Hey All!
So as the title says, I am not real fond of homer. I suppose I could have spent more time with it and worked out all my grief, but ultimately its one or two more services and ips i have to devote to it. I can get what I want in a much simpler, and for me, faster way.
So, the trick here is using sngrep. If you haven't gotten acquainted, I would suggest doing so. It comes standard as part of the fusionpbx install now, which is cool!
Sngrep will show you a list of calls taken while its running, but like wireshark, tshark and homer, it will also read packet captures and show you the same thing. As i mentioned this can be used in near real time as sngrep can open running capture files, and give you calls up to the moment you opened it.
First, I am assuming sngrep is already installed, but if this is an older instance, follow the instructions here for package-based distros:
https://github.com/irontec/sngrep/wiki/Installing-Binaries
Alrighty, we are all installed, you are also going to need to install tcpdump and ngrep for fun, too.
Now, with that finished, you will want to run the following script:
The two lines in there are for captures with media and without. Sometimes (rarely) you need to diagnose audio issues, so the first tcpdump line does that. You may have to modify the device, the ports, and the rtp range depending on whether your carrier sends on non-standard ports. I now use bash sngrep-capture.sh and it runs in the background. the -G flag specifies the interval to save files in this case its in 30 minute (1800 second) intervals to keep files manageable.
It will create the captures in the directory you specify, so watch the file path. You will want to leave this running all the time, so you will need to delete the files, which will eat up tons of space if you’re not careful. 3 days is a good range and I only ever have under a 100 gig of captures on hand.
add the following to crontab:
What do we do now that we have files in our capture directory? Use the capital I(eye) flag for input, and lowercase l(ell) if you have a lot of calls on the system, to get over the default 20k message limit.
Use the filters in sngrep to pull up the call in question and boom! You have all the info you need and quickly! As soon as the call completes or during if your impatient...
That will do for pretty much all you could want to do. Another quick trick is that you can use the lowercase i flag to get just what you want at invocation.
A note about sngrep: It leaks memory, and bad. If you leave sngrep running, it will consume all the ram on the system. Might take a while depending on call volume, even with the default 20k message limit, but do keep that in mind. It will also crash on some types of malformed sip which you will encounter as you capture, nearly for sure, so consider compiling from source if you find it crashing while opening captures. The beauty of this is that it's fast, no waiting for the call to get stored into db... the search time on homer is stupid, unless it’s really well resourced. If you love homer, keep on lovin’ it. You might just find this is quicker, though.
Enjoy, folks!
Ian
So as the title says, I am not real fond of homer. I suppose I could have spent more time with it and worked out all my grief, but ultimately its one or two more services and ips i have to devote to it. I can get what I want in a much simpler, and for me, faster way.
So, the trick here is using sngrep. If you haven't gotten acquainted, I would suggest doing so. It comes standard as part of the fusionpbx install now, which is cool!
Sngrep will show you a list of calls taken while its running, but like wireshark, tshark and homer, it will also read packet captures and show you the same thing. As i mentioned this can be used in near real time as sngrep can open running capture files, and give you calls up to the moment you opened it.
First, I am assuming sngrep is already installed, but if this is an older instance, follow the instructions here for package-based distros:
https://github.com/irontec/sngrep/wiki/Installing-Binaries
Alrighty, we are all installed, you are also going to need to install tcpdump and ngrep for fun, too.
Now, with that finished, you will want to run the following script:
Code:
#Full capture with media/rtp
#tcpdump -nq -s 0 -i eth0 -G1800 -w Sip_w_RTP_%Y-%m-%d_%H:%M:%S.pcap port 5060 or port 5080 or udp portrange 16384-32767 &
#Sip capture on 5060 and 5080
tcpdump -nq -s 0 -i eth0 -G1800 -w /root/captures/Sip_Only_%Y-%m-%d_%H:%M:%S.pcap port 5060 or port 5080 &The two lines in there are for captures with media and without. Sometimes (rarely) you need to diagnose audio issues, so the first tcpdump line does that. You may have to modify the device, the ports, and the rtp range depending on whether your carrier sends on non-standard ports. I now use bash sngrep-capture.sh and it runs in the background. the -G flag specifies the interval to save files in this case its in 30 minute (1800 second) intervals to keep files manageable.
It will create the captures in the directory you specify, so watch the file path. You will want to leave this running all the time, so you will need to delete the files, which will eat up tons of space if you’re not careful. 3 days is a good range and I only ever have under a 100 gig of captures on hand.
add the following to crontab:
Code:
5 3 * * * /usr/bin/find /root/captures -type f -mtime +03 -exec rm -rf {} \;What do we do now that we have files in our capture directory? Use the capital I(eye) flag for input, and lowercase l(ell) if you have a lot of calls on the system, to get over the default 20k message limit.
Code:
sngrep -I Date-within30MinsOfCall.pcap -l 50000Use the filters in sngrep to pull up the call in question and boom! You have all the info you need and quickly! As soon as the call completes or during if your impatient...
That will do for pretty much all you could want to do. Another quick trick is that you can use the lowercase i flag to get just what you want at invocation.
Code:
#after the -i you can search for numbers, domain names, ips of endpoints or carriers etc
sngrep -I Date-within30MinsOfCall.pcap -i 5551234567A note about sngrep: It leaks memory, and bad. If you leave sngrep running, it will consume all the ram on the system. Might take a while depending on call volume, even with the default 20k message limit, but do keep that in mind. It will also crash on some types of malformed sip which you will encounter as you capture, nearly for sure, so consider compiling from source if you find it crashing while opening captures. The beauty of this is that it's fast, no waiting for the call to get stored into db... the search time on homer is stupid, unless it’s really well resourced. If you love homer, keep on lovin’ it. You might just find this is quicker, though.
Enjoy, folks!
Ian
