Example: SONUS Monitoring

RIBBON/SONUS Monitoring Profile

This example recipe can ingest SBC monitoring profile messages (Extended SIP) and extract/encapsulate messages back to a HEP Capture Server such as HOMER or HEPIC for use cases where encrypted communication is unavailable off-the-wire for monitoring and troubleshooting.

Dependencies

• Ribbon/Sonus SBC with Monitoring Profile support
• NodeJS and paStash need to be installed before execution

NPM

# sudo npm install --unsafe-perm -g @pastash/pastash

PaStash Recipe

• syslog input on port 9514
• sonus filter to parse TRC events
• hep output to port 9063

Save the following recipe to a readable location, ie: /path/to/pastash_sonus_monitoring.conf

input {
    udp {
        host => 0.0.0.0
        port => 8002
    }
}

filter {
    regex {
        regex => /srcIp: ([0-9.]+):([0-9]+)/
        fields => [srcIp, srcPort]
    }

    regex {
        regex => /destIP: ([0-9.]+):([0-9]+)/
        fields => [dstIp, dstPort]
    }

    compute_field {
        field => 'payload'
        value => '#{message}'
    }
}

output {
    stdout {}
    hep {
        host => HEP-SERVER-ADDRESS
        port => 9063
        hep_id => 2233
        hep_type => 1
        hep_protocol => 6
        hep_ip_family => 2
    }
}

SBC Settings

From your SBC management, browse to the Monitoring Profile from the All category

Add a Monitoring profile pointing at the IP:PORT configured for your HEP paStash instance.

• Save and Apply your settings

Headers

In order for the packets to retain the correct network addresses, enable the srcIp and dstIp headers

• Save and Apply your settings

In case of issues adding headers, please disable/enable the monitoring profile prior to it activating