<div dir="ltr">How about running a continuous tshark/pcap/ngrep on interfaces of interest.<div>you can run every 10min.  putting in 10min files.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 22, 2021 at 6:36 AM johan <<a href="mailto:johan@democon.be">johan@democon.be</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
  
    
  
  <div>
    <p>yeah me too. <br>
    </p>
    <p>but I want also to see the forwarded packet with all changes. <br>
    </p>
    <div>On 22/01/2021 12:13, Nick Altmann
      wrote:<br>
    </div>
    <blockquote type="cite">
      
      <div dir="ltr">It depends on purpose. For example, I need an
        initial (untouched) packet there.
        <div><br clear="all">
          <div>
            <div dir="ltr">
              <div dir="ltr">
                <div>
                  <div dir="ltr">
                    <div>
                      <div dir="ltr">
                        <div>--</div>
                        <div>Nick</div>
                      </div>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
      <br>
      <div class="gmail_quote">
        <div dir="ltr" class="gmail_attr">пт, 22 янв. 2021 г. в 09:18,
          johan <<a href="mailto:johan@democon.be" target="_blank">johan@democon.be</a>>:<br>
        </div>
        <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi,<br>
          <br>
          <br>
          when you use the siptrace module and you go to homer from
          opensips<br>
          (hence without a port mirror/span port on a switch), when you
          change<br>
          from /to header, then the homer trace doesnot reflect the real
          packet<br>
          that exits opensips (as we all know, from to header changes
          are only<br>
          active when the packet is send out). <br>
          <br>
          <br>
          I find this annoying as the purpose of having a tracer is
          defeated by<br>
          this : we want to see the real packets with the changes
          applied.<br>
          <br>
          <br>
          Therefore : are there more people on the list who are ennoyed
          by this ?<br>
          If yes, then I will open a feature request for it.<br>
          <br>
          <br>
          wkr,<br>
          <br>
          _______________________________________________<br>
          Users mailing list<br>
          <a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
          <a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
        </blockquote>
      </div>
      <br>
      <fieldset></fieldset>
      <pre>_______________________________________________
Users mailing list
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a>
</pre>
    </blockquote>
  </div>

_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div>