Custom App for unknown SIP traffic

OyvindM — Wed, 02 Feb 2022 11:51:59 GMT

Hi.

I need to create a Custom App for SIP traffic that is not identified by the firewall. I see that you can match on the sip headers but not sure how to write the pattern.

Have done capture of the traffic and this is what I got...

What can be used here and how do I write the pattern?

INVITE sip:2574@10.100.118.40 SIP/2.0

Min-SE: 300

Date: Wed, 02 Feb 2022 11:11:28 GMT

CSeq: 1 INVITE

Via: SIP/2.0/UDP 10.100.254.103:5060;branch=z9hG4bK1b1aeaa5-f022-1910-8d14-00d8614b2eed;rport

Session-Expires: 3600;refresher=uas

User-Agent: NVTVoIP/8.3.0.1765

From: "Seng 2128" <sip:nvm@10.100.254.103>;tag=1b1aeaa5-f022-1910-8d11-00d8614b2eed

Call-ID: 1b1aeaa5-f022-1910-8d12-00d8614b2eed@FANTOFTMBB

Supported: timer, x-siemens-sipqv2

Organization: New Voice

To: <sip:2574@10.100.118.40>

P-Asserted-Identity: "Seng 2128" <sip:nvm@10.100.254.103>

Contact: <sip:nvm@10.100.254.103>

Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,SUBSCRIBE,NOTIFY,REFER,MESSAGE,INFO,PING

Content-Type: application/sdp

Content-Length: 308

Max-Forwards: 70

v=0

o=- 1643800288 1 IN IP4 10.100.254.103

s=Opal SIP Session

c=IN IP4 10.100.254.103

t=0 0

m=audio 5144 RTP/AVP 8 0 101 100

a=sendrecv

a=rtpmap:8 PCMA/8000/1

a=rtpmap:0 PCMU/8000/1

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-16,32,36

a=rtpmap:100 NSE/8000

a=fmtp:100 192-193

a=maxptime:240

SIP/2.0 100 Trying

To: <sip:2574@10.100.118.40>

From: "Seng 2128" <sip:nvm@10.100.254.103>;tag=1b1aeaa5-f022-1910-8d11-00d8614b2eed

Call-ID: 1b1aeaa5-f022-1910-8d12-00d8614b2eed@FANTOFTMBB

CSeq: 1 INVITE

Via: SIP/2.0/UDP 10.100.254.103:5060;received=10.100.254.103;branch=z9hG4bK1b1aeaa5-f022-1910-8d14-00d8614b2eed;rport=5060

Content-Length: 0

SIP/2.0 180 Ringing

Allow: INVITE, ACK, CANCEL, BYE, PRACK, NOTIFY, REFER, SUBSCRIBE, OPTIONS, UPDATE

Contact: sip:10.100.118.40

User-Agent: OmniPCX Enterprise R11.2.2 l2.300.31.b

P-Asserted-Identity: "Gruppe 7-1 Oster" <sip:2574@nordhord;user=phone>

To: <sip:2574@10.100.118.40>;tag=b2de9e36b543975d4ff88de7dec5e216

From: "Seng 2128" <sip:nvm@10.100.254.103>;tag=1b1aeaa5-f022-1910-8d11-00d8614b2eed

Call-ID: 1b1aeaa5-f022-1910-8d12-00d8614b2eed@FANTOFTMBB

CSeq: 1 INVITE

Via: SIP/2.0/UDP 10.100.254.103:5060;received=10.100.254.103;branch=z9hG4bK1b1aeaa5-f022-1910-8d14-00d8614b2eed;rport=5060

Content-Length: 0

topic Custom App for unknown SIP traffic in Custom Signatures

Custom App for unknown SIP traffic