Comments (7)
Thanks for your response @kYroL01. My diameter server is up on the another machine apart from captagent server . I have attached the diameter pcap file and the captagent conf folder as well. I just want to send diameter and sip traffic to homer 10 for integrated monitoring over my service network.
captagent.zip
diameter-pcap.zip
from captagent.
Thanks @engineerham I will take a look asap and let you know
from captagent.
Hi @engineerham this error comes from here
This means that captagent does not recognize your Diamter traffic as valid.
As you know Diameter is a very customizable protocol so maybe the internal parser needs to be updated.
Can you provide more information ?
Thank you
from captagent.
Hi @engineerham sorry for the delay, I was busy.
On the very first test, I see that not all your Diameter pkts are parsed apparently
I see good parsing like
[INFO] protocol_diameter.c:108 JSON DIAMETER "diameter_info": {"class":"3GPP","type":"Answer","command":"UA","app-ID":16777216}
and I also see some
[ERR] protocol_sip.c:141 This is not DIAMETER
I will check it.
Just FYI it's also unnecessary to have all the modules enabled in your captagent.xml
for performance, I will send you a better working version.
from captagent.
Hi again @engineerham
So, good news: your Diameter pcap contains all valid pkts that captagent parses perfectly.
What's happening is that you also have sip_profile enabled, and on any
interfaces, so some packets are discarded by the BPF filter of the sip profile (port 5060) and the Diameter dissector does not parse them.
Various solution:
- enable only diameter profile in socket_raw.xml and disable sip profile
- specify the exact network interface name in
dev
param where diameter is flowing, here instead of any. The same for SIP.
So, if you don't have SIP, turn it off.
Another adjustment you need to make is the modules you need to enable, because makes no sense to have all the modules enabled, especially the socket ones.
This is what your captagent.xml should be IMHO
<?xml version="1.0"?>
<document type="captagent/xml">
<configuration name="core.conf" description="CORE Settings" serial="2014024212">
<settings>
<param name="debug" value="5"/>
<param name="version" value="2"/>
<param name="serial" value="2014056501"/>
<param name="uuid" value="00781a4a-5b69-11e4-9522-bb79a8fcf0f3"/>
<param name="daemon" value="false"/>
<param name="syslog" value="false"/>
<param name="pid_file" value="/var/run/captagent.pid"/>
<!-- Configure using installation path if different from default -->
<param name="module_path" value="/usr/local/captagent/lib/captagent/modules"/>
<param name="config_path" value="/usr/local/captagent/etc/captagent/"/>
<param name="capture_plans_path" value="/usr/local/captagent/etc/captagent/captureplans"/>
<param name="backup" value="/usr/local/captagent/etc/captagent/backup"/>
<param name="chroot" value="/usr/local/captagent/etc/captagent"/>
</settings>
</configuration>
<configuration name="modules.conf" description="Modules">
<modules>
<load module="transport_hep" register="local"/>
<load module="protocol_sip" register="local"/>
<load module="protocol_rtcp" register="local"/>
<load module="protocol_diameter" register="local"/>
<load module="database_hash" register="local"/>
<load module="socket_pcap" register="local"/>
</modules>
</configuration>
</document>
Let me know if this resolves your problem.
Michele
from captagent.
Hi @kYroL01.
Thanks for your response and considerations. You means that I have to capture sip and diameter on deferent interfaces?
from captagent.
Hi @engineerham if you can, it will be the best choice.
Thank you
from captagent.
Related Issues (20)
- Installing Captagent on Debian 11 not working correctly HOT 14
- captagent[3276431]: [ERR] protocol_sip.c:141 Couldnot find this call HOT 29
- Captagent Problem on Debian 11 HOT 5
- Problem with systemd captagent HOT 7
- TLS doesn't work for captagent HOT 1
- Multiple transport profiles HOT 6
- Captagent crashed: double free or corruption HOT 4
- Can not compile - Missing files? HOT 2
- Сaptagent does not capture traffic destined for the ipsec tunnel HOT 1
- captagent 6.4.1 DEB Missing the package dependencies: error while loading shared libraries: libfl.so.2: HOT 1
- Centos7 compile error HOT 8
- Is --enable-mysql option working ? HOT 4
- TODO: remove MySQL feature as not supported anymore
- "TLS has been not enabled." - even after fresh reinstall HOT 3
- Segmentation fault when specify a specific filter with Captagent 6.4.1 HOT 9
- segfault at 0 ip 00007f480b0167de sp 00007f480a40ec00 error 4 in socket_pcap.so HOT 15
- Segmentation fault socket_pcap.c Captagent 6.4.1 HOT 3
- Segfault with captagent version 6.4.1 on Debian 11 HOT 16
- have problem with debian 12 and capagent HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from captagent.