Re: [OpenSIPS-Users] Opensips forward calls to incorrect port

[Denis via Users]

Hello, Pasan! Yes, i found where new port has been changed. Thank you. -- С уважением, Денис.Best regards, Denis 24.04.2018, 12:15, "Pasan Meemaduma via Users" :Hi Denis, Did you try to print the ruri port $rp before and after changes ?. is there any function call that could cause the destination port to be change?  On Tuesday, April 24, 2018, 2:26:13 PM GMT+5:30, Denis via Users  wrote:  Hello! version: opensips 2.2.6 (x86_64/linux)flags: STATS: On, DISABLE_NAGLE, USE_MCAST, SHM_MMAP, PKG_MALLOC, QM_MALLOC, DBG_MALLOC, FAST_LOCK-ADAPTIVE_WAITADAPTIVE_WAIT_LOOPS=1024, MAX_RECV_BUFFER_SIZE 262144, MAX_LISTEN 16, MAX_URI_SIZE 1024, BUF_SIZE 65535poll method support: poll, epoll_lt, epoll_et, sigio_rt, select.git revision: 5d229f5main.c compiled on 13:56:51 Apr 20 2018 with gcc 5.4.0 In attachment you can find some log of the call, where 1.1.1.1 - caller SIP UA2.2.2.2 - Opensips3.3.3.3 - callee SIP UA There is some instruction in opensips.cfg "$rU="812111";$rd="3.3.3.3";" The question is why does Opensips, in such scheme, send request to the port 5105? Thank you -- С уважением, Денис.Best regards, Denis   ___Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users,___Users mailing listUsers@lists.opensips.orghttp://lists.opensips.org/cgi-bin/mailman/listinfo/users___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Re: [OpenSIPS-Users] Opensips 2.5 and fraud module

[Liviu Chircu]

Yes, exactly. Apologies for my incomplete example scenario!

Best regards,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com

On 26.04.2018 07:57, Denis via Users wrote:

Liviu, it seems, i confused.
You gave an example
"the "sequential calls" holds the size of the last batch of calls sent 
to the same number. For example, if a user were to dial 44 and 45
prefixes in a round-robin manner, his "sequential calls" value would 
never exceed 1"
So, it seems, that if we have TWO PREFIX field in fraud detection 
table with one profile, with 44 and 55 content, and ONE user were to 
dial 44 (for example 44667788 or 44223344 etc) and 45 (4567788 or 
44223344 etc)
prefixes in a round-robin manner, his "sequential calls" value would 
never exceed 1.
In my case i have only ONE prefix - 810 - and, although, user were 
dial different numbers but with common prefix (810) "sequential calls" 
increased by one every call. And when counter reached predetermined 
value calls have started blocking.

Am i right?
Thank you.
--
С уважением, Денис.
Best regards, Denis
___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users



___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Re: [OpenSIPS-Users] Opensips 2.5 and fraud module

[Denis via Users]

Liviu, it seems, i confused.You gave an example"the "sequential calls" holds the size of the last batch of calls sent to the same number. For example, if a user were to dial 44 and 45prefixes in a round-robin manner, his "sequential calls" value would never exceed 1" So, it seems, that if we have TWO PREFIX field in fraud detection table with one profile, with 44 and 55 content, and ONE user were to dial 44 (for example 44667788 or 44223344 etc) and 45 (4567788 or 44223344 etc)prefixes in a round-robin manner, his "sequential calls" value would never exceed 1.In my case i have only ONE prefix - 810 - and, although, user were dial different numbers but with common prefix (810) "sequential calls" increased by one every call. And when counter reached predetermined value calls have started blocking. Am i right? Thank you. -- С уважением, Денис.Best regards, Denis 25.04.2018, 17:56, "Liviu Chircu" :Denis, they all match the same prefix. "810" is the same number match, over and over again, so the sequential calls is not reset. Please fix your number matching if you want it to work differently.Best regards,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 25.04.2018 17:41, Denis via Users wrote:Hello Liviu! Sorry, for long answer. I do not quite understand 07:08 was the first call to 810 prefix from 00:00 where counters, how you mentioned, has been reset. So, after 15 calls i can see, that Opensips drop any calls with appropriate reason ("fraud detected") The only counter that has such value is "sequential_calls_critical". Another counters are long away from this value. Anyway you doubt that "sequential_calls_critical" is the reason of call`s block? Thank you. -- С уважением, Денис.Best regards, Denis 24.04.2018, 12:41, "Liviu Chircu" :Hi Denis,It is difficult for me to assess your intervals, and triggering reasons. For example, your sheet starts at 07:08 AM, but the counter accumulation is reset way back, at 00:00.Please provide some actual fraud event logs, with a log such as below, so we can blame the sequential calls for sure:event_route [E_FRD_CRITICAL]{    fetch_event_params("$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)");    xlog("E_FRD_CRITICAL: $var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)\n");}Best regards,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 24.04.2018 12:06, Denis via Users wrote:Hello Liviu! "Yes, the "sequential calls" holds the size of the last batch of callssent to the same number. For example, if a user were to dial 44 and 45prefixes in a round-robin manner, his "sequential calls" value wouldnever exceed 1." Here you can find acc from one of the client (from the beginning of the 24.04)https://yadi.sk/i/Zkj70CCM3UiEyw and fraud module params looks like                    prefix: 810               start_hour: 00:00                 end_hour: 23:59            daysoftheweek: Mon-Sun              cpm_warning: 10             cpm_critical: 11    call_duration_warning: 1499   call_duration_critical: 1500      total_calls_warning: 99     total_calls_critical: 100 concurrent_calls_warning: 25concurrent_calls_critical: 30 sequential_calls_warning: 14sequential_calls_critical: 15 Something wrongeAs you can see the client dial different numbers but module detects fraud anyway. -- С уважением, Денис.Best regards, Denis 19.04.2018, 18:14, "Liviu Chircu" :Hi Denis!Good catch! For the first time, I documented a parameter, but forgot to export it for the script writer as well! :)It is now fixed. Thank you!Cheers,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 19.04.2018 17:28, Denis via Users wrote:Hello, Liviu! I had installed latest Opensips 2.2 (Opensips 2.2.6) In a log file, during start of Opensips, i can seeERROR:core:set_mod_param_regex: parameter  not found in module  Where is mistake? Thank you. -- С уважением, Денис.Best regards, Denis 13.04.2018, 09:49, "Denis via Users" :Ok, thank you -- С уважением, Денис.Best regards, Denis 12.04.2018, 14:23, "Liviu Chircu" :Use $Ts [1] to get the current UNIX timestamp in seconds.[1]: http://www.opensips.org/Documentation/Script-CoreVar-2-4#toc91Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 12.04.2018 14:08, Denis via Users wrote:Liviu, is there any way to find out current time from Opensips during call processing (some functions, variables etc which i can use in opensips.cfg)? Thank you -- С уважением, Денис.Best regards, Denis 12.04.2018, 13:50, "Liviu Chircu" :Hi Denis,The fraud detection module has no such mechanism, currently. We could invent some variables such as $frd_last_warn, $frd_last_crit, $frd_first_warn, $frd_first_crit. They would output a UNIX timestamp. If there were no warnings during the current interval, the timestamp value would be 0. Can't think of anything 

Re: [OpenSIPS-Users] Opensips 2.5 and fraud module

[Liviu Chircu]

Denis, they all match the same prefix. "810" is the same number match, 
over and over again, so the sequential calls is not reset. Please fix 
your number matching if you want it to work differently.


Best regards,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com

On 25.04.2018 17:41, Denis via Users wrote:

Hello Liviu!
Sorry, for long answer.
I do not quite understand
07:08 was the first call to 810 prefix from 00:00 where counters, how 
you mentioned, has been reset.
So, after 15 calls i can see, that Opensips drop any calls with 
appropriate reason ("fraud detected")
The only counter that has such value is "sequential_calls_critical". 
Another counters are long away from this value.
Anyway you doubt that "sequential_calls_critical" is the reason of 
call`s block?

Thank you.
--
С уважением, Денис.
Best regards, Denis
24.04.2018, 12:41, "Liviu Chircu" :


Hi Denis,

It is difficult for me to assess your intervals, and triggering 
reasons. For example, your sheet starts at 07:08 AM, but the counter 
accumulation is reset way back, at 00:00.


Please provide some actual fraud event logs, with a log such as 
below, so we can blame the sequential calls for sure:


event_route [E_FRD_CRITICAL]
{
fetch_event_params("$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)");
    xlog("E_FRD_CRITICAL: 
$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)\n");

}

Best regards,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com 
On 24.04.2018 12:06, Denis via Users wrote:

Hello Liviu!
"Yes, the "sequential calls" holds the size of the last batch of calls
sent to the same number. For example, if a user were to dial 44 and 45
prefixes in a round-robin manner, his "sequential calls" value would
never exceed 1."
Here you can find acc from one of the client (from the beginning of 
the 24.04)

https://yadi.sk/i/Zkj70CCM3UiEyw
and fraud module params looks like
                   prefix: 810
               start_hour: 00:00
                 end_hour: 23:59
            daysoftheweek: Mon-Sun
              cpm_warning: 10
             cpm_critical: 11
    call_duration_warning: 1499
   call_duration_critical: 1500
      total_calls_warning: 99
     total_calls_critical: 100
 concurrent_calls_warning: 25
concurrent_calls_critical: 30
 sequential_calls_warning: 14
sequential_calls_critical: 15
Something wronge
As you can see the client dial different numbers but module detects 
fraud anyway.

--
С уважением, Денис.
Best regards, Denis
19.04.2018, 18:14, "Liviu Chircu"  
:


Hi Denis!

Good catch! For the first time, I documented a parameter, but 
forgot to export it for the script writer as well! :)


It is now fixed. Thank you!

Cheers,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com 
On 19.04.2018 17:28, Denis via Users wrote:

Hello, Liviu!
I had installed latest Opensips 2.2 (Opensips 2.2.6)
In a log file, during start of Opensips, i can see
ERROR:core:set_mod_param_regex: parameter  not 
found in module 

Where is mistake?
Thank you.
--
С уважением, Денис.
Best regards, Denis
13.04.2018, 09:49, "Denis via Users"  
:

Ok, thank you
--
С уважением, Денис.
Best regards, Denis
12.04.2018, 14:23, "Liviu Chircu" >:


Use $Ts [1] to get the current UNIX timestamp in seconds.

[1]: http://www.opensips.org/Documentation/Script-CoreVar-2-4#toc91

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com 


On 12.04.2018 14:08, Denis via Users wrote:
Liviu, is there any way to find out current time from Opensips 
during call processing (some functions, variables etc which i 
can use in opensips.cfg)?

Thank you
--
С уважением, Денис.
Best regards, Denis
12.04.2018, 13:50, "Liviu Chircu"  
:


Hi Denis,

The fraud detection module has no such mechanism, currently. 
We could invent some variables such as $frd_last_warn, 
$frd_last_crit, $frd_first_warn, $frd_first_crit. They would 
output a UNIX timestamp. If there were no warnings during the 
current interval, the timestamp value would be 0. Can't think 
of anything better now - you can polish this idea and open up 
a pull request if you want.


How many users do you have? The "cachedb_local" offers a fast 
and configurable hash implementation. Why wouldn't it be a 
good solution in order to store/fetch the above-mentioned 
timestamps for each of your users?


Best regards,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com 


On 10.04.2018 13:11, Denis via Users wrote:

Hello, Liviu!
"So you want to check the time of the last fraud detection 
attempt for a user?"

Yes, but not for store this time to anywhere.

Re: [OpenSIPS-Users] Opensips 2.5 and fraud module

[Denis via Users]

Hello Liviu! Sorry, for long answer. I do not quite understand 07:08 was the first call to 810 prefix from 00:00 where counters, how you mentioned, has been reset. So, after 15 calls i can see, that Opensips drop any calls with appropriate reason ("fraud detected") The only counter that has such value is "sequential_calls_critical". Another counters are long away from this value. Anyway you doubt that "sequential_calls_critical" is the reason of call`s block? Thank you. -- С уважением, Денис.Best regards, Denis 24.04.2018, 12:41, "Liviu Chircu" :Hi Denis,It is difficult for me to assess your intervals, and triggering reasons. For example, your sheet starts at 07:08 AM, but the counter accumulation is reset way back, at 00:00.Please provide some actual fraud event logs, with a log such as below, so we can blame the sequential calls for sure:event_route [E_FRD_CRITICAL]{    fetch_event_params("$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)");    xlog("E_FRD_CRITICAL: $var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)\n");}Best regards,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 24.04.2018 12:06, Denis via Users wrote:Hello Liviu! "Yes, the "sequential calls" holds the size of the last batch of callssent to the same number. For example, if a user were to dial 44 and 45prefixes in a round-robin manner, his "sequential calls" value wouldnever exceed 1." Here you can find acc from one of the client (from the beginning of the 24.04)https://yadi.sk/i/Zkj70CCM3UiEyw and fraud module params looks like                    prefix: 810               start_hour: 00:00                 end_hour: 23:59            daysoftheweek: Mon-Sun              cpm_warning: 10             cpm_critical: 11    call_duration_warning: 1499   call_duration_critical: 1500      total_calls_warning: 99     total_calls_critical: 100 concurrent_calls_warning: 25concurrent_calls_critical: 30 sequential_calls_warning: 14sequential_calls_critical: 15 Something wrongeAs you can see the client dial different numbers but module detects fraud anyway. -- С уважением, Денис.Best regards, Denis 19.04.2018, 18:14, "Liviu Chircu" :Hi Denis!Good catch! For the first time, I documented a parameter, but forgot to export it for the script writer as well! :)It is now fixed. Thank you!Cheers,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 19.04.2018 17:28, Denis via Users wrote:Hello, Liviu! I had installed latest Opensips 2.2 (Opensips 2.2.6) In a log file, during start of Opensips, i can seeERROR:core:set_mod_param_regex: parameter  not found in module  Where is mistake? Thank you. -- С уважением, Денис.Best regards, Denis 13.04.2018, 09:49, "Denis via Users" :Ok, thank you -- С уважением, Денис.Best regards, Denis 12.04.2018, 14:23, "Liviu Chircu" :Use $Ts [1] to get the current UNIX timestamp in seconds.[1]: http://www.opensips.org/Documentation/Script-CoreVar-2-4#toc91Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 12.04.2018 14:08, Denis via Users wrote:Liviu, is there any way to find out current time from Opensips during call processing (some functions, variables etc which i can use in opensips.cfg)? Thank you -- С уважением, Денис.Best regards, Denis 12.04.2018, 13:50, "Liviu Chircu" :Hi Denis,The fraud detection module has no such mechanism, currently. We could invent some variables such as $frd_last_warn, $frd_last_crit, $frd_first_warn, $frd_first_crit. They would output a UNIX timestamp. If there were no warnings during the current interval, the timestamp value would be 0. Can't think of anything better now - you can polish this idea and open up a pull request if you want.How many users do you have? The "cachedb_local" offers a fast and configurable hash implementation. Why wouldn't it be a good solution in order to store/fetch the above-mentioned timestamps for each of your users?Best regards,Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.comOn 10.04.2018 13:11, Denis via Users wrote:Hello, Liviu! "So you want to check the time of the last fraud detection attempt for a user?" Yes, but not for store this time to anywhere.I want to detect the time of the first fraud call, and if this time, for example, between 19:00 and 09:00, make some actions. Can i do it with Opensips? Thank you. -- С уважением, Денис.Best regards, Denis 10.04.2018, 12:28, "Liviu Chircu" :Hi Denis,Yes, the "sequential calls" holds the size of the last batch of callssent to the same number. For example, if a user were to dial 44 and 45prefixes in a round-robin manner, his "sequential calls" value wouldnever exceed 1.So you want to check the time of the last fraud detection attempt for auser? You can use "cachedb_local", for example, and hold the last frauddetection timestamp for each user. Also, note that 

[OpenSIPS-Users] Cache the subscriber table

[Pat Burke]

Hello,




I there a way to cache the subscriber table?  Right now that is the only table 
that we have that requires remote (configuration) database to be running.  I am 
thinking of something the dynamic routing or dispatcher.




Thanks for your input.



Regards,
Pat Burke



___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Re: [OpenSIPS-Users] timeout between the invite and the sip message after the "180 trying"?

[Russell Treleaven]

ok

On Wed, Apr 25, 2018 at 9:43 AM, Abdoul Osséni 
wrote:

> Yes
>
> between 100 trying or 180 ringing?
> or
> between 100 trying or 183 sdp progress?
>
>
> Abdoul
>
> 2018-04-25 15:10 GMT+02:00 Russell Treleaven :
>
>> Do you mean 100 trying or 180 ringing?
>>
>> On Wed, Apr 25, 2018, 9:03 AM Abdoul Osséni 
>> wrote:
>>
>>> Hello list,
>>>
>>> Is it possible to set the timeout between the invite and the sip message
>>> after the "180 trying"?
>>>
>>> Best regards
>>> Abdoul.
>>> ___
>>> Users mailing list
>>> Users@lists.opensips.org
>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>
>>
>> ___
>> Users mailing list
>> Users@lists.opensips.org
>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>
>>
>
> ___
> Users mailing list
> Users@lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>


-- 
Sincerely,

Russell Treleaven
sip:rtrelea...@sip.bunnykick.ca
___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Re: [OpenSIPS-Users] timeout between the invite and the sip message after the "180 trying"?

[Abdoul Osséni]

Yes

between 100 trying or 180 ringing?
or
between 100 trying or 183 sdp progress?


Abdoul

2018-04-25 15:10 GMT+02:00 Russell Treleaven :

> Do you mean 100 trying or 180 ringing?
>
> On Wed, Apr 25, 2018, 9:03 AM Abdoul Osséni 
> wrote:
>
>> Hello list,
>>
>> Is it possible to set the timeout between the invite and the sip message
>> after the "180 trying"?
>>
>> Best regards
>> Abdoul.
>> ___
>> Users mailing list
>> Users@lists.opensips.org
>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>
>
> ___
> Users mailing list
> Users@lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
>
___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

Re: [OpenSIPS-Users] timeout between the invite and the sip message after the "180 trying"?

[Russell Treleaven]

Do you mean 100 trying or 180 ringing?

On Wed, Apr 25, 2018, 9:03 AM Abdoul Osséni  wrote:

> Hello list,
>
> Is it possible to set the timeout between the invite and the sip message
> after the "180 trying"?
>
> Best regards
> Abdoul.
> ___
> Users mailing list
> Users@lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>
___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users

[OpenSIPS-Users] timeout between the invite and the sip message after the "180 trying"?

[Abdoul Osséni]

Hello list,

Is it possible to set the timeout between the invite and the sip message
after the "180 trying"?

Best regards
Abdoul.
___
Users mailing list
Users@lists.opensips.org
http://lists.opensips.org/cgi-bin/mailman/listinfo/users