Hi, how about checking $Rp (http://www.kamailio.org/wiki/cookbooks/devel/pseudovariables#rp_-_received_port)? That would show, on which port the packet was received....
Thanks, Carsten 2016-11-15 8:43 GMT+01:00 andrzej.ciupek-asterisk.edu.pl <andrzej.ciu...@asterisk.edu.pl>: > Hello > > My point is to log INVITEs in my Network. My SIP Network work on port 6060. > Im am using HEP to do that, and hep clients that are listening on port range > 5060-6066 to detect some SIP attack to port 5060 and others. > But when I have attack to port 5060 I don't want to insert that INVITE to my > "good traffic" table, but place it to "fraud" table. > > Some devices like Panasonic PBX send INVITE to port 6060 so it is "good > traffic" but there is no port 6060 in URI, so I can't detect it in right > way, because $dp or $rp are 5060 by default. > > This kamailio work as capture server as "promiscuous_on", so I can't use any > "force_rport" etc. because I am only listening. Tcpdump for that SIP session > show me that client send traffic to 6060, but I can't get that information > from INVITE header. > > Greetings > > _______________________________________________ > SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list > sr-users@lists.sip-router.org > http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users -- Carsten Bock CEO (Geschäftsführer) ng-voice GmbH Millerntorplatz 1 20359 Hamburg / Germany http://www.ng-voice.com mailto:cars...@ng-voice.com Office +49 40 5247593-40 Fax +49 40 5247593-99 Sitz der Gesellschaft: Hamburg Registergericht: Amtsgericht Hamburg, HRB 120189 Geschäftsführer: Carsten Bock Ust-ID: DE279344284 Hier finden Sie unsere handelsrechtlichen Pflichtangaben: http://www.ng-voice.com/imprint/ _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
