SipCapture Module

Alexandr Dubovikov

Edited by

Alexandr Dubovikov

Table of Contents

1. Admin Guide
1.1. Overview
1.2. Dependencies
1.2.1. OpenSIPS Modules
1.2.2. External Libraries or Applications
1.3. Parameters
1.3.1. db_url (str)
1.3.2. table_name (str)
1.3.3. capture_on (integer)
1.3.4. hep_capture_on (integer)
1.3.5. max_async_queries (integer)
1.3.6. raw_ipip_capture_on (integer)
1.3.7. raw_moni_capture_on (integer)
1.3.8. raw_socket_listen (string)
1.3.9. raw_interface (string)
1.3.10. raw_sock_children (integer)
1.3.11. promiscuous_on (integer)
1.3.12. raw_moni_bpf_on (integer)
1.3.13. capture_node (str)
1.4. Exported Functions
1.4.1. sip_capture()
1.5. Exported Async Functions
1.5.1. sip_capture()
1.6. MI Commands
1.6.1. sip_capture
1.7. Database setup
1.8. Limitation

List of Examples

1.1. Set db_url parameter
1.2. Set sip_capture parameter
1.3. Set capture_on parameter
1.4. Set hep_capture_on parameter
1.5. Set max_async_queries parameter
1.6. Set raw_ipip_capture_on parameter
1.7. Set raw_moni_capture_on parameter
1.8. Set raw_socket_listen parameter
1.9. Set raw_socket_listen parameter
1.10. Set raw_socket_listen parameter
1.11. Set promiscuous_on parameter
1.12. Set raw_moni_bpf_on parameter
1.13. Set capture_node parameter
1.14. sip_capture usage
1.15. sip_capture usage

Chapter 1. Admin Guide

1.1. Overview

Offer a possibility to store incoming/outgoing SIP messages in database.

OpenSIPs can capture SIP messages in three mode

  • IPIP encapsulation. (ETHHDR+IPHDR+IPHDR+UDPHDR).

  • Monitoring/mirroring port.

  • Homer encapsulation protocl mode (HEP v1).

The capturing can be turned on/off using fifo commad.

opensipsctl fifo sip_capture on

opensipsctl fifo sip_capture off

1.2. Dependencies

1.2.1. OpenSIPS Modules

The following modules must be loaded before this module:

  • database module - mysql, postrgress, dbtext, unixodbc...

1.2.2. External Libraries or Applications

The following libraries or applications must be installed before running OpenSIPS with this module loaded:

  • None.

1.3. Parameters

1.3.1. db_url (str)

Database URL.

Default value is "".

Example 1.1. Set db_url parameter

modparam("sipcapture", "db_url", "mysql://user:passwd@host/dbname")

1.3.2. table_name (str)

Name of the table's name where to store the SIP messages.

Default value is "sip_capture".

Example 1.2. Set sip_capture parameter

modparam("sipcapture", "table_name", "homer_capture")

1.3.3. capture_on (integer)

Parameter to enable/disable capture globaly (on(1)/off(0))

Default value is "0".

Example 1.3. Set capture_on parameter

modparam("sipcapture", "capture_on", 1)

1.3.4. hep_capture_on (integer)

Parameter to enable/disable capture of HEP (on(1)/off(0))

Default value is "0".

Example 1.4. Set hep_capture_on parameter

modparam("sipcapture", "hep_capture_on", 1)

1.3.5. max_async_queries (integer)

Parameter to set the maximum number of 'INSERT' queries of captured packets to be done in the same time, only if the DB supports async operations. If OpenSIPS is shut down, the remaining queries shall be executed. The query buffer is limited 65535 chars, so probably no more than 30-40 queries can be done in the same time, depending mostly on the size of the inserted sip message, since it's the biggest part of the query.

Default value is "5".

Example 1.5. Set max_async_queries parameter

modparam("sipcapture", "max_async_queries", 3)

1.3.6. raw_ipip_capture_on (integer)

Parameter to enable/disable IPIP capturing (on(1)/off(0))

Default value is "0".

Example 1.6. Set raw_ipip_capture_on parameter

modparam("sipcapture", "raw_ipip_capture_on", 1)

1.3.7. raw_moni_capture_on (integer)

Parameter to enable/disable monitoring/mirroring port capturing (on(1)/off(0)) Only one mode on raw socket can be enabled! Monitoring port capturing currently supported only on Linux.

Default value is "0".

Example 1.7. Set raw_moni_capture_on parameter

modparam("sipcapture", "raw_moni_capture_on", 1)

1.3.8. raw_socket_listen (string)

Parameter indicate an listen IP address of RAW socket for IPIP capturing. You can also define a port/portrange for IPIP/Mirroring mode, to capture SIP messages in specific ports:

"" - the source/destination port of the SIP message must be equal 5060

"" - the source/destination port of the SIP message must be equal or be between 5060 and 5090.

The port/portrange must be defined if you are planning to use mirroring capture! In this case, the part with IP address will be ignored, but to make parser happy, use i.e.

Default value is "".

Example 1.8. Set raw_socket_listen parameter

modparam("sipcapture", "raw_socket_listen", "")
modparam("sipcapture", "raw_socket_listen", "")

1.3.9. raw_interface (string)

Name of the interface to bind on the raw socket.

Default value is "".

Example 1.9. Set raw_socket_listen parameter

modparam("sipcapture", "raw_interface", "eth0")

1.3.10. raw_sock_children (integer)

Parameter define how much children must be created to listen the raw socket.

Default value is "1".

Example 1.10. Set raw_socket_listen parameter

modparam("sipcapture", "raw_sock_children", 6)

1.3.11. promiscuous_on (integer)

Parameter to enable/disable promiscuous mode on the raw socket. Linux only.

Default value is "0".

Example 1.11. Set promiscuous_on parameter

modparam("sipcapture", "promiscuous_on", 1)

1.3.12. raw_moni_bpf_on (integer)

Activate Linux Socket Filter (LSF based on BPF) on the mirroring interface. The structure is defined in linux/filter.h. The default LSF accept a port/portrange from the raw_socket_listen param. Currently LSF supported only on Linux.

Default value is "0".

Example 1.12. Set raw_moni_bpf_on parameter

modparam("sipcapture", "raw_moni_bpf_on", 1)

1.3.13. capture_node (str)

Name of the capture node.

Default value is "homer01".

Example 1.13. Set capture_node parameter

modparam("sipcapture", "capture_node", "homer03")

1.4. Exported Functions

1.4.1.  sip_capture()

Save the message into the database.


Example 1.14. sip_capture usage

if (is_method("REGISTER"))

1.5. Exported Async Functions

1.5.1.  sip_capture()

Save the message inside the database. The query is being done asnychronously only if the database supports async operations. The query might not be executed exactly at this moment, it depends on the max_async_queries parameter.

Example 1.15. sip_capture usage

	async(sip_capture(), capture_resume);

route[capture_resume] {
	xlog("insert executed\n");
	/*continuing logic here */

1.6. MI Commands

1.6.1.  sip_capture

Name: sip_capture


  • capture_mode : turns on/off SIP message capturing. Possible values are:

    • on

    • off

    The parameter is optional - if missing, the command will return the status of the SIP message capturing (as string “on” or “off” ) without changing anything.

MI FIFO Command Format:


1.7. Database setup

Before running OpenSIPS with sipcapture, you have to setup the database tables where the module will store the data. For that, if the table were not created by the installation script or you choose to install everything by yourself you can use the sipcapture-create.sql or the sipcapture-st-create.sql SQL script in the database directories in the opensips/scripts folder as template. You can also find the complete database documentation on the project webpage,

1.8. Limitation

1. Only one capturing mode on RAW socket is supported: IPIP or monitoring/mirroring port. Don't activate both at the same time. 2. By default MySQL doesn't support INSERT DELAYED for partitioning table. You can patch MySQL ( or use separate tables (pseudo partitioning) 3. Mirroring port capturing works only on Linux.