Heplify tcpassembly / sipassembly

[brownee3210]

Hi,

I have a SIP data stream I am monitoring, and it is SIP over TCP and the SIP message are large so are being segmented by the TCP layer.

Some of these messages have 3 to 4 segments that need to be re-assembled.

I have been trying to get heplify's “-tcpassembly” and “-sipassembly” options to re-assemble this SIP data but so far unsuccessfully.

If I run the heplify command without the “-tcpassembly” ” and “-sipassembly” options I see the message in the database, but it is truncated.

If I run with the “-tcpassembly” ” and / or “-sipassembly” options the message seems to be skipped all together and are not written to the database.

This is the heplify command I have been testing with and I have added the option “assembly_debug_log” to log debugging for TCP assembly. I have also used the “-e” option to send logging to stderr. I am using heplify version 1.66.10.

/usr/local/sbin/hep/heplify -i eno2 -dd -nt udp -hs 192.168.4.161:9998 -hi 4100 -m SIP -pr 5060-5070 -t pcap -prometheus 192.168.4.194:7998 -vlan -tcpassembly -sipassembly -e -assembly_debug_log

The output is quite verbose but one of the messages I see is: -
“hit_ max buffer size: {MaxBufferedPagesTotal:1 MaxBufferedPagesPerConnection:1}, 1, 1”

Not sure if this is a problem / error message that could be contributing to this problem?

After this not really sure what else I can try to solve this so hoping someone can help out with this?

Regards,
Graham Brown