[SIPForum-discussion] How to filter SIP traffic based on SIP stack

[Tomasz Zieleniewski]

Hi,

You can do live filtering with all this tools,
but with wireshark that would be the easiest case (set filters)
Any way there are performance issues after some time,
because gathered data is decreasing free memory size.
Those tools are good for scenario testing not traffic monitoring.

Kind regards
Tomasz Zieleniewski


2009/3/12 Gauravkumar Raval <gaurav.raval at gmail.com>

> Hi,
>
> I am searching for live filtering (like firewall) application to
> filter traffic based on various configurable parameters (eg Field and
> Message constraints).
>
> Kindly share
>
> * Your experience with on-the-fly filtering and performance results.
>
> * Any RFC3303 ( Middlebox communication architecture and framework)
> based implementation.
>
>
> On Wed, Mar 11, 2009 at 11:34 AM, Tomasz Zieleniewski
> <tzieleniewski at gmail.com> wrote:
> >
> > Hi,
> >
> > Try wireshark, realy very good tools with lots of options to configure.
> > If You are using linux OS You can use tcpdump or ngrep.
>
> Is it possible to filter the traffic (in real time) using above
> mentioned tools?
>
> >
> > Regards
> >  Tomasz Zieleniewski
> >
> > 2009/3/10 Gauravkumar Raval <gaurav.raval at gmail.com>
> >>
> >> Hi,
> >>
> >> Can anyone help me filtering SIP traffic based on various field values
> >>  and/or regular expressions?
> >> While searching I come to following possible options.
> >>
> >> * L-7filter (Netfilter based)
> >> * Connection Tracker (Netfilter based)
> >> * HLBR (pcap based)
> >>
> >> But, I can't configure any of above successfully. Please, share your
> >> experience about configuring SIP packet capturing and filtering.
> >> (projects, rules, patch, notes... etc)
> >>
> >> Regards,
> >> Gaurav Raval
> >> http://gaurav.raval.googlepages.com
> >> _______________________________________________
> >> This is the SIP Forum discussion mailing list
> >> TO UNSUBSCRIBE, or edit your delivery options, please visit
> http://sipforum.org/mailman/listinfo/discussion
> >> Post to the list at discussion at sipforum.org
> >
>
> Regards,
>
> Gaurav Raval
> http://gaurav.raval.googlepages.com
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://sipforum.org/pipermail/discussion/attachments/20090313/2ae2effe/attachment-0002.html>