Media Description - Can values be used for routing purposes?

KentC · Post by **KentC** » Thu Oct 04, 2012 2:26 pm

1. Brekeke Product Name and version:
Brekeke Sip Server 2.0
2. Java version:
jre1.6
3. OS type and the version:
Centos 5.6 (Best Linux Distro on EARTH)
4. UA (phone), gateway or other hardware/software involved:
N/A
5. Select your network pattern from http://www.brekeke-sip.com/bbs/network/ ... terns.html :
Enterprise
6. Your problem:

Hi Team!

I just wanted to ask in the "Media Description" Line (Name and Address,etc in wireshark pcap) with the SDP, can the values in that line be used for routing purposes on Brekeke Sip Server? Please advise.

Thank you for your assistance!

Kent C.

james · Post by **james** » Thu Oct 04, 2012 10:08 pm

Have you try $body?It can meet the requirement.

Which part of "m=" (as Media Description) do you want to check?

KentC · Post by **KentC** » Fri Oct 05, 2012 3:57 pm

James,

Thanks for the info.

Can you please give me a dial-peer example of what you are describing, i have used the $body a few times but still learning that function.

I would like to try what you are implying.

Kent C.

james · Post by **james** » Fri Oct 05, 2012 10:12 pm

So... Which part of Media Description do you want to check?

KentC · Post by **KentC** » Mon Oct 08, 2012 10:28 am

Basically want to check per-say if the field contains the port and media value 18 and/or 18 and 101 then $action=503. We are basically trying to keep away traffic that is g729 only. If it were to have g729 AND g711 then it would be fine.

KentC · Post by **KentC** » Mon Oct 15, 2012 8:45 pm

I'll revisit this, i remember that function, and tried it but it didn't work as expected when i used it.

Kent C.

lakeview · Post by **lakeview** » Tue Oct 16, 2012 9:45 pm

If SDP's m= line doesn't have the value 0 (g711), return 503.

Code: Select all

[Matching Patterns]
  $request = ^INVITE 
  $sdp.audio("m") = !RTP/AVP.* 0

[Deploy Patterns]
  $action = 503

KentC · Post by **KentC** » Sun Oct 21, 2012 2:10 pm

Thank you!!!

I will try such and report my findings! You are great.

KentC · Post by **KentC** » Mon Nov 12, 2012 3:46 pm

lakeview wrote:If SDP's m= line doesn't have the value 0 (g711), return 503.
Code: Select all
[Matching Patterns]
  $request = ^INVITE 
  $sdp.audio("m") = !RTP/AVP.* 0

[Deploy Patterns]
  $action = 503

I have tried such and met with little success:

Code: Select all

m=audio 32050 RTP/AVP 18 101

c=IN IP4 MY.IP.ADDY.HERE
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20

Code: Select all

[Matching Patterns]
   	  $addr=IP\.IP\.IP\.IP
        $request=INVITE
        $sdp.audio("m")=!RTP/AVP.* 0

[Deploy Patterns]
        $action = 503

Please advise. I checked wireshark capture and still this rule doesn't block the codec.

hope · Post by **hope** » Tue Nov 13, 2012 12:09 pm

is the call sent from the IP set in the dail plan rule

KentC · Post by **KentC** » Tue Nov 13, 2012 12:40 pm

Hi again.

Here is how the call breaks down:

[1] Carrier > [2] Main Production Inbound Brekeke Proxy [Public IP] > [3] Second Brekeke Proxy [Private IP] > [4] Netsapiens Virtual IP server [Termination]

1. Originates from ITSP
2. Traffic is routed to brekeke proxy
3. IMPORTANT *This is where the dial-plan is built, matching is from main brekeke,deploy is to Netsapiens Server*
4. Final routing which terms to a virtual IP/PBX

Please advise as all the suggested features have yet to be established. I'm desperate here team!

Kent C.

janP · Post by **janP** » Tue Nov 13, 2012 3:55 pm

> 3. IMPORTANT *This is where the dial-plan is built, matching is from main brekeke,deploy is to Netsapiens Server*

Which version of Brekeke SIP Server is it?
It must be Brekeke 3.0 or later if you use $sdp.audio.

The following rule will work at both ver 3 and 2.

Code: Select all

[Matching Patterns] 
  $request = ^INVITE 
  $body("(m=audio .+)") = !RTP/AVP.* 0

[Deploy Patterns] 
  $action = 503

KentC · Post by **KentC** » Tue Nov 13, 2012 4:49 pm

I will test and update team. Thanks again for the info. We are using v2.

Kent C.

KentC · Post by **KentC** » Mon Dec 03, 2012 9:31 am

Hey everyone,

I've tested all the above, and nothing has worked on V2.

Can you please advise what else could be done here?

Matching Patterns
$addr=XX\.XX\.XX\.XX
$request=INVITE
$body("(m=audio .+)")=!RTP/AVP.* 0

Deploy Patterns
$action=503
&net.sip.loglevel.file=255

I'm going to retry on v3 and post results shortly.

Harold · Post by **Harold** » Mon Dec 03, 2012 11:25 am

The above rule with $body should work on version 2.
If you use $sdp.audio, the SIP Server must be version 3.

If you can, I recommend you to send DialPlan table file to Brekeke's team .

Harold · Post by **Harold** » Mon Dec 03, 2012 11:35 am

For adding $body in Matching Patterns.
The [Variable] part is
$body("(m=audio .+)")

The [Value] part is
!RTP/AVP.* 0

And, You must not include space characters within "m=audio".

> $body("(m = audio .+)")

It must be

> $body("(m=audio .+)")

KentC · Post by **KentC** » Mon Dec 03, 2012 6:34 pm

Team,

Here is the update:

I used this and was able to finally get the 503:

Matching Patterns
$request=^INVITE
$body("(m=audio .+)")=!RTP/AVP.* 18 0 101

Deploy Patterns
$action=503
&net.sip.loglevel.file=255

This is PROGRESS. Thanks for the tip Harold. That was a win here. It looks in the patterns above like its spaced, but that $body is closed in together on the syntax, that worked. I just outta curiousity tried the extra codecs on accident and got the 503.

Now that we know that definitely works that way, I need to know
what I'm doing that I need to approach to get this as my final results:

We want it to route if it contains 0=PCMU/G711U but 503 if it doesn't.

I will continue to jump all over, please continue to help EVERYONE. You guys are amazing...I mean it...Thanks for making this SIP stuff doable..[/code]

KentC · Post by **KentC** » Mon Dec 03, 2012 7:35 pm

Harold wrote:The above rule with $body should work on version 2.
If you use $sdp.audio, the SIP Server must be version 3.

Ok, not sure why, but i've configured it exactly like V2, i moved the .tbl from v2 sip server to v3 and overwrite on the dialplan.tbl on the v3.

I tried the following with several configurations to only get 404:

Matching Patterns
$request = ^INVITE
$sdp.audio("(m=audio .+)") = !RTP/AVP.* 0

Deploy Patterns
$action = 503
&net.sip.loglevel.file = 255

For the Top rule and here is dialplan that keeps not working for some reason even though I used the v2 .tbl.

Matching Patterns
$addr=IP\.IP\.IP\.IP
$request=INVITE
From=sip:(.+)

Deploy Patterns
To=sip:MYDIDPHONENUMBER@TERMIP
$rtp=true

Please advise again. Thanks!

Kent C.

hope · Post by **hope** » Mon Dec 03, 2012 11:39 pm

is it $sdp.audio("m") = !RTP/AVP.* 0 when use $sdp.audio?

which rule not work?
can you try one rule each time?

KentC · Post by **KentC** » Tue Dec 04, 2012 9:42 am

Hi,

I will, and post my finding. EDIT: Just re-read your post Hope and I will adjust my settings, and test as suggested.

Btw, v3 is alot better,there anything else I should know about that's not in v2 that's "recommended"?

Kent C.

Tata · Post by **Tata** » Wed Dec 05, 2012 4:53 pm

> $body("(m = audio .+)")=!RTP/AVP.* 18 0 101

It seems you still have spaces with "m=" definition.

The RFC4566 http://tools.ietf.org/html/rfc4566 which defines SDP said:
Whitespace MUST NOT be used on either side of the "=" sign.

Set
$body("(m=audio .+)")
instead of
$body("(m = audio .+)")

Tata · Post by **Tata** » Wed Dec 05, 2012 5:01 pm

> We want it to route if it contains 0=PCMU/G711U but 503 if it doesn't.

This is the rule.

Code: Select all

[Matching Patterns] 
  $request = ^INVITE 
  $body("(m=audio .+)")   =   !RTP/AVP.* 0 

[Deploy Patterns] 
  $action = 503

Note:
$body("(m=audio .+)") must be in the [Variable] part.
!RTP/AVP.* 0 must be in the [Value] part.

Tata · Post by **Tata** » Wed Dec 05, 2012 5:08 pm

For getting "m=" line with $body
$body("(m=audio .+)")

For getting "m="line with $sdp.audio
$sdp.audio("m")

$body can match any line of any content-type (not only SDP).

Tata · Post by **Tata** » Wed Dec 05, 2012 5:20 pm

> Btw, v3 is alot better,there anything else I should know about that's not in v2 that's "recommended"?

In DialPlan menu, there are new pages [Preliminary] and [History].
If you add rules under the [Preliminary], these rules will be executed for incoming requests before the SIP Server accepts them.
There is a couple of sample rules in
http://wiki.brekeke.com/wiki/Avoid-attacks

In the [History], there is the list of recently matched rules.

KentC · Post by **KentC** » Tue Dec 11, 2012 11:39 am

Thank you Tata! I have applied the settings now to v3 as well.
That is such a big improvement, glad they seperated those values in different sections.

Also,I have checked and applied the rule you are suggesting on v2:

Here is the SDP packet taken from my last Wireshark showing the SDP INVITE packet from sip server to the one I'm trying to regulate the 503 rule in:

Menubar>Analyze>Follow UDP Stream:

Code: Select all

m=audio 10004 RTP/AVP 18 0 8 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:20
a=fmtp:18 annexb=no

With the rule given and setup, can someone explain why this call still goes through but when i do something like 18 0 101 it's doing the 503?

Matching Patterns:
$body("(m=audio .+)") = !RTP/AVP.* 0 0

^
Even that 503's!!! What the heck!?

Matching Patterns:
$body("(m=audio .+)") = !RTP/AVP.* 0
^
Call still comes in.

2nd Q:
What does this do?

Code: Select all

Media Attribute (a): rtpmap:101 telephone-event/8000

^
???

Kent C.