Nature of traffic

hishamjan — Fri, 19 Feb 2021 12:20:37 GMT

Hi,

I have two instances of Asterisk running in my production environment. The third server has a Splunk indexer installed with Universal Forwarders installed on the two Asterisk servers, respectively. The calling system is via SIP trunks and all of the calls fall on the Asterisk servers.

Now, I would like to monitor the nature of the traffic that is catered by the Asterisk Servers, i.e. UDP, TCP or RTP?

Is there a way to do so?

Any degree of help will be appreciated.

thanks and regards,

Hisham

Re: Nature of traffic

tscroggins — Sat, 20 Feb 2021 21:25:06 GMT

@hishamjan

RTP and SIP are application layer protocols that may use either TCP or UDP as a transport. I'm not familiar with Asterisk, but it presumably includes functionality to log session and call metrics.

You can use Splunk App for Stream to monitor network traffic on the forwarders and send cooked traffic events to the indexer. Both RTP and SIP are supported.

The implementation of Splunk App for Stream can be non-trivial. If you're unfamiliar with packet capture and protocol analysis concepts, you may prefer to enlist Splunk Professional Services or another qualified consultant.

topic Nature of traffic in Splunk Search

Nature of traffic

Re: Nature of traffic