Forums Read-only archive

Media Description - Can values be used for routing purposes?

26 posts · Brekeke SIP Server Forum

KentC Original post
1. Brekeke Product Name and version:
Brekeke Sip Server 2.0
2. Java version:
jre1.6
3. OS type and the version:
Centos 5.6 (Best Linux Distro on EARTH)
4. UA (phone), gateway or other hardware/software involved:
N/A
5. Select your network pattern from http://www.brekeke-sip.com/bbs/network/ ... terns.html :
Enterprise
6. Your problem:


Hi Team!

I just wanted to ask in the "Media Description" Line (Name and Address,etc in wireshark pcap) with the SDP, can the values in that line be used for routing purposes on Brekeke Sip Server? Please advise.

Thank you for your assistance!


Kent C.
james
Have you try $body?It can meet the requirement.


Which part of "m=" (as Media Description) do you want to check?
KentC
James,

Thanks for the info.


Can you please give me a dial-peer example of what you are describing, i have used the $body a few times but still learning that function.

I would like to try what you are implying.






Kent C.
james
So... Which part of Media Description do you want to check?
KentC
Basically want to check per-say if the field contains the port and media value 18 and/or 18 and 101 then $action=503. We are basically trying to keep away traffic that is g729 only. If it were to have g729 AND g711 then it would be fine.
KentC
I'll revisit this, i remember that function, and tried it but it didn't work as expected when i used it.










Kent C.
lakeview
If SDP's m= line doesn't have the value 0 (g711), return 503.

Code: 

[Matching Patterns]
  $request = ^INVITE 
  $sdp.audio("m") = !RTP/AVP.* 0

[Deploy Patterns]
  $action = 503
KentC
Thank you!!!

I will try such and report my findings! You are great.
KentC
lakeview wrote:If SDP's m= line doesn't have the value 0 (g711), return 503.

Code: 

[Matching Patterns]
  $request = ^INVITE 
  $sdp.audio("m") = !RTP/AVP.* 0

[Deploy Patterns]
  $action = 503
I have tried such and met with little success:

Code: 

m=audio 32050 RTP/AVP 18 101

c=IN IP4 MY.IP.ADDY.HERE
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20

Code: 

[Matching Patterns]
   	  $addr=IP\.IP\.IP\.IP
        $request=INVITE
        $sdp.audio("m")=!RTP/AVP.* 0

[Deploy Patterns]
        $action = 503
Please advise. I checked wireshark capture and still this rule doesn't block the codec.
hope
is the call sent from the IP set in the dail plan rule
KentC
Hi again.


Here is how the call breaks down:

[1] Carrier > [2] Main Production Inbound Brekeke Proxy [Public IP] > [3] Second Brekeke Proxy [Private IP] > [4] Netsapiens Virtual IP server [Termination]

1. Originates from ITSP
2. Traffic is routed to brekeke proxy
3. IMPORTANT *This is where the dial-plan is built, matching is from main brekeke,deploy is to Netsapiens Server*
4. Final routing which terms to a virtual IP/PBX

Please advise as all the suggested features have yet to be established. I'm desperate here team!


Kent C. :oops:
janP
> 3. IMPORTANT *This is where the dial-plan is built, matching is from main brekeke,deploy is to Netsapiens Server*

Which version of Brekeke SIP Server is it?
It must be Brekeke 3.0 or later if you use $sdp.audio.


The following rule will work at both ver 3 and 2.

Code: 

[Matching Patterns] 
  $request = ^INVITE 
  $body("(m=audio .+)") = !RTP/AVP.* 0

[Deploy Patterns] 
  $action = 503
KentC
I will test and update team. Thanks again for the info. We are using v2.








Kent C.
KentC
Hey everyone,

I've tested all the above, and nothing has worked on V2.

Can you please advise what else could be done here?

Matching Patterns
$addr=XX\.XX\.XX\.XX
$request=INVITE
$body("(m=audio .+)")=!RTP/AVP.* 0

Deploy Patterns
$action=503
&net.sip.loglevel.file=255


I'm going to retry on v3 and post results shortly.
Harold
The above rule with $body should work on version 2.
If you use $sdp.audio, the SIP Server must be version 3.


If you can, I recommend you to send DialPlan table file to Brekeke's team .
Harold
For adding $body in Matching Patterns.
The [Variable] part is
$body("(m=audio .+)")

The [Value] part is
!RTP/AVP.* 0


And, You must not include space characters within "m=audio".

> $body("(m = audio .+)")

It must be

> $body("(m=audio .+)")
KentC
Team,

Here is the update:

I used this and was able to finally get the 503:

Matching Patterns
$request=^INVITE
$body("(m=audio .+)")=!RTP/AVP.* 18 0 101

Deploy Patterns
$action=503
&net.sip.loglevel.file=255

This is PROGRESS. Thanks for the tip Harold. That was a win here. It looks in the patterns above like its spaced, but that $body is closed in together on the syntax, that worked. I just outta curiousity tried the extra codecs on accident and got the 503.

Now that we know that definitely works that way, I need to know
what I'm doing that I need to approach to get this as my final results:

We want it to route if it contains 0=PCMU/G711U but 503 if it doesn't.

I will continue to jump all over, please continue to help EVERYONE. You guys are amazing...I mean it...Thanks for making this SIP stuff doable..[/code]
KentC
Harold wrote:The above rule with $body should work on version 2.
If you use $sdp.audio, the SIP Server must be version 3.
Ok, not sure why, but i've configured it exactly like V2, i moved the .tbl from v2 sip server to v3 and overwrite on the dialplan.tbl on the v3.

I tried the following with several configurations to only get 404:

Matching Patterns
$request = ^INVITE
$sdp.audio("(m=audio .+)") = !RTP/AVP.* 0

Deploy Patterns
$action = 503
&net.sip.loglevel.file = 255


For the Top rule and here is dialplan that keeps not working for some reason even though I used the v2 .tbl.

Matching Patterns
$addr=IP\.IP\.IP\.IP
$request=INVITE
From=sip:(.+)

Deploy Patterns
To=sip:MYDIDPHONENUMBER@TERMIP
$rtp=true

Please advise again. Thanks!


Kent C.
hope
is it $sdp.audio("m") = !RTP/AVP.* 0 when use $sdp.audio?

which rule not work?
can you try one rule each time?
KentC
Hi,

I will, and post my finding. EDIT: Just re-read your post Hope and I will adjust my settings, and test as suggested.

Btw, v3 is alot better,there anything else I should know about that's not in v2 that's "recommended"?




Kent C.
Tata
> $body("(m = audio .+)")=!RTP/AVP.* 18 0 101

It seems you still have spaces with "m=" definition.

The RFC4566 http://tools.ietf.org/html/rfc4566 which defines SDP said:
Whitespace MUST NOT be used on either side of the "=" sign.


Set
$body("(m=audio .+)")
instead of
$body("(m = audio .+)")
Tata
> We want it to route if it contains 0=PCMU/G711U but 503 if it doesn't.

This is the rule.

Code: 

[Matching Patterns] 
  $request = ^INVITE 
  $body("(m=audio .+)")   =   !RTP/AVP.* 0 

[Deploy Patterns] 
  $action = 503
Note:
$body("(m=audio .+)") must be in the [Variable] part.
!RTP/AVP.* 0 must be in the [Value] part.
Tata
For getting "m=" line with $body
$body("(m=audio .+)")

For getting "m="line with $sdp.audio
$sdp.audio("m")


$body can match any line of any content-type (not only SDP).
Tata
> Btw, v3 is alot better,there anything else I should know about that's not in v2 that's "recommended"?

In DialPlan menu, there are new pages [Preliminary] and [History].
If you add rules under the [Preliminary], these rules will be executed for incoming requests before the SIP Server accepts them.
There is a couple of sample rules in
http://wiki.brekeke.com/wiki/Avoid-attacks

In the [History], there is the list of recently matched rules.
KentC
Thank you Tata! I have applied the settings now to v3 as well.
That is such a big improvement, glad they seperated those values in different sections.

Also,I have checked and applied the rule you are suggesting on v2:


Here is the SDP packet taken from my last Wireshark showing the SDP INVITE packet from sip server to the one I'm trying to regulate the 503 rule in:

Menubar>Analyze>Follow UDP Stream:

Code: 

m=audio 10004 RTP/AVP 18 0 8 101
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:20
a=fmtp:18 annexb=no
With the rule given and setup, can someone explain why this call still goes through but when i do something like 18 0 101 it's doing the 503?

Matching Patterns:
$body("(m=audio .+)") = !RTP/AVP.* 0 0

^
Even that 503's!!! What the heck!?

Matching Patterns:
$body("(m=audio .+)") = !RTP/AVP.* 0
^
Call still comes in.

2nd Q:
What does this do?

Code: 

Media Attribute (a): rtpmap:101 telephone-event/8000
^
???

Kent C.
Tata
! in the front of the regex value expresses "NOT".

"RTP/AVP.* 0" means "if there is 0" because the value doesn't have !.
"! RTP/AVP.* 0" means "if there is no 0" because the value has !.

Since 0 is G711U's payload type, the "! RTP/AVP.* 0" means "if the caller does NOT support G711U".



> $body("(m = audio .+)") = !RTP/AVP.* 0 0
> Even that 503's!!! What the heck!?

Because there is not "0 0" in m=audio line.


> $body("(m = audio .+)") = !RTP/AVP.* 0
> Call still comes in.

Because there is " 0 " in m=audio line.



> Media Attribute (a): rtpmap:101 telephone-event/8000

It is for telephone-events such as DTMF. It is not a codec.