Example: SONUS Monitoring

RIBBON/SONUS Monitoring Profile

This example recipe can ingest SBC monitoring profile messages (Extended SIP) and extract/encapsulate messages back to a HEP Capture Server such as HOMER or HEPIC for use cases where encrypted TLS communication is unavailable off-the-wire for monitoring and troubleshooting purposes.

Dependencies

• HOMER or HEPIC capture server
• Ribbon/Sonus SBC with Monitoring Profile support
• NodeJS and paStash need to be installed before execution

NPM

# sudo npm install -g @pastash/pastash

PaStash Recipe

• syslog input on port 9514
• sonus filter to parse TRC events
• hep output to port 9063

Save the following recipe to a readable location, ie: /etc/pastash_sonus_monitoring.conf

input {
    udp {
        host => 0.0.0.0
        port => 8002
    }
}

filter {
    regex {
        regex => /srcIp: ([0-9.]+):([0-9]+)/
        fields => [srcIp, srcPort]
    }

    regex {
        regex => /destIP: ([0-9.]+):([0-9]+)/
        fields => [dstIp, dstPort]
    }

    compute_field {
        field => 'payload'
        value => '#{message}'
    }
}

output {
    stdout {}
    hep {
        host => HEP-SERVER-ADDRESS
        port => 9063
        hep_id => 2233
        hep_type => 1
        hep_protocol => 6
        hep_ip_family => 2
    }
}

Run as Service

Install add-to-systemd utility with npm

npm install -g add-to-systemd

Add a pastash service to systemd (will start it on boot)

add-to-systemd pastash-sonus "$(which pastash) --config_file=/etc/pastash_sonus_monitoring.conf"

Use systemctl to manage the service

systemctl start pastash-sonus

---

SBC Settings

From your SBC management, browse to the Monitoring Profile from the All category

Add a Monitoring profile pointing at the IP:PORT configured for your HEP paStash instance.

• Save and Apply your settings

Headers

In order for the packets to retain the correct network addresses, enable the srcIp and dstIp headers

• Save and Apply your settings

In case of issues adding headers, please disable/enable the monitoring profile prior to it activating

---

Validate

Login to your HOMER or HEPIC instance and look for any session originating from enabled SBCs Monitoring Profile

Notes

• Add precise timestamping enabling the timestamp header
• Add and extract additional information from extra headers