SIP connection tracking

SIP connection tracking

[prabha]

Hi
    I would like to know if there is a SIP connection tracking support
in IPTables now.

Regards
Prabha

SIP Connection Tracking

[Anirudha Chinmulgund]

Hi,

Is there a SIP Connections tracking/NAT module implemented?

Thanks
-Jadya

_________________________________________________________________
Get rid of annoying pop-up ads with the new MSN Toolbar – FREE! 
http://toolbar.msn.com/go/onm00200414ave/direct/01/

SIP connection tracking

[Sagara Wijetunga]

Hi all

I'm trying to prioritize the out going SIP related
traffic from my desktop computer.

I tried:

iptables -t mangle -A POSTROUTING \
-m helper --helper sip -m state --state
ESTABLISHED,RELATED \
-j ...

It simply doesn't detect SIP related traffic!

I'm using Linux kernel 2.6.11.9, iptables 1.3.5 and
sip-conntrack-nat from patch-o-matic-ng-20060502.

I have enabled the Mangling, SIP support in the kernel
(as built-in, not as a module).

Have I missed something? any ideas?

Thanks

Kind regards
Sagara



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: SIP connection tracking

[Marius-Iulian Corici]

Only the SIP (signaling traffic) or also the voice traffic (RTP traffic - you 
can see it with tcpdump)?
Take a short look at the priotitization in OpenWRT distribution.
It prioritizes on some "a little" bit different criteria.
Anyway, usually the SIP is udp

Marius

On Tuesday 09 May 2006 07:37, Sagara Wijetunga wrote:

> Hi all
>
> I'm trying to prioritize the out going SIP related
> traffic from my desktop computer.
>
> I tried:
>
> iptables -t mangle -A POSTROUTING \
> -m helper --helper sip -m state --state
> ESTABLISHED,RELATED \
> -j ...
>
> It simply doesn't detect SIP related traffic!
>
> I'm using Linux kernel 2.6.11.9, iptables 1.3.5 and
> sip-conntrack-nat from patch-o-matic-ng-20060502.
>
> I have enabled the Mangling, SIP support in the kernel
> (as built-in, not as a module).
>
> Have I missed something? any ideas?
>
> Thanks
>
> Kind regards
> Sagara
>
>
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam?  Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com

-- 
Dipl. Eng. Marius-Iulian Corici
FOKUS/NGNI
We are changing the world because God helped us hack His source code ...

Re: SIP connection tracking

[Sagara Wijetunga]

--- Marius-Iulian Corici
<marius-Iulian.corici@fokus.fraunhofer.de> wrote:

> Only the SIP (signaling traffic) or also the voice
> traffic (RTP traffic - you 
> can see it with tcpdump)?
> Take a short look at the priotitization in OpenWRT
> distribution.
> It prioritizes on some "a little" bit different
> criteria.
> Anyway, usually the SIP is udp
> 

Thanks for the reply.

I can see all packets passing thru the interface
(ppp0).

The issue is the rule does not match to either SIP
(signaling traffic) or RTP traffic at all. 

Does it work for you?

I'll have a look at the OpenWRT.

Thanks again

Sagara


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Re: SIP connection tracking

[Rob Sterenborg]

On Tue, May 9, 2006 07:37, Sagara Wijetunga wrote:
> Hi all
>
> I'm trying to prioritize the out going SIP related
> traffic from my desktop computer.
>
> I tried:
>
> iptables -t mangle -A POSTROUTING -m helper --helper \
> sip -m state --state ESTABLISHED,RELATED \
> -j ...
>
> It simply doesn't detect SIP related traffic!

Perhaps only NEW traffic passes the mangle table, just like the nat table.. If
that is the case, ESTABLISHED and RELATED packets are (probably) treated the
same way as the NEW packet.
But, I'm not sure about this.. Did you test that ?


Gr,
Rob

Re: SIP connection tracking

[Sagara Wijetunga]

--- Rob Sterenborg <rob@sterenborg.info> wrote:

> On Tue, May 9, 2006 07:37, Sagara Wijetunga wrote:
> > Hi all
> >
> > I'm trying to prioritize the out going SIP related
> > traffic from my desktop computer.
> >
> > I tried:
> >
> > iptables -t mangle -A POSTROUTING -m helper
> --helper \
> > sip -m state --state ESTABLISHED,RELATED \
> > -j ...
> >
> > It simply doesn't detect SIP related traffic!
> 
> Perhaps only NEW traffic passes the mangle table,
> just like the nat table.. If
> that is the case, ESTABLISHED and RELATED packets
> are (probably) treated the
> same way as the NEW packet.
> But, I'm not sure about this.. Did you test that ?
> 

iptables -t mangle -A POSTROUTING \
-p udp --dport 5060 \
-j <mark packets>


Tcpdump shows entire SIP communication is marked up to
the last ACK packet.

This shows packets related to an ESTABLISHED
connection goes thru the mangle table. 

Iptables man page doesn't say any restriction.

Regards
Sagara

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

Sip Connection Tracking

[Siqhamo Sifo]

I recently recompiled my kernel with Sip support and now I have a problem
with
ip_nat_sip and ip_conntrack_sip.They do not seem to be working , see I do
port
forwarding to my asterisk box behind the NAT and I can connect
successfully from outside using xlite.The problem is that I do not get any
audio , reason being that when I take a look at  the packets which r
coming from my asterisk box thorough the nat I find that I the SIP headers
under the SDP section the connection address still refers to my asterisk
box behind the NAT and hence the RTP packets r sent to my 10.* ip which
does not make sense .

Siqhamo

Re: Sip Connection Tracking

[Ming-Ching Tiew]

I have similar experience with 2.6.17 ( patch-o-matic ng ) and
2.6.18 ( vanilla ). Now I really wonder if the sip conntrack is
working.

----- Original Message ----- 
From: "Siqhamo Sifo" <siqhamo@newlunar.co.za>
To: <netfilter@lists.netfilter.org>
Sent: Monday, August 14, 2006 5:56 PM
Subject: Sip Connection Tracking


> I recently recompiled my kernel with Sip support and now I have a problem
> with
> ip_nat_sip and ip_conntrack_sip.They do not seem to be working , see I do
> port
> forwarding to my asterisk box behind the NAT and I can connect
> successfully from outside using xlite.The problem is that I do not get any
> audio , reason being that when I take a look at  the packets which r
> coming from my asterisk box thorough the nat I find that I the SIP headers
> under the SDP section the connection address still refers to my asterisk
> box behind the NAT and hence the RTP packets r sent to my 10.* ip which
> does not make sense .
> 
> Siqhamo
> 
> 
>