[ERR] protocol_sip.c:141 This is not DIAMETER

[engineerham]

Hi, I have a problem with sending diameter hep to homer. I have activated this protocol in socket_pcap.xml file and loaded related module in captagent.xml file. The logs of service is like this:

Mar 13 11:25:32 demo systemd[1]: Starting Captagent - monitoring system...
Mar 13 11:25:32 demo captagent[166208]: [NOTICE] Loaded core config
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded socket_tzsp
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded protocol_diameter
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded output_json
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded protocol_tls
Mar 13 11:25:32 demo systemd[1]: Started Captagent - monitoring system.
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded protocol_ss7
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded protocol_sip
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded database_hash
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded transport_hep
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded protocol_rtcp
Mar 13 11:25:32 demo captagent[166209]: [NOTICE] Loaded socket_pcap
Mar 13 11:25:40 demo captagent[166209]: [ERR] protocol_sip.c:141 This is not DIAMETER
Mar 13 11:25:40 demo captagent[166209]:
Mar 13 11:26:10 demo captagent[166209]: [ERR] protocol_sip.c:141 This is not DIAMETER
Mar 13 11:26:10 demo captagent[166209]:

[kYroL01]

Hi @engineerham this error comes from here
This means that captagent does not recognize your Diamter traffic as valid.
As you know Diameter is a very customizable protocol so maybe the internal parser needs to be updated.
Can you provide more information ?

Thank you

[engineerham]

Thanks for your response @kYroL01. My diameter server is up on the another machine apart from captagent server . I have attached the diameter pcap file and the captagent conf folder as well. I just want to send diameter and sip traffic to homer 10 for integrated monitoring over my service network.

captagent.zip
diameter-pcap.zip

[kYroL01]

Thanks @engineerham I will take a look asap and let you know

[kYroL01]

Hi @engineerham sorry for the delay, I was busy.
On the very first test, I see that not all your Diameter pkts are parsed apparently
I see good parsing like

[INFO] protocol_diameter.c:108 JSON DIAMETER "diameter_info": {"class":"3GPP","type":"Answer","command":"UA","app-ID":16777216}

and I also see some

[ERR] protocol_sip.c:141 This is not DIAMETER

I will check it.

Just FYI it's also unnecessary to have all the modules enabled in your captagent.xml for performance, I will send you a better working version.

[kYroL01]

Hi again @engineerham

So, good news: your Diameter pcap contains all valid pkts that captagent parses perfectly.

What's happening is that you also have sip_profile enabled, and on any interfaces, so some packets are discarded by the BPF filter of the sip profile (port 5060) and the Diameter dissector does not parse them.

Various solution:

1. enable only diameter profile in socket_raw.xml and disable sip profile
2. specify the exact network interface name in dev param where diameter is flowing, here instead of any. The same for SIP.

So, if you don't have SIP, turn it off.

Another adjustment you need to make is the modules you need to enable, because makes no sense to have all the modules enabled, especially the socket ones.
This is what your captagent.xml should be IMHO

<?xml version="1.0"?>
<document type="captagent/xml">
	<configuration name="core.conf" description="CORE Settings" serial="2014024212">
	    <settings>
		<param name="debug" value="5"/>
		<param name="version" value="2"/>
		<param name="serial" value="2014056501"/>
		<param name="uuid" value="00781a4a-5b69-11e4-9522-bb79a8fcf0f3"/>
		<param name="daemon" value="false"/>
		<param name="syslog" value="false"/>
		<param name="pid_file" value="/var/run/captagent.pid"/>
		<!-- Configure using installation path if different from default -->
		<param name="module_path" value="/usr/local/captagent/lib/captagent/modules"/>
		<param name="config_path" value="/usr/local/captagent/etc/captagent/"/>
		<param name="capture_plans_path" value="/usr/local/captagent/etc/captagent/captureplans"/>
		<param name="backup" value="/usr/local/captagent/etc/captagent/backup"/>
		<param name="chroot" value="/usr/local/captagent/etc/captagent"/>
	    </settings>
	</configuration>
	<configuration name="modules.conf" description="Modules">
	    <modules>
		<load module="transport_hep" register="local"/>
		<load module="protocol_sip" register="local"/>
		<load module="protocol_rtcp" register="local"/>
		<load module="protocol_diameter" register="local"/>
		<load module="database_hash" register="local"/>	
		<load module="socket_pcap" register="local"/>
            </modules>
	</configuration>
</document>

Let me know if this resolves your problem.

Michele

[engineerham]

Hi @kYroL01.
Thanks for your response and considerations. You means that I have to capture sip and diameter on deferent interfaces?

[kYroL01]

Hi @engineerham if you can, it will be the best choice.
Thank you