For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

pedroviejo_1497's avatar
pedroviejo_1497
Icon for Nimbostratus rankNimbostratus
Apr 03, 2014

irule to identify SIP 603 message

Hi,

 

I need some assistance creating an irule to analize a SIP 603 decline message. This is the body of the SIP message:

 

SIP/2.0 603 Decline To: ;tag=xxxx From: ;tag=xxxx Call-ID: xxxxxxx CSeq: 1 INVITE Content-Length: 0 Via: SIP/2.0/UDP xxxxx Allow: PRACK, INFO, INVITE, ACK, BYE, CANCEL, UPDATE, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS P-Charging-Vector: P-Charging-Function-Addresses:

 

I need to check if received SIP message is a 603 decline. I've created and applied the following irule in order to print "603" in local log:

 

when SIP_REQUEST { log local0. "SIP_REQUEST: [SIP::method] -- [SIP::response code],,[SIP::response phrase]"

 

} when SIP_RESPONSE { log local0. "SIP_RESPONSE: [SIP::method] -- [SIP::response code],,[SIP::response phrase]"

 

} when SIP_REQUEST_SEND { log local0. "SIP_REQUEST_SEND: [SIP::method] -- [SIP::response code],,[SIP::response phrase]"

 

} when SIP_RESPONSE_SEND { log local0. "SIP_RESPONSE_SEND: [SIP::method] -- [SIP::response code],,[SIP::response phrase]"

 

}

 

But, after receive a SIP 603 message in load balancer, it did not log anything about 603 message.

 

Please, could you help me to desing an irule to identify a SIP 603 message? What type of event is it? I mean, SIP_RESPONSE_SEND? SIP_REQUEST_SEND?...

 

Thanks in advance for your support!

 

application delivery
BIG-IP Access Policy Manager (APM)
design
devops
iRules
LTM
security

1 Reply

  • Sophie_D_175631's avatar
    Sophie_D_175631
    Icon for Nimbostratus rankNimbostratus
    Jan 13, 2015

    Hello, I apologize for this late reply. I'm responding anyway in case you're still having issues.

     

    First of all, which version of TMOS are you running?

     

    Are you getting any errors? I would expect the SIP::response method to return nothing for the two REQUEST events. Valid events would be SIP_RESPONSE, SIP_RESPONSE_SEND, MR_INGRESS and MR_EGRESS (the last two are generalized for all of the Message Routing protocols).

     

    Do you see your log messages show up at all? If not, your iRule is probably not firing. Double check that your virtual server has the correct rule(s) attached. Then, verify that traffic is passing by capturing packets (tcpdump or similar). And of course, verify that you are looking ar the correct log file.

     

    If you do see some log output, please paste a sample of the logs after passing traffic.

     

    Try the following:

     

    when SIP_RESPONSE { 
    log local0. "SIP response: code = [SIP::response code] phrase = [SIP::response phrase]"
    if {[SIP::response code] == "603"} {
        log local0. "DECLINE"
    }
}

    To answer on your question about which events to use, think of it this way. What type of message would contain a response code? A request message? No. A response message. If you're only interested in incoming (received) response messages, go with SIP_RESPONSE or MR_INGRESS. The two "_SEND" events are for outgoing message (from BIGIP to server).

     

    You can read about these events here.