app_cisco (Cisco ISR) filter plugin DNS lookup error about pastash HOT 14 CLOSED

Thanks @pierok13 new version published

+ @pastash/[email protected]

from pastash.

Your report is appreciated. Please star this repository to motivate its developers! ⭐

from pastash.

Could you please let me know if there is any additional information that I could provide to help further troubleshoot this issue?

Thanks.

from pastash.

Let me check

from pastash.

I pulled a request to delete that dns query as it was a try to do something that doesn't work. sorry for that.
here

from pastash.

Many thanks.
Saw that dns variable at the beginning as well, but was not sure about what it did.
Happy to hear it is not really used.
Will build again once it is deleted and test.

from pastash.

Hi.
Were the changes pushed? I am keen on testing again.

from pastash.

I just tested this again. And I am still getting a DNS issue, but this time a bit different:

Error: getaddrinfo ENOTFOUND .
    at GetAddrInfoReqWrap.onlookup [as oncomplete] (node:dns:72:26) {
  errno: -3008,
  code: 'ENOTFOUND',
  syscall: 'getaddrinfo',
  hostname: '.'
}
undefined

Were you able to successfully test it? Perhaps I am missing something.
I have the debug for the plugin filter set to debug (just like in the config pasted above).

from pastash.

Thats not good. I have no data to test this but I think I can patch it up. Standby.

from pastash.

@runelucica nothing too obvious in the code, it would appear as the srcIp was just a . (unlikely?)
are those errors constant or are there also successful extractions?
It's really hard to tell without seeing the logs they stem from

from pastash.

I have attached the SIP messages as a separate file.
The paStash debug log output is this one:

2021-11-10T12:41:55.603770780Z null
2021-11-10T12:41:55.603873544Z EXTERNAL_IP
2021-11-10T12:41:58.669639871Z null
2021-11-10T12:41:58.669680478Z EXTERNAL_IP
2021-11-10T12:41:59.672896218Z null
2021-11-10T12:41:59.672919305Z 0.0.0.9

Is that what we are supposed to see with logging set to debug?

These are the SIP messages:
SIP Messages.txt

I replaced sensitive data with some text labels.

I don't see those error messages anymore in the pastash logs, but I don't see this in Homer either. Took a packet capture to see if anything is sent to the heplify-server on TCP 9060 (as configured), but I can't see anything.

Any other ideas would be appreciated.

from pastash.

9060 is typically a UDP port, are you positive that's correct?

from pastash.

I believe I am using TCP. I have several heplify agents running across the environment and all are configured to use TCP.
The ports exposed on the heplify-server docker-compose service are:
ports:
- "9060:9060"
- "9096:9096"

And the heplify server configuration specifies only this address:
HEPTCPAddr = "0.0.0.0:9060"

The other ones (HEPAddr and HEPTLSAddr) are commented out.

from pastash.

Based on my latest testing the DNS error is not a problem anymore.
I have other ones for which I will open a separate issue.
Thanks for the help.

from pastash.