<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small">Hi,</div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small">Last time i had issues with cisco gateways it had to do with UDP fragmentation. Try to find out if those missed invite packets are arriving in more then one frame. The following will allow you to check for fragmented packets. Other then that, i'm out of ideas...</div><div class="gmail_extra"><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;font-size:small"><span style="font-family:arial,sans,sans-serif;font-size:13px">tcpdump -nq -i eth0:0 "ip[6:2] & 0x3fff != 0x0000"</span></div><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif" style="background-color:rgb(255,255,255)">---</font></div><div><span style="font-family:tahoma,sans-serif">Marc</span><div class="gmail_default" style="font-family:tahoma,sans-serif;display:inline">o</div><br></div><div><span style="background-color:rgb(255,255,255)"><font face="tahoma, sans-serif"><div>---</div><br></font></span></div></div></div></div>
<br><div class="gmail_quote">On Sat, May 28, 2016 at 5:23 PM, Abel Alejandro <span dir="ltr"><<a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Actually this is my fault since I didn't explain properly, sorry for that guys.<div><br></div><div>The voipmonitor detected 11 calls from this endpoint like this, however this very same endpoint made and received hundreds of calls yesterday alone successfully, this is a Cisco UC PBX. </div><div><br></div><div>This is what the INVITE looks like with a couple details anomized. I do think everything looks good on this INVITE, port is okay and the domain is okay.</div><div><br></div>INVITE <a href="http://sip:19727612465@sip.fusetelecom.com:5060" target="_blank">sip:19727612465@sip.fusetelecom.com:5060</a> SIP/2.0<br>Via: SIP/2.0/UDP 10.30.28.1:5060;branch=z9hG4bKE5DB37D<br>From: "XXXX" <<a href="mailto:sip%3A787200xxxx@sip.fusetelecom.com" target="_blank">sip:787200xxxx@sip.fusetelecom.com</a>>;tag=DB6B8ADC-17FC<br>To: <<a href="mailto:sip%3A1972761xxxx@sip.fusetelecom.com" target="_blank">sip:1972761xxxx@sip.fusetelecom.com</a>><br>Date: Fri, 27 May 2016 14:10:16 GMT<br>Call-ID: <a href="mailto:924D11CC-234B11E6-BB27E6D2-8EBB5E3A@sip.fusetelecom.com" target="_blank">924D11CC-234B11E6-BB27E6D2-8EBB5E3A@sip.fusetelecom.com</a><br>Supported: 100rel,timer,resource-priority,replaces,sdp-anat<br>Min-SE: 600<br>Cisco-Guid: 2376044366-0592122342-3139626706-2394644026<br>User-Agent: Cisco-SIPGateway/IOS-12.x<br>Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER<br>CSeq: 101 INVITE<br>Max-Forwards: 70<br>Timestamp: 1464358216<br>Contact: <<a href="http://sip:787200xxxx@10.30.28.1:5060" target="_blank">sip:787200xxxx@10.30.28.1:5060</a>><br>Call-Info: <sip:<a href="http://10.30.28.1:5060" target="_blank">10.30.28.1:5060</a>>;method="NOTIFY;Event=telephone-event;Duration=2000"<br>Expires: 300<br>Allow-Events: telephone-event<br>Content-Type: application/sdp<br>Content-Disposition: session;handling=required<br>Content-Length: 324<br><br>v=0<br>o=CiscoSystemsSIP-GW-UserAgent 6165 9658 IN IP4 10.30.28.1<br>s=SIP Call<br>c=IN IP4 10.30.28.1<br>t=0 0<br>m=audio 17106 RTP/AVP 18 0 8 101 19<br>c=IN IP4 10.30.28.1<br>a=rtpmap:18 G729/8000<br>a=fmtp:18 annexb=no<br>a=rtpmap:0 PCMU/8000<br>a=rtpmap:8 PCMA/8000<br>a=rtpmap:101 telephone-event/8000<br>a=fmtp:101 0-16<br>a=rtpmap:19 CN/8000<div><br></div></div><div class=""><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Sat, May 28, 2016 at 12:05 PM, Marco Teixeira <span dir="ltr"><<a href="mailto:admin@marcoteixeira.com" target="_blank">admin@marcoteixeira.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div style="font-family:tahoma,sans-serif;font-size:small">It was an example.</div><div style="font-family:tahoma,sans-serif;font-size:small">What i meant was that, usually, sniffers set the NIC to promiscuous, meaning that they will catch whatever garbage arrives at the IP stack. The iptables was an example. Others have pointed before, maybe your config is not binding to the correct port ? maybe you don't have the correct domain configured in sipwise ? </div><div class="gmail_extra"><br clear="all"><div><div data-smartmail="gmail_signature"><div dir="ltr"><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif" style="background-color:rgb(255,255,255)">---</font></div><div><font face="tahoma, sans-serif" style="background-color:rgb(255,255,255)">Best regards</font></div><div><font face="tahoma, sans-serif" style="background-color:rgb(255,255,255)">Marco </font></div><div><span style="background-color:rgb(255,255,255)"><font face="tahoma, sans-serif"><div>---</div><br></font></span></div></div></div></div><div><div>
<br><div class="gmail_quote">On Sat, May 28, 2016 at 1:18 PM, Abel Alejandro <span dir="ltr"><<a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hey Marco,<div><br></div><div>I do not mean the server iptables, I do not run anything other than sipwise + sniffer, I mean the anti DDoS of the sipwise itself.</div><div><br></div><div><br></div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, May 28, 2016 at 8:04 AM, Marco Teixeira <span dir="ltr"><<a href="mailto:admin@marcoteixeira.com" target="_blank">admin@marcoteixeira.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><p dir="ltr">Hi Abel,<br>
Carefull with your assumptions. As an example, if i run sip-ngrep on the server, it will see all the traffic even before iptables drops it...</p>
<div class="gmail_quote"><div><div>Em 27/05/2016 20:12, "Abel Alejandro" <<a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a>> escreveu:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div><div><div dir="ltr">Well, the network capture is a network application that runs on the same sipwise server, its from the <a href="http://voipmonitor.org" target="_blank">voipmonitor.org</a> guys, I dont see how the network sniffer could capture the data and at the same time the server not deliver it to the kamalio process.<div><br></div><div>I sent you the pcap capture privately, but yes the domain looks correct. Is there no chance the endpoint was banned during this time? Would that skip the logs?</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 27, 2016 at 2:59 PM, Daniel Grotti <span dir="ltr"><<a href="mailto:dgrotti@sipwise.com" target="_blank">dgrotti@sipwise.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><p dir="ltr">Hi,<br>
Well if no request are on Kamailio-lb, then invites never reached the server.<br>
Are you sure the invite was heading to the right sip domain?</p><span><font color="#888888">
<p dir="ltr">Daniel</p></font></span><div><div>
<div class="gmail_quote">On May 27, 2016 8:51 PM, Abel Alejandro <<a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a>> wrote:<br type="attribution"><blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>I am testing a voipmonitor and just saw an interesting call where an endpoint sent to sipwise 3 invites and it never got answered. Mind you I am doing the voipmonitor capture at the sipwise server itself so there is no chance of network packet loss here.</div><div><br></div><div>When I take a look at the logs I dont even see the request in kamailio-lb.log or kamailio-proxy.log , is there any other place I could check?</div><div><br></div><div><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px;color:rgb(102,102,102);background-color:rgb(255,255,255)"><i><font size="4" face="'trebuchet ms', sans-serif">Abel Alejandro</font></i></span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><blockquote style="margin:0px 0px 0px 40px;border-style:none;padding:0px"></blockquote><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"><a href="tel:787%20586%208313" value="+17875868313" target="_blank">787 586 8313</a> </span><span style="font-family:'trebuchet ms',sans-serif"><font color="#ff6600">|</font></span><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"> <a href="tel:787%20705%200555" value="+17877050555" target="_blank">787 705 0555</a></span><div><a href="mailto:joquendo@alliedtechnologygrouppr.com" style="color:rgb(17,85,204)" target="_blank"></a><div><br></div><div><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">400 Calle Calaf 477</span></div><div><div style="text-align:left"><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">San Juan, PR 00918</span></div></div></div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;text-align:left;background-color:rgb(255,255,255)"><a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a></div></div></div>
</div></div>
</blockquote></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px;color:rgb(102,102,102);background-color:rgb(255,255,255)"><i><font size="4" face="'trebuchet ms', sans-serif">Abel Alejandro</font></i></span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><blockquote style="margin:0px 0px 0px 40px;border-style:none;padding:0px"></blockquote><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"><a href="tel:787%20586%208313" value="+17875868313" target="_blank">787 586 8313</a> </span><span style="font-family:'trebuchet ms',sans-serif"><font color="#ff6600">|</font></span><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"> <a href="tel:787%20705%200555" value="+17877050555" target="_blank">787 705 0555</a></span><div><a href="mailto:joquendo@alliedtechnologygrouppr.com" style="color:rgb(17,85,204)" target="_blank"></a><div><br></div><div><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">400 Calle Calaf 477</span></div><div><div style="text-align:left"><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">San Juan, PR 00918</span></div></div></div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;text-align:left;background-color:rgb(255,255,255)"><a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a></div></div></div>
</div>
<br></div></div>_______________________________________________<br>
Spce-user mailing list<br>
<a href="mailto:Spce-user@lists.sipwise.com" target="_blank">Spce-user@lists.sipwise.com</a><br>
<a href="https://lists.sipwise.com/listinfo/spce-user" rel="noreferrer" target="_blank">https://lists.sipwise.com/listinfo/spce-user</a><br>
<br></blockquote></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px;color:rgb(102,102,102);background-color:rgb(255,255,255)"><i><font size="4" face="'trebuchet ms', sans-serif">Abel Alejandro</font></i></span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><blockquote style="margin:0px 0px 0px 40px;border-style:none;padding:0px"></blockquote><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"><a href="tel:787%20586%208313" value="+17875868313" target="_blank">787 586 8313</a> </span><span style="font-family:'trebuchet ms',sans-serif"><font color="#ff6600">|</font></span><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"> <a href="tel:787%20705%200555" value="+17877050555" target="_blank">787 705 0555</a></span><div><a href="mailto:joquendo@alliedtechnologygrouppr.com" style="color:rgb(17,85,204)" target="_blank"></a><div><br></div><div><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">400 Calle Calaf 477</span></div><div><div style="text-align:left"><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">San Juan, PR 00918</span></div></div></div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;text-align:left;background-color:rgb(255,255,255)"><a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a></div></div></div>
</div>
</div></div></blockquote></div><br></div></div></div></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13px;color:rgb(102,102,102);background-color:rgb(255,255,255)"><i><font size="4" face="'trebuchet ms', sans-serif">Abel Alejandro</font></i></span><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><blockquote style="margin:0px 0px 0px 40px;border-style:none;padding:0px"></blockquote><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif">787 586 8313 </span><span style="font-family:'trebuchet ms',sans-serif"><font color="#ff6600">|</font></span><span style="color:rgb(51,51,51);font-family:'trebuchet ms',sans-serif"> 787 705 0555</span><div><a href="mailto:joquendo@alliedtechnologygrouppr.com" style="color:rgb(17,85,204)" target="_blank"></a><div><br></div><div><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">400 Calle Calaf 477</span></div><div><div style="text-align:left"><span style="color:rgb(102,102,102);font-family:'trebuchet ms',sans-serif">San Juan, PR 00918</span></div></div></div></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;text-align:left;background-color:rgb(255,255,255)"><a href="mailto:aalejandro@alliedtechnologygrouppr.com" target="_blank">aalejandro@alliedtechnologygrouppr.com</a></div></div></div>
</div>
</div></div></blockquote></div><br></div></div>