Skip to content

Instantly share code, notes, and snippets.

@jesusprubio

jesusprubio/gist:5628075

Created May 22, 2013 14:44
Show Gist options
  • Save jesusprubio/5628075 to your computer and use it in GitHub Desktop.
Save jesusprubio/5628075 to your computer and use it in GitHub Desktop.
Download ZIP
Homer SIP Capture 3.5 kamailio.cfg file
Raw
gistfile1.txt
#!KAMAILIO
#
# Example configuration file for a sipcapture node
#
####### Global Parameters #########
debug=5
log_stderror=no
memdbg=5
memlog=5
log_facility=LOG_LOCAL0
fork=yes
children=5
/* uncomment the next line to disable TCP (default on) */
disable_tcp=yes
/* IP and port for HEP capturing) */
#listen=udp:<HOST_IP>:9060
#Max loops
max_while_loops=100
mpath="/usr/lib/kamailio/modules"
loadmodule "pv.so"
loadmodule "db_mysql.so"
loadmodule "sipcapture.so"
loadmodule "textops.so"
loadmodule "rtimer.so"
loadmodule "xlog.so"
loadmodule "sqlops.so"
loadmodule "htable.so"
loadmodule "sl.so"
loadmodule "siputils.so"
modparam("htable", "htable", "a=>size=8;autoexpire=400")
modparam("htable", "htable", "b=>size=8;autoexpire=31")
modparam("rtimer", "timer", "name=ta;interval=60;mode=1;")
modparam("rtimer", "exec", "timer=ta;route=TIMER_STATS")
modparam("sqlops","sqlcon","cb=>mysql://<MYSQL_USER>:<MYSQL_PASS>@127.0.0.1/homer_db")
# ----- mi_fifo params -----
####### Routing Logic ########
modparam("sipcapture", "db_url", "mysql://<MYSQL_USER>:<MYSQL_PASS>@localhost/homer_db")
modparam("sipcapture", "capture_on", 1)
/* activate HEP capturing */
modparam("sipcapture", "hep_capture_on", 1)
/* IP to listen. Port/Portrange apply only on mirroring port capturing */
modparam("sipcapture", "raw_socket_listen", "10.0.0.0:5060-5090")
/* Name of interface to bind on raw socket */
modparam("sipcapture", "raw_interface", "eth0")
/* activate IPIP capturing */
modparam("sipcapture", "raw_ipip_capture_on", 0)
/* My table name*/
modparam("sipcapture", "table_name", "sip_capture")
/* children for raw socket */
modparam("sipcapture", "raw_sock_children", 4)
/* insert delayed */
#modparam("sipcapture", "db_insert_mode", 1)
/* activate monitoring/mirroring port capturing. Linux only */
modparam("sipcapture", "raw_moni_capture_on", 1)
/* Promiscious mode RAW socket. Mirroring port. Linux only */
modparam("sipcapture", "promiscious_on", 1)
/* activate Linux Socket Filter (LSF/BPF) on mirroring interface. Linux only */
#modparam("sipcapture", "raw_moni_bpf_on", 1)
/* !!! old schema !!!! */
#modparam("sipcapture", "authorization_column", "authorization")
# Main SIP request routing logic
# - processing of any incoming SIP request starts with this route
route {
xlog("ANTON: recibido paquete!!");
if($sht(a=>method::all) == $null) $sht(a=>method::all) = 0;
$sht(a=>method::all) = $sht(a=>method::all) + 1;
if($sht(b=>$rm::$cs::$ci) != $null) {
$var(a) = "sip_capture";
# Kamailio 4.1 only
#sip_capture("$var(a)");
sip_capture();
drop;
}
$sht(b=>$rm::$cs::$ci) = 1;
if (is_method("INVITE|REGISTER")) {
if($ua =~ "(friendly-scanner|sipvicious)") {
sql_query("cb", "INSERT INTO alarm_data_mem (create_date, type, total, source_ip, description) VALUES(NOW(), 'scanner', 1, '$si', 'Friendly scanner alarm!') ON DUPLICATE KEY UPDATE total=total+1");
}
if($ua =~ "(scanner|bluebox)") {
sql_query("cb", "INSERT INTO alarm_data_mem (create_date, type, total, source_ip, description) VALUES(NOW(), 'scanner', 1, '$si', 'Scanner alarm!') ON DUPLICATE KEY UPDATE total=total+1");
}
#IP Method
sql_query("cb", "INSERT INTO stats_ip_mem ( method, source_ip, total) VALUES('$rm', '$si', 1) ON DUPLICATE KEY UPDATE total=total+1");
if($au != $null) $var(anumber) = $au;
else $var(anumber) = $fU;
#hostname in contact
if($sel(contact.uri.host) =~ "^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$") {
if($sht(a=>alarm::dns) == $null) $sht(a=>alarm::dns) = 0;
$sht(a=>alarm::dns) = $sht(a=>alarm::dns) + 1;
}
if($sel(contact.uri.host) != $si) {
if($sht(a=>alarm::spoofing) == $null) $sht(a=>alarm::spoofing) = 0;
$sht(a=>alarm::spoofing) = $sht(a=>alarm::spoofing) + 1;
}
if($au =~ "(\=)|(\-\-)|(\')|(\#)|(\%27)|(\%24)") {
if($sht(a=>alarm::sqlinjection) == $null) $sht(a=>alarm::sqlinjection) = 0;
$sht(a=>alarm::sqlinjection) = $sht(a=>alarm::sqlijnection) + 1;
}
if($(hdr(Record-Route)[0]{nameaddr.uri}) != $si) {
if($sht(a=>alarm::spoofing) == $null) $sht(a=>alarm::spoofing) = 0;
$sht(a=>alarm::spoofing) = $sht(a=>alarm::spoofing) + 1;
}
if (is_method("INVITE")) {
if (has_totag()) {
if($sht(a=>method::reinvite) == $null) $sht(a=>method::reinvite) = 0;
$sht(a=>method::reinvite) = $sht(a=>method::reinvite) + 1;
}
else {
if($sht(a=>method::invite) == $null) $sht(a=>method::invite) = 0;
$sht(a=>method::invite) = $sht(a=>method::invite) + 1;
if($adu != $null) {
if($sht(a=>method::invite::auth) == $null) $sht(a=>method::invite::auth) = 0;
$sht(a=>method::invite::auth) = $sht(a=>method::invite::auth) + 1;
}
if($ua != $null) {
sql_query("cb", "INSERT INTO stats_useragent_mem (useragent, method, total) VALUES('$ua', 'INVITE', 1) ON DUPLICATE KEY UPDATE total=total+1");
}
}
}
else {
if($sht(a=>method::register) == $null) $sht(a=>method::register) = 0;
$sht(a=>method::register) = $sht(a=>method::register) + 1;
if($adu != $null) {
if($sht(a=>method::register::auth) == $null) $sht(a=>method::register::auth) = 0;
$sht(a=>method::register::auth) = $sht(a=>method::register::auth) + 1;
}
if($ua != $null) {
sql_query("cb", "INSERT INTO stats_useragent_mem (useragent, method, total) VALUES('$ua', 'REGISTER', 1) ON DUPLICATE KEY UPDATE total=total+1");
}
}
}
else if(is_method("BYE")) {
if($sht(a=>method::bye) == $null) $sht(a=>method::bye) = 0;
$sht(a=>method::bye) = $sht(a=>method::bye) + 1;
if(is_present_hf("Reason")) {
$var(cause) = $(hdr(Reason){param.value,cause}{s.int});
if($var(cause) != 16 && $var(cause) !=17) {
if($sht(a=>stats::sdf) == $null) $sht(a=>stats::sdf) = 0;
$sht(a=>stats::sdf) = $sht(a=>stats::sdf) + 1;
}
}
}
else if(is_method("CANCEL")) {
if($sht(a=>method::cancel) == $null) $sht(a=>method::cancel) = 0;
$sht(a=>method::cancel) = $sht(a=>method::cancel) + 1;
}
else if(is_method("OPTIONS")) {
if($sht(a=>method::options) == $null) $sht(a=>method::options) = 0;
$sht(a=>method::options) = $sht(a=>method::options) + 1;
}
else if(is_method("REFER")) {
if($sht(a=>method::refer) == $null) $sht(a=>method::refer) = 0;
$sht(a=>method::refer) = $sht(a=>method::refer) + 1;
}
else if(is_method("UPDATE")) {
if($sht(a=>method::update) == $null) $sht(a=>method::update) = 0;
$sht(a=>method::update) = $sht(a=>method::update) + 1;
}
$var(a) = "sip_capture";
# Kamailio 4.1 only
#sip_capture("$var(a)");
sip_capture();
drop;
}
onreply_route {
if($sht(a=>method::all) == $null) $sht(a=>method::all) = 0;
$sht(a=>method::all) = $sht(a=>method::all) + 1;
if($sht(b=>$rs::$cs::$rm::$ci) != $null) {
$var(a) = "sip_capture";
# Kamailio 4.1 only
#sip_capture("$var(a)");
sip_capture();
drop;
}
$sht(b=>$rs::$cs::$rm::$ci) = 1;
#413 Too large
if(status == "413") {
if($sht(a=>alarm::413) == $null) $sht(a=>alarm::413) = 0;
$sht(a=>alarm::413) = $sht(a=>alarm::413) + 1;
}
# Too many hops
else if(status == "483") {
if($sht(a=>alarm::483) == $null) $sht(a=>alarm::483) = 0;
$sht(a=>alarm::483) = $sht(a=>alarm::483) + 1;
}
# loops
else if(status == "482") {
if($sht(a=>alarm::482) == $null) $sht(a=>alarm::482) = 0;
$sht(a=>alarm::482) = $sht(a=>alarm::482) + 1;
}
# Call Transaction Does not exist
else if(status == "481") {
if($sht(a=>alarm::481) == $null) $sht(a=>alarm::481) = 0;
$sht(a=>alarm::481) = $sht(a=>alarm::481) + 1;
}
# 408 Timeout
else if(status == "408") {
if($sht(a=>alarm::408) == $null) $sht(a=>alarm::408) = 0;
$sht(a=>alarm::408) = $sht(a=>alarm::408) + 1;
}
# 400
else if(status == "400") {
if($sht(a=>alarm::400) == $null) $sht(a=>alarm::400) = 0;
$sht(a=>alarm::400) = $sht(a=>alarm::400) + 1;
}
# MOVED
else if(status =~ "^(30[012])$") {
if($sht(a=>response::300) == $null) $sht(a=>response::300) = 0;
$sht(a=>response::300) = $sht(a=>response::300) + 1;
}
if($rm == "INVITE") {
#ISA
if(status =~ "^(408|50[03])$") {
if($sht(a=>stats::isa) == $null) $sht(a=>stats::isa) = 0;
$sht(a=>stats::isa) = $sht(a=>stats::isa) + 1;
}
#Bad486
if(status =~ "^(486|487|603)$") {
if($sht(a=>stats::bad::invite) == $null) $sht(a=>stats::bad::invite) = 0;
$sht(a=>stats::bad::invite) = $sht(a=>stats::bad::invite) + 1;
}
#SD
if(status =~ "^(50[034])$") {
if($sht(a=>stats::sd) == $null) $sht(a=>stats::sd) = 0;
$sht(a=>stats::sd) = $sht(a=>stats::sd) + 1;
}
if(status == "407") {
if($sht(a=>response::407::invite) == $null) $sht(a=>response::407::invite)= 0;
$sht(a=>response::407::invite) = $sht(a=>response::407::invite) + 1;
}
else if(status == "401") {
if($sht(a=>response::401::invite) == $null) $sht(a=>response::401::invite)= 0;
$sht(a=>response::401::invite) = $sht(a=>response::401::invite) + 1;
}
else if(status == "200") {
if($sht(a=>response::200::invite) == $null) $sht(a=>response::200::invite)= 0;
$sht(a=>response::200::invite) = $sht(a=>response::200::invite) + 1;
}
}
else if($rm == "BYE") {
if(status == "407") {
if($sht(a=>response::407::bye) == $null) $sht(a=>response::407::bye) = 0;
$sht(a=>response::407::bye) = $sht(a=>response::407::bye) + 1;
}
else if(status == "401") {
if($sht(a=>response::401::bye) == $null) $sht(a=>response::401::bye) = 0;
$sht(a=>response::401::bye) = $sht(a=>response::401::bye) + 1;
}
else if(status == "200") {
if($sht(a=>response::200::bye) == $null) $sht(a=>response::200::bye) = 0;
$sht(a=>response::200::bye) = $sht(a=>response::200::bye) + 1;
}
}
sip_capture();
drop;
}
route[TIMER_STATS] {
xlog("timer routine: time is $TS\n");
#ALARM SCANNERS
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, source_ip, description) SELECT create_date, type, total, source_ip, description FROM alarm_data_mem;");
sql_query("cb", "TRUNCATE TABLE alarm_data_mem");
#413
if($sht(a=>alarm::413) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Big messages', $sht(a=>alarm::413), 'Too many big messages')");
$sht(a=>alarm::413) = 0;
}
#483
if($sht(a=>alarm::483) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Too many hops', $sht(a=>alarm::483), 'Too many hops messages')");
$sht(a=>alarm::483) = 0;
}
#482
if($sht(a=>alarm::482) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Loops detected', $sht(a=>alarm::482), 'Too many loops messages')");
$sht(a=>alarm::482) = 0;
}
#481
if($sht(a=>alarm::481) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Too Many 481', $sht(a=>alarm::481), 'Call transaction does not exist')");
$sht(a=>alarm::481) = 0;
}
#408
if($sht(a=>alarm::408) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Too Many 408', $sht(a=>alarm::408), 'Timeout')");
$sht(a=>alarm::408) = 0;
}
#400
if($sht(a=>alarm::400) > 0) {
sql_query("cb", "INSERT INTO alarm_data (create_date, type, total, description) VALUES(NOW(), 'Bad Request detected', $sht(a=>alarm::400), 'Too many bad request')");
$sht(a=>alarm::400) = 0;
}
#SQL STATS
$var(tm) = ($time(min) mod 10);
if($var(tm) != 0 && $var(tm) != 5) return;
$var(t1) = $TS;
$var(t2) = $var(t1) - 300;
xlog("TIME : $var(tm)\n");
$var(t_date) = "FROM_UNIXTIME(" + $var(t1) + ", '%Y-%m-%d %H:%i:00')";
$var(f_date) = "FROM_UNIXTIME(" + $var(t2) + ", '%Y-%m-%d %H:%i:00')";
#STATS Useragent
sql_query("cb", "INSERT INTO stats_useragent (from_date, to_date, useragent, method, total) SELECT $var(f_date) as from_date, $var(t_date) as to_date, useragent, method, total FROM stats_useragent_mem;");
sql_query("cb", "TRUNCATE TABLE stats_useragent_mem");
#STATS IP
sql_query("cb", "INSERT INTO stats_ip (from_date, to_date, method, source_ip, total) SELECT $var(f_date) as from_date, $var(t_date) as to_date, method, source_ip, total FROM stats_ip_mem;");
sql_query("cb", "TRUNCATE TABLE stats_ip_mem");
#INSERT SQL STATS
#SDF
if($sht(a=>stats::sdf) != $null && $sht(a=>stats::sdf) > 0) {
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'sdf', $sht(a=>stats::sdf))");
$sht(a=>stats::sdf) = 0;
}
#ISA
if($sht(a=>stats::isa) != $null && $sht(a=>stats::isa) > 0) {
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'isa', $sht(a=>stats::isa))");
$sht(a=>stats::isa) = 0;
}
#SD
if($sht(a=>stats::sd) != $null && $sht(a=>stats::sd) > 0) {
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'isa', $sht(a=>stats::sd))");
$sht(a=>stats::sd) = 0;
}
#SSR
if($sht(a=>stats::ssr) != $null && $sht(a=>stats::ssr) > 0) {
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'ssr', $sht(a=>stats::ssr))");
$sht(a=>stats::ssr) = 0;
}
#ASR
$var(asr) = 0;
#if($sht(a=>response::200::invite) > 0) {
if($sht(a=>method::invite) > 0) {
if($sht(a=>response::407::invite) == $null) $sht(a=>response::407::invite) = 0;
if($sht(a=>response::200::invite) == $null) $sht(a=>response::200::invite) = 0;
$var(d) = $sht(a=>method::invite) - $sht(a=>response::407::invite);
if($var(d) > 0) {
$var(asr) = $sht(a=>response::200::invite) / $var(d) * 100;
if($var(asr) > 100) $var(asr) = 100;
}
}
#Stats DATA
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'asr', $var(asr))");
#NER
$var(ner) = 0;
#if($sht(a=>response::200::invite) > 0 || $sht(a=>stats::bad::invite) > 0) {
if($sht(a=>method::invite) > 0) {
if($sht(a=>response::200::invite) == $null) $sht(a=>response::200::invite) = 0;
if($sht(a=>response::bad::invite) == $null) $sht(a=>response::bad::invite) = 0;
if($sht(a=>response::407::invite) == $null) $sht(a=>response::407::invite) = 0;
$var(d) = $sht(a=>method::invite) - $sht(a=>response::407::invite);
if($var(d) > 0) {
$var(ner) = ($sht(a=>response::200::invite) + $sht(a=>stats::bad::invite)) / $var(d) * 100;
if($var(ner) > 100) $var(ner) = 100;
}
}
sql_query("cb", "INSERT INTO stats_data (from_date, to_date, type, total) VALUES($var(f_date), $var(t_date), 'ner', $var(ner))");
#INVITE
if($sht(a=>method::invite) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, totag, total) VALUES($var(f_date), $var(t_date),'INVITE', 1, $sht(a=>method::reinvite))");
$sht(a=>method::reinvite) = 0;
}
#INVITE
if($sht(a=>method::invite) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'INVITE', $sht(a=>method::invite))");
$sht(a=>method::invite) = 0;
}
#INVITE AUTH
if($sht(a=>method::invite::auth) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, auth, total) VALUES($var(f_date), $var(t_date), 'INVITE', 1, $sht(a=>method::invite::auth))");
$sht(a=>method::invite::auth) = 0;
}
#REGISTER
if($sht(a=>method::register) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'REGISTER', $sht(a=>method::register))");
$sht(a=>method::register) = 0;
}
#REGISTER AUTH
if($sht(a=>method::register::auth) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, auth, total) VALUES($var(f_date), $var(t_date), 'REGISTER', 1, $sht(a=>method::register::auth))");
$sht(a=>method::register::auth) = 0;
}
#BYE
if($sht(a=>method::bye) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'BYE', $sht(a=>method::bye))");
$sht(a=>method::bye) = 0;
}
#CANCEL
if($sht(a=>method::cancel) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'CANCEL', $sht(a=>method::cancel))");
$sht(a=>method::cancel) = 0;
}
#OPTIONS
if($sht(a=>method::options) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'OPTIONS', $sht(a=>method::options))");
$sht(a=>method::options) = 0;
}
#REFER
if($sht(a=>method::refer) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'REFER', $sht(a=>method::refer))");
$sht(a=>method::refer) = 0;
}
#UPDATE
if($sht(a=>method::update) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'UPDATE', $sht(a=>method::update))");
$sht(a=>method::update) = 0;
}
#RESPONSE
#300
if($sht(a=>response::300) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), '300', $sht(a=>response::300))");
$sht(a=>response::300) = 0;
}
#407 INVITE
if($sht(a=>response::407::invite) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '407', 'INVITE', $sht(a=>response::407::invite))");
$sht(a=>response::407::invite) = 0;
}
#401 INVITE
if($sht(a=>response::401::invite) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '401', 'INVITE', $sht(a=>response::401::invite))");
$sht(a=>response::401::invite) = 0;
}
#200 INVITE
if($sht(a=>response::200::invite) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '200', 'INVITE', $sht(a=>response::200::invite))");
$sht(a=>response::200::invite) = 0;
}
#407 BYE
if($sht(a=>response::407::bye) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '407', 'BYE', $sht(a=>response::407::bye))");
$sht(a=>response::407::bye) = 0;
}
#401 BYE
if($sht(a=>response::401::bye) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '401', 'BYE', $sht(a=>response::401::bye))");
$sht(a=>response::401::bye) = 0;
}
#200 BYE
if($sht(a=>response::200::bye) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, cseq, total) VALUES($var(f_date), $var(t_date), '200', 'BYE', $sht(a=>response::200::bye))");
$sht(a=>response::200::bye) = 0;
}
#ALL MESSAGES
if($sht(a=>method::all) > 0) {
sql_query("cb", "INSERT INTO stats_method (from_date, to_date, method, total) VALUES($var(f_date), $var(t_date), 'ALL', $sht(a=>method::all))");
$sht(a=>method::all) = 0;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment