TCPdump is a powerful command-line packet analyzer, which may be used for a SIP message sniffing/analyzing. TCPdump is preinstalled on many linux distributions, or may be installed directly from debian repository:
apt-get install tcpdump
TCPdump allows write sniff to a file or display it realtime. Its usage for SIP message analysis may look like:
Description: Homer is an Open Source SIP Capture server by Alexandr Dubovikov & Friends, based on OpenSER/Kamailio and supporting HEPv1/v2 (Homer Encapsulation Protocol) & IP proto 4 (IPIP) encapsulation and monitoring/mirroring port capture modes. Homer ships with a flexible and lightweight capture agent for unsupported scenarios and a powerful browser based UI (webHomer).
Web:
This guide describes the individual steps of the installation process of Zabbix version 4.0 on Ubuntu 16.04 operating system.
Zabbix is a free open-source monitoring software. Zabbix provides monitoring of many metrics about the state of the administered network and its devices and services (including virtual machines).
Elastic stack is a group of products from the Elastic company built around the Elasticsearch database designed to process data from any type of source.
In this article we will show you how to monitor the state of the Elasticsearch service and server load using the Elastic Stack services.
Port mirroring is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic such as an intrusion detection system, passive probe or real user monitoring (RUM) technology that is used to support application performance management (APM).
In our particular case, the faculty provided us with a Cisco Catalyst 2960 switch. We have configured this switch to mirror all internet-bound data traffic traversing the interface connected to network gateway, to the interface connected to Moloch server. As a result, we can now monitor all inbound and outbound lab traffic.
Switch(config)#monitor session 1 source fa0/1 both
– This command specifies source interface as fa 0/1. The parameter “both” specifies both directions to be monitored.
Switch(config)#monitor session 1 destination interface fa0/24
– This command defines the destination interface of mirrored traffic
Ngrep is one of networking tools usefull for VoIP (Voice Over IP) analysis. Unfortunatelly I did not find ngrep package available inside ot the yum repository, so command
yum install ngrep
does not work (SipXecs over CentOS). No problem, just few steps how to install it.
http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html
Cisco switches provides SPAN and RSPAN feature which is suitable for monitoring and capturing packets flowing through switch ports or VLANs. But this feature is not provided on Cisco routers, therefore if you look for it there is not result.
The article describes just the simplest running configuration and how to run SNMPd agent on Linux OS.
