UDP input/output issue

[thepacketlover]

Hello,
on the WIKI on HEP forwarding https://github.com/sipcapture/paStash/wiki/Example:-HEP-Relay there an example with UDP in and UDP out, also an example with UDP-> AMQP. AMQP -> UDP. I have tried both with similar problems.

I am trying to get UDP-> AMQP. AMQP -> UDP working but I have a feeling the UDP in/out issue will solve the issue with AMQP.

Here is an outline of what I have tried or looked at:

heplify -------UDP. ------>. heplify Server. Data in Homer

Once I put in paStash with UDP in and out based on example nothing shows up in homer

heplify---UDP--> paStatsh --UDP----> heplify Server nothing in Homer

I have replaced paStash with Samplicator. https://github.com/sleinen/samplicator and I get data in homer. Samplicator is a simple UDP packet replicator.

heplify---UDP--> samplicator --UDP----> heplify Server Data in homer... but does not help on moving to AMQP. It just shows the path and firewall rules are good.

Environment: Cent 7 latest. node v14.15.5 also tried v10.x, v15.8.0. same issues.
simple udp in udp out config.

input {
  udp {
    host => 192.168.176.11
    port => 9060
  }
}

output {
  udp {
    host => 192.168.176.8
    port => 9060
  }
}

192.168.176.43 heplify
192.168.176.11. paStash
192.168.176.8 Heplify-server

I see packet flow in and out of paStash. pcap is attached.

The LUA Wireshark dissector
pa-Stash-udp-udp-hep.pcap.zip
does not decode what is going out of paStash(packets sourced from 192.168.176.11 to 192.168.176.8). The packet capture was from the server where paStash running 192.168.176.11

[lmangani]

Hi @thepacketlover its hard to compare pastash and samplicator - pastash does not blindly forward network packets but rather interprets, reassembles and decodes them internally for modification and reshaping. The raw UDP/TCP examples should work indeed, but perhaps there's more at play. Try to stdout{} a few of the egress messages to see what they contain in detail.

In your case, you also might want to avoid doing UDP/TCP/UDP pipelines for obvious reasons i'd suggest using TCP HEP.

[lmangani]

NOTE: adding the raw serializer to the input might make this work as you would expect.