doc/userguide/rules/sip-keywords.rst
The SIP keywords are implemented as sticky buffers and can be used to match on fields in SIP messages.
As described in RFC3261, common header field names can be represented in a short form. In such cases, the header name is normalized to its regular form to be matched by its corresponding sticky buffer.
============================== ================== Keyword Direction ============================== ================== sip.method Request sip.uri Request sip.request_line Request sip.stat_code Response sip.stat_msg Response sip.response_line Response sip.protocol Both sip.from Both sip.to Both sip.via Both sip.user_agent Both sip.content_type Both sip.content_length Both ============================== ==================
This keyword matches on the method found in a SIP request.
Syntax
::
sip.method; content:<method>;
Examples of methods are:
* INVITE
* BYE
* REGISTER
* CANCEL
* ACK
* OPTIONS
Examples
::
sip.method; content:"INVITE";
This keyword matches on the uri found in a SIP request.
Syntax
::
sip.uri; content:<uri>;
Where <uri> is an uri that follows the SIP URI scheme.
Examples
::
sip.uri; content:"sip:sip.url.org";
This keyword forces the whole SIP request line to be inspected.
Syntax
::
sip.request_line; content:<request_line>;
Where <request_line> is a partial or full line.
Examples
::
sip.request_line; content:"REGISTER sip:sip.url.org SIP/2.0"
This keyword matches on the status code found in a SIP response.
Syntax
::
sip.stat_code; content:<stat_code>
Where <status_code> belongs to one of the following groups of codes:
* 1xx - Provisional Responses
* 2xx - Successful Responses
* 3xx - Redirection Responses
* 4xx - Client Failure Responses
* 5xx - Server Failure Responses
* 6xx - Global Failure Responses
Examples
::
sip.stat_code; content:"100";
This keyword matches on the status message found in a SIP response.
Syntax
::
sip.stat_msg; content:<stat_msg>
Where <stat_msg> is a reason phrase associated to a status code.
Examples
::
sip.stat_msg; content:"Trying";
This keyword forces the whole SIP response line to be inspected.
Syntax
::
sip.response_line; content:<response_line>;
Where <response_line> is a partial or full line.
Examples
::
sip.response_line; content:"SIP/2.0 100 OK"
This keyword matches the protocol field from a SIP request or response line.
If the response line is 'SIP/2.0 100 OK', then this buffer will contain 'SIP/2.0'
Syntax
::
sip.protocol; content:<protocol>
Where <protocol> is the SIP protocol version.
Example
::
sip.protocol; content:"SIP/2.0"
This keyword matches on the From field that can be present in SIP headers. It matches both the regular and short forms, though it cannot distinguish between them.
Syntax
::
sip.from; content:<from>
Where <from> is the value of the From header.
Example
::
sip.from; content:"user"
This keyword matches on the To field that can be present in SIP headers. It matches both the regular and short forms, though it cannot distinguish between them.
Syntax
::
sip.to; content:<to>
Where <to> is the value of the To header.
Example
::
sip.to; content:"user"
This keyword matches on the Via field that can be present in SIP headers. It matches both the regular and short forms, though it cannot distinguish between them.
Syntax
::
sip.via; content:<via>
Where <via> is the value of the Via header.
Example
::
sip.via; content:"SIP/2.0/UDP"
This keyword matches on the User-Agent field that can be present in SIP headers.
Syntax
::
sip.user_agent; content:<user_agent>
Where <user_agent> is the value of the User-Agent header.
Example
::
sip.user_agent; content:"Asterisk"
This keyword matches on the Content-Type field that can be present in SIP headers. It matches both the regular and short forms, though it cannot distinguish between them.
Syntax
::
sip.content_type; content:<content_type>
Where <content_type> is the value of the Content-Type header.
Example
::
sip.content_type; content:"application/sdp"
This keyword matches on the Content-Length field that can be present in SIP headers. It matches both the regular and short forms, though it cannot distinguish between them.
Syntax
::
sip.content_length; content:<content_length>
Where <content_length> is the value of the Content-Length header.
Example
::
sip.content_length; content:"200"