HEP relay/forwarder not working

[solarmon]

Hi,

I'm trying to set up paStash as a HEP relat/forwarder so that it will send HEP packets (from rtpproxy 2.2.0) to two separate Homer servers.

I am following this guide:

https://github.com/sipcapture/paStash/wiki/Example:-HEP-Relay

and have configured it to run as a service, as per:

https://github.com/sipcapture/paStash/wiki/pastash-service#running-as-systemd-service

I am using the following paStash config:

input {
  udp {
    host => 127.0.0.1
    port => 9060
  }
}

output {
  udp {
    host => <Homer #1>
    port => 9060
  }
  udp {
    host => <Homer #1>
    port => 9060
  }
}

Note that I'm using UDP as:

1. rtpproxy only seems to work with HEP using UDP
2. My Homer servers are currently working with HEP using UDP.

My node version is v16.14.1 running on a CentOS 7.9 machine.

pastash seems to be working in that it receives the input and sends an output to both Homer server IPs.

The original UDP HEP packet contents is:

HEP3...................................	.
bE.....
.
..	6............
.e.......&c61af2ecfc784480a93934fbf9c3a27f.....
m........
..+.......{
 "ssrc": 4199153814,
 "sender_information": {
  "ntp_timestamp_sec": 3857727066,
  "ntp_timestamp_usec": 511629389,
  "rtp_timestamp": 32000,
  "packets": 175,
  "octets": 28000
 },
 "type": 200,
 "report_blocks": [
  {
   "source_ssrc": 0,
   "fraction_lost": 1,
   "packets_lost": 1,
   "highest_seq_no": 22704,
   "ia_jitter": 78,
   "lsr": 0,
   "dlsr": 0
  }
 ],
 "report_count": 1
}

However, the format of the output does not seem correct. When I capture the packets and view the output UDP stream, the contents are:

{
	"message": "HEP3\u0002\u000F\u0000\u0000\u0000\u0001\u0000\u0007\u0002\u0000\u0000\u0000\u0002\u0000\u0007\u0011\u0000\u0000\u0000\u0007\u0000\b......\u0000\u0000\u0000\b\u0000\b...\u0000\u0000\u0000\t\u0000\nbE......\u0000\u0000\u0000\n\u0000\n\u0000\u0002\t6\u0000\u0000\u0000\u000B\u0000\u0007\u0005\u0000\u0000\u0000\f\u0000\n\u0000e\u0000\u0000\u0000\u0000\u0000\u0011\u0000&c61af2ecfc784480a93934fbf9c3a27f\u0000\u0000\u0000\u0003\u0000\nm.........\u0000\u0000\u0000\u0004\u0000\n...\f+...\u0000\u0000\u0000\u000F\u0001...{\n \"ssrc\": 4199153814,\n \"sender_information\": {\n  \"ntp_timestamp_sec\": 3857727066,\n  \"ntp_timestamp_usec\": 511629389,\n  \"rtp_timestamp\": 32000,\n  \"packets\": 175,\n  \"octets\": 28000\n },\n \"type\": 200,\n \"report_blocks\": [\n  {\n   \"source_ssrc\": 0,\n   \"fraction_lost\": 1,\n   \"packets_lost\": 1,\n   \"highest_seq_no\": 22704,\n   \"ia_jitter\": 78,\n   \"lsr\": 0,\n   \"dlsr\": 0\n  }\n ],\n \"report_count\": 1\n}",
	"host": "127.0.0.1",
	"udp_port": "9060",
	"@timestamp": "2022-03-31T14:51:06.160Z",
	"@version": "1"
}

So it seems that paStash is converting the message and encoding it in a JSON format.

I expect paStash to be relaying/forwarding the HEP UDP contents untouched and relay it on to the destination Homer server IP.

[lmangani]

Could you try adding unserializer => raw to your input?

[solarmon]

@lmangani

Do I add to the input{} or udp{} section? I have tried both and it doesn't seem to have made a difference, I have not done a capture yet to see the contents.

Also, as a comparison, the following udp forwarder solution using socat seems to work as expected:

socat -U - udp4-recv:9060 | tee >(socat -u - udp4-datagram:<Homer #1>:9060) | socat -u - udp4-datagram:<Homer #2>:9060

[solarmon]

With input as:

input {
  udp {
    host => 127.0.0.1
    port => 9060
    unserializer => raw
  }
}

The output UDP packet contents is the same JSON formatted contents:

{"message":"HEP3\u0002\u0010\u0000\u0000\u0000\u0001\u0000\u0007\u0002\u0000\u0000\u0000\u0002\u0000\u0007\u0011\u0000\u0000\u0000\u0007\u0000\b...e\u0000\u0000\u0000\b\u0000\b...'\u0000\u0000\u0000\t\u0000\nbF......\u0000\u0000\u0000\n\u0000\n\u0000\u0004......\u0000\u0000\u0000\u000b\u0000\u0007\u0005\u0000\u0000\u0000\f\u0000\n\u0000e\u0000\u0000\u0000\u0000\u0000\u0011\u0000&492b6843ed8d4bff9b93b7224dc35816\u0000\u0000\u0000\u0003\u0000\nm.........\u0000\u0000\u0000\u0004\u0000\n...\f+...\u0000\u0000\u0000\u000f\u0001...{\n \"ssrc\": 4199229345,\n \"sender_information\": {\n  \"ntp_timestamp_sec\": 3857802597,\n  \"ntp_timestamp_usec\": 1198811271,\n  \"rtp_timestamp\": 32000,\n  \"packets\": 175,\n  \"octets\": 28000\n },\n \"type\": 200,\n \"report_blocks\": [\n  {\n   \"source_ssrc\": 0,\n   \"fraction_lost\": 1,\n   \"packets_lost\": 1,\n   \"highest_seq_no\": 31673,\n   \"ia_jitter\": 78,\n   \"lsr\": 0,\n   \"dlsr\": 0\n  }\n ],\n \"report_count\": 1\n}","host":"127.0.0.1","udp_port":"9060","@timestamp":"2022-04-01T11:49:57.312Z","@version":"1"}