[SR-Users] How to get Destination port UDP

[Carsten Bock]

Hi,

how about checking $Rp
(http://www.kamailio.org/wiki/cookbooks/devel/pseudovariables#rp_-_received_port)?
That would show, on which port the packet was received....

Thanks,
Carsten

2016-11-15 8:43 GMT+01:00 andrzej.ciupek-asterisk.edu.pl
<andrzej.ciupek at asterisk.edu.pl>:
> Hello
>
> My point is to log INVITEs in my Network. My SIP Network work on port 6060.
> Im am using HEP to do that, and hep clients that are listening on port range
> 5060-6066 to detect some SIP attack to port 5060 and others.
> But when I have attack to port 5060 I don't want to insert that INVITE to my
> "good traffic" table, but place it to "fraud" table.
>
> Some devices like Panasonic PBX send INVITE to port 6060 so it is "good
> traffic" but there is no port 6060 in URI, so I can't detect it in right
> way, because $dp or $rp are 5060 by default.
>
> This kamailio work as capture server as "promiscuous_on", so I can't use any
> "force_rport" etc. because I am only listening. Tcpdump for that SIP session
> show me that client send traffic to 6060, but I can't get that information
> from INVITE header.
>
> Greetings
>
> _______________________________________________
> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
> sr-users at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users



-- 
Carsten Bock
CEO (Geschäftsführer)

ng-voice GmbH
Millerntorplatz 1
20359 Hamburg / Germany

http://www.ng-voice.com
mailto:carsten at ng-voice.com

Office +49 40 5247593-40
Fax +49 40 5247593-99

Sitz der Gesellschaft: Hamburg
Registergericht: Amtsgericht Hamburg, HRB 120189
Geschäftsführer: Carsten Bock
Ust-ID: DE279344284

Hier finden Sie unsere handelsrechtlichen Pflichtangaben:
http://www.ng-voice.com/imprint/