Error upon execution of utils/kernel-intercept-pcap-replay.pl

[Alex Kolomoyskyy]

Hello

I guess that many people here used that script and hope that someone could explain what is the reason it fails.

Thank you in advance. Below is a problem  description.

OS - RHEL 64bit
RTP in pcap file - pcmu/8000

rtpengine 12.1.1.4

kernel-intercept-pcap-replay.pl - latest from master branch
xt_RTPENGINE loaded and properly functioning

In general, everything is working fine between rtpengine and rtpengine-recording on that host.

Command line
perl kernel-intercept-pcap-replay.pl call3_full_1_rtp.pcap 0 pcmu/8000

sysread inside of msg_ret here fails with "Numerical result out of range at kernel-intercept-pcap-replay.pl line 177":

print("adding kernel call\n");
my (undef, $cid) = msg_ret(5, '', 'I I', 'I a256', 0, $parent)
print("kernel cid $cid\n");

sub msg_ret {
my ($cmd, $extra, $unpacker, $packer, @rest) = @_;
my $msg = pack('II' . $packer, $cmd, 0, @rest);
# for 32-bit:
# my $msg = pack('I' . $packer, $cmd, @rest);
$msg .= ("\0" x (840 - length($msg))); # packet length also needs adjusting for 32-bit
$msg .= ($extra // '');
sysread($kfd, $msg, length($msg)) or die $!;
return unpack($unpacker, $msg);
}

 

[Richard Fuchs]

On 27/05/2026 15.54, Alex Kolomoyskyy wrote:
> I guess that many people here used that script

Bold assumption 😅

> and hope that someone could explain what is the reason it fails

The last update to that script was in 2019. It fails because the
interface to the kernel module has changed since then, and the script
hasn't been updated.

I'll see if it can be updated to make it work. In the meantime, the
version of rtpengine at that time was 8.2, if you want to try it against
an older version.

Cheers

[Alex Kolomoyskyy]

Thanks, Richard, I figured it out. Error was raised by kernel ext module due to excessive length of message (840 instead of 264 for call add command).

Actually, I only switched to "32bit" msg initialization, that solved it.

Alex

[Richard Fuchs]

On 28/05/2026 12.48, Alex Kolomoyskyy wrote:
> Thanks, Richard, I figured it out. Error was raised by kernel ext
> module due to excessive length of message (840 instead of 264 for call
> add command).
> Actually, I only switched to "32bit" msg initialization, that solved it.

Ok great, that was one of the things I had to fix, but I guess against
the current trunk version there were a few more differences that needed
to be addressed.

This is now done here:
https://github.com/sipwise/rtpengine/commit/5df7cabbb27ec383bdca8ff900b01a050eb3956d
which also requires
https://github.com/sipwise/rtpengine/commit/421868df45e6dd292316e3ad5a4a5cfa5e08811c

Cheers

[Alex Kolomoyskyy]

Hello Richard

After it started to push packets through kernel extension, I encountered another issue - rtpengine-recording creates wav file what contains only header, so it seems that it successfully processed metadata file, but didn't read packets from sink.

In log of rtpengine-recording I see only 1 message "adding packet from stream #0 to mix output" while pcap contains ~1400 RTP packets.

Could you, please, take a look at rtpengine-recording.log and pcap file (both attached)?

Thank you in advance

Alex 

[Alex Kolomoyskyy]

Hello Richard

Additional info - every time I run that perl script, I see the following messages in syslog (once per run):

May 28 22:13:26 guebcontst03 kernel: rtpengine-recor[27729]: segfault at a5 ip 000000000041aff9 sp 00007fd2077fce30 error 4 in rtpengine-recording[409000+1f000]
May 28 22:13:26 guebcontst03 kernel: Code: 8d 7c 24 30 31 f6 e8 56 e7 fe ff 48 8b 44 24 28 44 89 ea 48 8b bb 20 02 00 00 be b7 e7 42 00 4c 8b 88 88 00 00 00 48 8b 04 24 <48> 8b 48 10 ff 74 24 38 31 c0 ff 74 24 38 4d 8b 46 38 e8 e0 e2 fe

Nothing like that happens when packets are coming from rtpengine.

Alex

[Richard Fuchs]

On 28/05/2026 18.59, Alex Kolomoyskyy wrote:
> Additional info - every time I run that perl script, I see the
> following messages in syslog (once per run):
> May 28 22:13:26 guebcontst03 kernel: rtpengine-recor[27729]: segfault
> at a5 ip 000000000041aff9 sp 00007fd2077fce30 error 4 in
> rtpengine-recording[409000+1f000]
> May 28 22:13:26 guebcontst03 kernel: Code: 8d 7c 24 30 31 f6 e8 56 e7
> fe ff 48 8b 44 24 28 44 89 ea 48 8b bb 20 02 00 00 be b7 e7 42 00 4c
> 8b 88 88 00 00 00 48 8b 04 24 <48> 8b 48 10 ff 74 24 38 31 c0 ff 74 24
> 38 4d 8b 46 38 e8 e0 e2 fe

Ok, so not just a one-line fix. You're probably running into what this
fixes:
https://github.com/sipwise/rtpengine/commit/8172b83e23f6017adb4b88da52bb8c7a6f094ad1

Which was a result of this mismatch:
https://github.com/sipwise/rtpengine/commit/5df7cabbb27ec383bdca8ff900b01a050eb3956d#diff-cfaaca760d76569d7f4a46ebd731c27c116cd8da8a1bb4e14b52dd10f0d0c07aL57-R57

Which in turn was updated to match this change:
https://github.com/sipwise/rtpengine/commit/421868df45e6dd292316e3ad5a4a5cfa5e08811c#diff-83c6cc89d5f804092dd7a107089df5ca1b780c7c73896f3f5aa83a36657b5c4bL170-R172

IOW, it's probably best if you just update to the trunk version.

Cheers

[Alex Kolomoyskyy]

Hello Richard

Thanks for your comments, but I am not sure they are applicable in our case - we use old release (12.1.14), where  media-sdp-id has not been introduced yet and enum rtpengine_command in xt_RTPENGINE.h contained REMG_DEL_TARGET

Btw, what "trunk version" actually means? I have some telephony-based associations with word "trunk", but it doesn't help here :)

Alex

[Richard Fuchs]

On 29/05/2026 11.31, Alex Kolomoyskyy wrote:
> Thanks for your comments, but I am not sure they are applicable in our
> case - we use old release (12.1.14), where media-sdp-id has not been
> introduced yet and enum rtpengine_command in xt_RTPENGINE.h
> contained REMG_DEL_TARGET

I wasn't suggesting that you should take the entire commits as they are,
just the parts that are relevant. You can check in daemon/recording.c to
see the expected format of the "STREAM ... details" chunk.

12.1 is no longer maintained so there won't be any fixes applied to that
version branch.

> Btw, what "trunk version" actually means? I have some telephony-based
> associations with word "trunk", but it doesn't help here :)

The "master" branch from upstream git:
https://github.com/sipwise/rtpengine/commits/master/

Cheers

[Alex Kolomoyskyy]

Thanks, Richard, will try to apply quick square patch for metadata (at least TAG-MEDIA) in perl script first.

We definitely will move to latest release, but it is kind of longer time story due to required testing, etc.

Alex 

[Alex Kolomoyskyy]

Thanks again, Richard.

Square patch did the job so I finally made it work end-to-end.

Alex