Thinking a bit about your case - do you know what all "good" traffic should look like? If so - could you possibly create one REGEX statement that would say "if it doesn't look like this - discard" ?
I don't think $fu can be NULL unless it's actually not in the packet. as far as I can tell - OS looks for the sip: and grabs everything behind it to the > or ; or whatever is the next delimiter. There's always inserting each valid domain into the db and using db lookups for verification - dunno how many different domains you serve, but it's one way... On Mon, Feb 14, 2011 at 11:47 PM, thrillerbee <thriller...@gmail.com> wrote: > I'm really trying to find methods of combating memory leaks that I now > believe must be caused by some specific traffic pattern. As a result, I'm > trying to "filter" as much "bad" traffic as possible before it gets into the > core of my network. > > I *have* seen parse errors on the from header as I use uac_replace_from to > normalize traffic to determine jurisdiction, etc. I'd like to know how to > identify that traffic, so, would $fu be NULL in this scenario? Is there a > better method? > > Thanks. > > > On Sun, Feb 13, 2011 at 7:13 AM, Tyler Merritt <ty...@fonality.com> wrote: > >> I'm relatively new to OpenSIPs myself - but in my various experiments - >> the idea that OS cannot parse a header is a bit foreign. As a SIP proxy - >> it's job is more to use the routing logic in order to transmit packets from >> A through to C via B (OS itself). >> >> I have sent packets with bogus From and To headers and they transmit to >> the end destination just fine. I don't believe that your answer will be >> found in the format of the headers. Rather, the best way to detect invalid >> headers (I think) would be to use TextOps modules and REGEX to act on the >> headers themselves and detect formats that you say are valid. >> >> OS is flexible enough to do this - plenty of logic in the IF, THEN, ELSE >> statements within routing blocks in order to check these headers against >> rules that you assert are "valid". >> >> >> >> On Sat, Feb 12, 2011 at 7:57 AM, thrillerbee <thriller...@gmail.com>wrote: >> >>> What is the easiest way to identify traffic with invalid headers? >>> Specifically, the from and to URIs. >>> For example, if OpenSIPS is unable to parse a from URI, would $fu be >>> NULL? >>> >>> Thanks. >>> >>> _______________________________________________ >>> Users mailing list >>> Users@lists.opensips.org >>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users >>> >>> >> >> _______________________________________________ >> Users mailing list >> Users@lists.opensips.org >> http://lists.opensips.org/cgi-bin/mailman/listinfo/users >> >> > > _______________________________________________ > Users mailing list > Users@lists.opensips.org > http://lists.opensips.org/cgi-bin/mailman/listinfo/users > >
_______________________________________________ Users mailing list Users@lists.opensips.org http://lists.opensips.org/cgi-bin/mailman/listinfo/users