B813163C@getmailspring.com/1?redirect=127.0.0.1%3A5062&recipient=c3ItdXNlcnNAbGlzdHMua2FtYWlsaW8ub3Jn>

Kamailio request route is super simple
request_route {
    xlog("L_ALERT", "[SIP-PACKET] Got packet [F=$fu R=$ru D=$du M=$rm IP=($si:$sp $Ri:$Rp) ID=$ci]\n");
    drop;
}

I was trying to get Kamailio just listen on interface 127.0.0.1:5062, but no luck

listen=udp:127.0.0.1:5062

Next was to use sipcapture module with following parameters

loadmodule "sipcapture.so"
modparam("sipcapture", "db_url", "text:///tmp/")
modparam("sipcapture", "raw_socket_listen", "127.0.0.1:5060-5062")
modparam("sipcapture", "raw_interface", "lo")
modparam("sipcapture", "promiscious_on", 1)

Also no luck. Means Kamailio can't see packets, but I see em with wireshark on lo interface.

What is best way to get it working? Or I'm missing something?

Thanks!



_______________________________________________
Kamailio (SER) - Users Mailing List
sr-users at lists.kamailio.org<mailto:sr-users at lists.kamailio.org>
https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users


--
Kamailio Merchandising - https://skalatan.de/merchandising/
Kamailio services - https://skalatan.de/services
Henning Westerholt - https://skalatan.de/blog/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.kamailio.org/pipermail/sr-users/attachments/20191027/2e545b88/attachment.html>