Calea on 3.10 and TZSP Calea server

RouterOS General
1

I tried to cofigure an RB600 to create a Calea Intercept:

/ ip firewall calea add action=sniff chain=forward sniff-target=192.168.1.26 sniff-target-port=5555
src-address=192.168.1.25
/ ip firewall calea add action=sniff chain=forward sniff-target=192.168.1.26 sniff-target-port=5555
dst-address=192.168.1.25

but nothing seems to happens.

I use Wireshark (ethereal) in Ubuntu(linux) and WinXP, but I can’t find any TZSP packet or paquet going to 5555 port on 192.168.1.26 :frowning:

Any ideas??

Tanks

2

Check on some of my Prev Posts RE CALEA..

I ran into a similar problem… on an earlier release…
I cant remember where (what chain it was), but I had to add a second set of rules to get the packets to “Sniff”… the rules are the same, but in a different chain…

BOTH seem to be required… (This was going to be investigated by the boys, but I don’t know if it was due to the fact that an update was going to be done for some out of band “reporting” that was needed for compliance to the WISPA / CALEA std.)

Take a look at the rules I added and add them for testing and I think you will see packets streaming after you do..

As this is a “why wont this work” “FIX”, please test the results with known data to ensure that the results are what you need… I don’t want you to rely on my “tweaks” on a production environment especially AFTER receiving one of those wonderfull subpoenas…
and then getting slammed with fines due to a configuration issue…

Hope this helps..

3

Thanks for the response, but it didn’t help me more

(I had been reading all post in forum who talks abouth Calea)

But nobody writes a “complete” configuration for Calea

and the wiki example: http://wiki.mikrotik.com/wiki/Calea its for a Mikrotik Calea Server
and http://mum.mikrotik.com/presentations/US07/MUM_CALEA.pdf example talks about /ip firewall filter (not Calea)

Thanks again for the response, but i can’t find the solution of my problem

4

Check the posts..
It is NOT in the manuals (It seems to be a “feature”)

It was supposed to be “fixed” you should NOT need the second chain set…

5

My question is solved in RouterOS 3.13

Thanks Sergejs :slight_smile: