Hello!
I'm working on setting up our kamailio instance to use TLS for inter-phone communication and so far I've been able to configure the GUI and get it to work which is great. However, I'm trying to grab a packet capture and decode the TLS session to get the SIP ladder (so I can troubleshoot issues) and so far I've been unable to. I've been following the article at: http://packetpushers.net/using-wireshark-to-decode-ssltls-packets/ and using the kamailio self-signed cert as I think that's the cert being used with no success. I'm getting the Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) which doesn't use perfect forward secrecy so it should be able to be decoded.
Is there a way to decode the kamailio TLS encoded communications so I can troubleshoot issues that may come up?
Thank you in advance, Robert
Robert Remsik
Telecom
Desk Phone: 970 491 7120
Robert.Remsik@colostate.edu
On Fri, Feb 16, 2018 at 08:28:49PM +0000, Remsik,Robert wrote:
Hello!
I'm working on setting up our kamailio instance to use TLS for inter-phone communication and so far I've been able to configure the GUI and get it to work which is great. However, I'm trying to grab a packet capture and decode the TLS session to get the SIP ladder (so I can troubleshoot issues) and so far I've been unable to. I've been following the article at: http://packetpushers.net/using-wireshark-t o-decode-ssltls-packets/ and using the kamailio self-signed cert as I think that's the cert being used with no success. I'm getting the Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) which doesn't use perfect forward secrecy so it should be able to be decoded.
Is there a way to decode the kamailio TLS encoded communications so I can troubleshoot issues that may come up?
Robert,
You could dump the pseudo-var $mb using the corex module in the event_route[network:msg] hook. https://kamailio.org/docs/modules/4.3.x/modules/corex.html
Anthony
Hello,
for Kamailio v4.3 you can print is syslog the $mb as it was suggested in the other response (https://lists.kamailio.org/pipermail/sr-users/2018-February/100378.html), you can do that in request_route or onreply_route. In onsend_route you can print $snd(buf).
Then there is siptrace module that can work standalone and store sip traffic in a database table.
If you have a production system with lot of traffic, Homer Sipcapture project might be something to consider -- kamailio has the modules siptrace and sipcapture.
I also want to highlight that v5.1 has a new module sipdump that should simplify the capture of sip traffic:
* https://www.kamailio.org/docs/modules/stable/modules/sipdump.html
I added it because I needed to look at tls traffic while developing/debugging.
Cheers, Daniel
On 16.02.18 21:28, Remsik,Robert wrote:
Hello!
I'm working on setting up our kamailio instance to use TLS for inter-phone communication and so far I've been able to configure the GUI and get it to work which is great. However, I'm trying to grab a packet capture and decode the TLS session to get the SIP ladder (so I can troubleshoot issues) and so far I've been unable to. I've been following the article at: http://packetpushers.net/using-wireshark-to-decode-ssltls-packets/%C2%A0and using the kamailio self-signed cert as I think that's the cert being used with no success. I'm getting the Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) which doesn't use perfect forward secrecy so it should be able to be decoded.
Is there a way to decode the kamailio TLS encoded communications so I can troubleshoot issues that may come up?
Thank you in advance, Robert
Robert Remsik
Telecom
Desk Phone: 970 491 7120
Robert.Remsik@colostate.edu
Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
Cool, I will check that out. Thank you. :)
Robert Remsik
Telecom
Desk Phone: 970 491 7120
Robert.Remsik@colostate.edu
________________________________ From: Daniel-Constantin Mierla miconda@gmail.com Sent: Tuesday, February 20, 2018 1:16:59 AM To: Kamailio (SER) - Users Mailing List; Remsik,Robert Subject: Re: [SR-Users] Kamailio 4.3 decrypting SIP-TLS
Hello,
for Kamailio v4.3 you can print is syslog the $mb as it was suggested in the other response (https://lists.kamailio.org/pipermail/sr-users/2018-February/100378.html), you can do that in request_route or onreply_route. In onsend_route you can print $snd(buf).
Then there is siptrace module that can work standalone and store sip traffic in a database table.
If you have a production system with lot of traffic, Homer Sipcapture project might be something to consider -- kamailio has the modules siptrace and sipcapture.
I also want to highlight that v5.1 has a new module sipdump that should simplify the capture of sip traffic:
* https://www.kamailio.org/docs/modules/stable/modules/sipdump.html
I added it because I needed to look at tls traffic while developing/debugging.
Cheers, Daniel
On 16.02.18 21:28, Remsik,Robert wrote:
Hello!
I'm working on setting up our kamailio instance to use TLS for inter-phone communication and so far I've been able to configure the GUI and get it to work which is great. However, I'm trying to grab a packet capture and decode the TLS session to get the SIP ladder (so I can troubleshoot issues) and so far I've been unable to. I've been following the article at: http://packetpushers.net/using-wireshark-to-decode-ssltls-packets/ and using the kamailio self-signed cert as I think that's the cert being used with no success. I'm getting the Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035) which doesn't use perfect forward secrecy so it should be able to be decoded.
Is there a way to decode the kamailio TLS encoded communications so I can troubleshoot issues that may come up?
Thank you in advance, Robert
Robert Remsik
Telecom
Desk Phone: 970 491 7120
Robert.Remsik@colostate.edumailto:Robert.Remsik@colostate.edu
_______________________________________________ Kamailio (SER) - Users Mailing List sr-users@lists.kamailio.orgmailto:sr-users@lists.kamailio.org https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users
-- Daniel-Constantin Mierla www.twitter.com/micondahttp://www.twitter.com/miconda -- www.linkedin.com/in/micondahttp://www.linkedin.com/in/miconda Kamailio Advanced Training - March 5-7, 2018, Berlin - www.asipto.comhttp://www.asipto.com Kamailio World Conference - May 14-16, 2018 - www.kamailioworld.comhttp://www.kamailioworld.com
-
Anthony Alba -
Daniel-Constantin Mierla -
Remsik,Robert