[ERR] protocol_sip.c:141 This is not DIAMETER

[engineerham]

[ERR] protocol_sip.c:141 This is not DIAMETER

[engineerham]

Thanks for your response @kYroL01. My diameter server is up on the another machine apart from captagent server . I have attached the diameter pcap file and the captagent conf folder as well. I just want to send diameter and sip traffic to homer 10 for integrated monitoring over my service network.

captagent.zip
diameter-pcap.zip

[kYroL01]

Thanks @engineerham I will take a look asap and let you know

[kYroL01]

Hi @engineerham this error comes from here
This means that captagent does not recognize your Diamter traffic as valid.
As you know Diameter is a very customizable protocol so maybe the internal parser needs to be updated.
Can you provide more information ?

Thank you

[kYroL01]

Hi @engineerham sorry for the delay, I was busy.
On the very first test, I see that not all your Diameter pkts are parsed apparently
I see good parsing like

[INFO] protocol_diameter.c:108 JSON DIAMETER "diameter_info": {"class":"3GPP","type":"Answer","command":"UA","app-ID":16777216}

and I also see some

[ERR] protocol_sip.c:141 This is not DIAMETER

I will check it.

Just FYI it's also unnecessary to have all the modules enabled in your captagent.xml for performance, I will send you a better working version.

[kYroL01]

Hi again @engineerham

So, good news: your Diameter pcap contains all valid pkts that captagent parses perfectly.

What's happening is that you also have sip_profile enabled, and on any interfaces, so some packets are discarded by the BPF filter of the sip profile (port 5060) and the Diameter dissector does not parse them.

Various solution:

1. enable only diameter profile in socket_raw.xml and disable sip profile
2. specify the exact network interface name in dev param where diameter is flowing, here instead of any. The same for SIP.

So, if you don't have SIP, turn it off.

Another adjustment you need to make is the modules you need to enable, because makes no sense to have all the modules enabled, especially the socket ones.
This is what your captagent.xml should be IMHO

<?xml version="1.0"?>
<document type="captagent/xml">
	<configuration name="core.conf" description="CORE Settings" serial="2014024212">
	    <settings>
		<param name="debug" value="5"/>
		<param name="version" value="2"/>
		<param name="serial" value="2014056501"/>
		<param name="uuid" value="00781a4a-5b69-11e4-9522-bb79a8fcf0f3"/>
		<param name="daemon" value="false"/>
		<param name="syslog" value="false"/>
		<param name="pid_file" value="/var/run/captagent.pid"/>
		<!-- Configure using installation path if different from default -->
		<param name="module_path" value="/usr/local/captagent/lib/captagent/modules"/>
		<param name="config_path" value="/usr/local/captagent/etc/captagent/"/>
		<param name="capture_plans_path" value="/usr/local/captagent/etc/captagent/captureplans"/>
		<param name="backup" value="/usr/local/captagent/etc/captagent/backup"/>
		<param name="chroot" value="/usr/local/captagent/etc/captagent"/>
	    </settings>
	</configuration>
	<configuration name="modules.conf" description="Modules">
	    <modules>
		<load module="transport_hep" register="local"/>
		<load module="protocol_sip" register="local"/>
		<load module="protocol_rtcp" register="local"/>
		<load module="protocol_diameter" register="local"/>
		<load module="database_hash" register="local"/>	
		<load module="socket_pcap" register="local"/>
            </modules>
	</configuration>
</document>

Let me know if this resolves your problem.

Michele

[engineerham]

Hi @kYroL01.
Thanks for your response and considerations. You means that I have to capture sip and diameter on deferent interfaces?

[kYroL01]

Hi @engineerham if you can, it will be the best choice.
Thank you