Multiple SIP INVITE to provider with round-robin servers

Asterisk Asterisk Support
1

Hello,

All of a sudden calls to my provider vitelity.net are failing. First they said there was something wrong with the authentication (not possible, nothing changed). Now they say (and have shown a dump proving) that Asterisk is sending successive INVITE’s to different servers. The DNS record for outbound.vitelity.net is a round-robin list and clearly Asterisk is doing multiple DNS lookups as part of the same call attempt… and DNS is correctly returning a different IP at the top of the list each time. Vitelity says “it’s a bug or configuration problem”. However I have not upgraded software nor changed the configuration.

Before I get into config files, traces etc. can someone please comment whether Asterisk is supposed to send multiple successive INVITE’s - I think that is a normal part of the authentication process is it not? And if so - surely it shouldn’t be repeating the DNS lookup?

OR: is there something the provider may be doing wrong? It’s so strange that this happened without me changing anything on my side, and I can’t be the only person using * with Vitelity…

Searching the web I didn’t find any specific help, there were a few old reports that suggested “canreinvite” or “srvlookup” could be the problem but both of those have always been “no” in my configuration.

I’m using Asterisk 1.8.11.1-1digium1~lucid.

I’m not an expert on SIP, and appreciate any help - all of a sudden we can’t make outbound calls… Thanks!

2

Please do a “sip set debug on”, make outbound call towards the provider and copy/paste the output here. It’s impossible to pin point the problem without any debugs.

3

Thank you - Here are the relevant IP’s:
Name: outbound.vitelity.net
Addresses: 64.2.142.111
64.2.142.187
64.2.142.188
64.2.142.189
64.2.142.190
64.2.142.106
64.2.142.107
64.2.142.109
This appears in the log too but isn’t relevant to this problem:
Name: inbound24.vitelity.net
Address: 66.241.96.164

Here is the SIP log (username etc. altered):
<— SIP read from UDP:64.2.142.190:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK76bb049b;received=70.38.15.82
From: “Unknown” sip:username@70.38.15.82;tag=as626a7c2b
To: sip:64.2.142.190;tag=as1a483d60
Call-ID: 41a784441b8c43992f7eacf74116ade9@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘41a784441b8c43992f7eacf74116ade9@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47] Reliably Transmitting (no NAT) to 64.2.142.109:5060:
OPTIONS sip:64.2.142.109 SIP/2.0
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK0aea6625
Max-Forwards: 70
From: “Unknown” sip:username@70.38.15.82;tag=as1e9726b2
To: sip:64.2.142.109
Contact: sip:username@70.38.15.82:5060
Call-ID: 266148971fea5f796b948d9a5ae8586a@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:47 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:47] Reliably Transmitting (no NAT) to 66.241.96.164:5060:
OPTIONS sip:inbound24.vitelity.net SIP/2.0
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK3b2a7fc8
Max-Forwards: 70
From: “Unknown” sip:Unknown@70.38.15.82;tag=as5b88e662
To: sip:inbound24.vitelity.net
Contact: sip:Unknown@70.38.15.82:5060
Call-ID: 7d2c0ee87786a48f7db2c5025b78f7d5@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:47 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.109:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK0aea6625;received=70.38.15.82
From: “Unknown” sip:username@70.38.15.82;tag=as1e9726b2
To: sip:64.2.142.109;tag=as0db037d5
Call-ID: 266148971fea5f796b948d9a5ae8586a@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘266148971fea5f796b948d9a5ae8586a@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47] Reliably Transmitting (no NAT) to 64.2.142.106:5060:
OPTIONS sip:64.2.142.106 SIP/2.0
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK7d01b2fd
Max-Forwards: 70
From: “Unknown” sip:username@70.38.15.82;tag=as2886af3c
To: sip:64.2.142.106
Contact: sip:username@70.38.15.82:5060
Call-ID: 1a6bd68c28bf6ee0084b37d079305883@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:47 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:47] Reliably Transmitting (no NAT) to 64.2.142.107:5060:
OPTIONS sip:64.2.142.107 SIP/2.0
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK6ed25c80
Max-Forwards: 70
From: “Unknown” sip:username@70.38.15.82;tag=as039c6890
To: sip:64.2.142.107
Contact: sip:username@70.38.15.82:5060
Call-ID: 7e12942819e41aef567c2ef017754104@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:47 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.106:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK7d01b2fd;received=70.38.15.82
From: “Unknown” sip:username@70.38.15.82;tag=as2886af3c
To: sip:64.2.142.106;tag=as78b11832
Call-ID: 1a6bd68c28bf6ee0084b37d079305883@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘1a6bd68c28bf6ee0084b37d079305883@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.107:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK6ed25c80;received=70.38.15.82
From: “Unknown” sip:username@70.38.15.82;tag=as039c6890
To: sip:64.2.142.107;tag=as539acf45
Call-ID: 7e12942819e41aef567c2ef017754104@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘7e12942819e41aef567c2ef017754104@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47]
<— SIP read from UDP:197.216.15.24:50371 —>
ACK sip:14165551212@ceml.xxxx.xx SIP/2.0
Via: SIP/2.0/UDP 197.216.15.24:50964;branch=z9hG4bK-d8754z-1c5780569e003f74-1—d8754z-;rport
To: "14165551212"sip:14165551212@ceml.xxxx.xx;tag=as07caa1eb
From: "310"sip:310@ceml.xxxx.xx;tag=3e531d27
Call-ID: NTVhMGI4MzNlNmQzZmI4NTk0OTgzNmVmZGMxNTNkYjI.
CSeq: 2 ACK
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (7 headers 0 lines) —
[2012-10-08 14:51:47] Reliably Transmitting (no NAT) to 64.2.142.188:5060:
OPTIONS sip:outbound.vitelity.net SIP/2.0
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK69dc1a24
Max-Forwards: 70
From: “Unknown” sip:username@70.38.15.82;tag=as57d298ad
To: sip:outbound.vitelity.net
Contact: sip:username@70.38.15.82:5060
Call-ID: 0ddbb7bc30bf15e87520f0d614841a3b@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:47 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.188:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK69dc1a24;received=70.38.15.82
From: “Unknown” sip:username@70.38.15.82;tag=as57d298ad
To: sip:outbound.vitelity.net;tag=as5d8f2c1c
Call-ID: 0ddbb7bc30bf15e87520f0d614841a3b@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘0ddbb7bc30bf15e87520f0d614841a3b@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47]
<— SIP read from UDP:66.241.96.164:5060 —>
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK3b2a7fc8;received=70.38.15.82
From: “Unknown” sip:Unknown@70.38.15.82;tag=as5b88e662
To: sip:inbound24.vitelity.net;tag=as1ec6890b
Call-ID: 7d2c0ee87786a48f7db2c5025b78f7d5@70.38.15.82:5060
CSeq: 102 OPTIONS
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Accept: application/sdp
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47] Really destroying SIP dialog ‘7d2c0ee87786a48f7db2c5025b78f7d5@70.38.15.82:5060’ Method: O
ONS
[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.188:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK356789cc;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05e34d60
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 102 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2dd28216"
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.111:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK1c0748b0;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as219823a7
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 103 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="42578f79"
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.107:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK7dd83206;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05c1b298
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 104 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2c6995d0"
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:47]
<— SIP read from UDP:64.2.142.190:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK0eafe944;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as5e84535b
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 105 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="0b1c0008"
Content-Length: 0
<------------->
[2012-10-08 14:51:47] — (11 headers 0 lines) —
[2012-10-08 14:51:48]
<— SIP read from UDP:64.2.142.188:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK356789cc;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05e34d60
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 102 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2dd28216"
Content-Length: 0
<------------->
[2012-10-08 14:51:48] — (11 headers 0 lines) —
[2012-10-08 14:51:48]
<— SIP read from UDP:64.2.142.111:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK1c0748b0;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as219823a7
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 103 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="42578f79"
Content-Length: 0
<------------->
[2012-10-08 14:51:48] — (11 headers 0 lines) —
[2012-10-08 14:51:48]
<— SIP read from UDP:64.2.142.107:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK7dd83206;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05c1b298
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 104 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2c6995d0"
Content-Length: 0
<------------->
[2012-10-08 14:51:48] — (11 headers 0 lines) —
[2012-10-08 14:51:48]
<— SIP read from UDP:64.2.142.190:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK0eafe944;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as5e84535b
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 105 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="0b1c0008"
Content-Length: 0
<------------->
[2012-10-08 14:51:48] — (11 headers 0 lines) —
[2012-10-08 14:51:49] Really destroying SIP dialog ‘433f7c680683a17e1e59dcb37d62e190@127.0.1.1’ Method: REGISTER
[2012-10-08 14:51:50] Reliably Transmitting (NAT) to 10.1.0.149:5065:
OPTIONS sip:320@10.1.0.149:5065;rinstance=cc5cae29a21f1ba9 SIP/2.0
Via: SIP/2.0/UDP 10.20.0.1:5060;branch=z9hG4bK770e9607;rport
Max-Forwards: 70
From: “Unknown” sip:Unknown@10.20.0.1;tag=as56aefebe
To: sip:320@10.1.0.149:5065;rinstance=cc5cae29a21f1ba9
Contact: sip:Unknown@10.20.0.1:5060
Call-ID: 79bfb47322fb17873e58d2a9593da9de@10.20.0.1:5060
CSeq: 102 OPTIONS
User-Agent: FPBX-2.10.1(1.8.11.1)
Date: Mon, 08 Oct 2012 14:51:50 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

[2012-10-08 14:51:50]
<— SIP read from UDP:10.1.0.149:5065 —>
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.20.0.1:5060;branch=z9hG4bK770e9607;rport=5060
Contact: sip:10.1.0.149:5065
To: sip:320@10.1.0.149:5065;rinstance=cc5cae29a21f1ba9;tag=36390b68
From: "Unknown"sip:Unknown@10.20.0.1;tag=as56aefebe
Call-ID: 79bfb47322fb17873e58d2a9593da9de@10.20.0.1:5060
CSeq: 102 OPTIONS
Accept: application/sdp
Accept-Language: en
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
User-Agent: eyeBeam release 1105z stamp 59031
Content-Length: 0
<------------->
[2012-10-08 14:51:50] — (12 headers 0 lines) —
[2012-10-08 14:51:50] Really destroying SIP dialog ‘79bfb47322fb17873e58d2a9593da9de@10.20.0.1:5060’ Method: OPT
S
[2012-10-08 14:51:50]
<— SIP read from UDP:64.2.142.188:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK356789cc;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05e34d60
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 102 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2dd28216"
Content-Length: 0
<------------->
[2012-10-08 14:51:50] — (11 headers 0 lines) —
[2012-10-08 14:51:50]
<— SIP read from UDP:64.2.142.111:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK1c0748b0;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as219823a7
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 103 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="42578f79"
Content-Length: 0
<------------->
[2012-10-08 14:51:50] — (11 headers 0 lines) —
[2012-10-08 14:51:50]
<— SIP read from UDP:64.2.142.107:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK7dd83206;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as05c1b298
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 104 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="2c6995d0"
Content-Length: 0
<------------->
[2012-10-08 14:51:50] — (11 headers 0 lines) —
[2012-10-08 14:51:50]
<— SIP read from UDP:64.2.142.190:5060 —>
SIP/2.0 407 Proxy Authentication Required
Via: SIP/2.0/UDP 70.38.15.82:5060;branch=z9hG4bK0eafe944;received=70.38.15.82
From: “Hendersons” sip:username@70.38.15.82;tag=as3e1c6e94
To: sip:14165551212@outbound.vitelity.net;tag=as5e84535b
Call-ID: 04eb1428052d42521fb697026e4958fd@70.38.15.82:5060
CSeq: 105 INVITE
User-Agent: packetrino
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces
Proxy-Authenticate: Digest algorithm=MD5, realm=“asterisk”, nonce="0b1c0008"
Content-Length: 0
<------------->

4

I can’t find any INVITEs in that trace!

5

Here is a different trace captured with tcpdump - I eliminated lots of nulls, \0x00 in the expectation that you’re not needing to count hex bytes :smile: if you want those I can post the original.

I think I see what is happening but I don’t understand why. It looks like Asterisk is:

  • doing DNS lookup
  • sending the initial invite
  • getting a request for authentication
  • doing another DNS lookup ***** WHY??? ***** and getting a new IP
  • sending the second invite (with authentication I suppose) to the wrong server

Especially I don’t understand why it worked on Oct. 6 at 1441 GMT and started failing at 1714 GMT…

15:08:56.394751 IP (tos 0x60, ttl 64, id 39175, offset 0, flags [none], proto UDP (17), length 1024)
70.38.15.82.sip > 64.2.142.188.GIGe-net.vitel.net.sip: SIP, length: 996
INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 494e 5649 5445 2073 6970 3a31 3431 3632
0x0010: 3331 3335 3636 406f 7574 626f 756e 642e
0x0020: 7669 7465 6c69 7479 2e6e 6574 2053 4950

15:08:56.442126 IP (tos 0x0, ttl 53, id 7352, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.188.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via: \0x09\0xd6\0x01ZFT\0x88\0xecrP’$i\0x1a\0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E\0x01\0xc8\0x96\0x9c@\0x11\0xbd\0xf3F&\0x0fR@\0x02\0x8e\0xbb\0x13\0xc4\0x13\0xc4\0x01\0xb4%\0xfbACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrP\0x94\0x0co\0x1a\0x11\0x08\0x02\0x01\0x04\0x06\0x08'\0xe8\0x8eC\0x08't~\0x08'\0xe8\0x8eC\0x08E\0x04\0xc1\0x96\0x9d@\0x11\0xba\0xf9F&\0x0fR@\0x02\0x8e\0xbb\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xf4INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:56.443098 IP (tos 0x60, ttl 64, id 38556, offset 0, flags [none], proto UDP (17), length 456)
70.38.15.82.sip > 64.2.142.187.GIGe-net.vitel.net.sip: SIP, length: 428
ACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrP\0x94\0x0co\0x1a\0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E`\0x04\0xc1\0x96\0x9d@\0x11\0xba\0xf9F&\0x0fR@\0x02\0x8e\0xbb\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xf4INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 4143 4b20 7369 703a 3134 3136 3233 3133
0x0010: 3536 3640 6f75 7462 6f75 6e64 2e76 6974
0x0020: 656c 6974 792e 6e65 7420 5349 502f 322e

15:08:56.443485 IP (tos 0x60, ttl 64, id 38557, offset 0, flags [none], proto UDP (17), length 1217)
70.38.15.82.sip > 64.2.142.187.GIGe-net.vitel.net.sip: SIP, length: 1189
INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 494e 5649 5445 2073 6970 3a31 3431 3632
0x0010: 3331 3335 3636 406f 7574 626f 756e 642e
0x0020: 7669 7465 6c69 7479 2e6e 6574 2053 4950

15:08:56.490657 IP (tos 0x0, ttl 53, id 7353, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.187.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via: \0x09\0xd6\0x01ZFT\0x88\0xecrP<\0xacO\0x1d\0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E\0x01\0xc8N\0x8f@\0x11\0x06OF&\0x0fR@\0x02\0x8em\0x13\0xc4\0x13\0xc4\0x01\0xb4%\0xadACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrP\0xa8\0x13U\0x1d\0x11\0x08\0x02\0x01\0x04\0x06\0x08'\0xe8\0x8eC\0x08't~\0x08'\0xe8\0x8eC\0x08E\0x04\0xc1N\0x90@\0x11\0x03UF&\0x0fR@\0x02\0x8em\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xa6INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:56.491760 IP (tos 0x60, ttl 64, id 20111, offset 0, flags [none], proto UDP (17), length 456)
70.38.15.82.sip > 64.2.142.109.GIGe-net.vitel.net.sip: SIP, length: 428
ACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrP\0xa8\0x13U\0x1d\0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E`\0x04\0xc1N\0x90@\0x11\0x03UF&\0x0fR@\0x02\0x8em\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xa6INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 4143 4b20 7369 703a 3134 3136 3233 3133
0x0010: 3536 3640 6f75 7462 6f75 6e64 2e76 6974
0x0020: 656c 6974 792e 6e65 7420 5349 502f 322e

15:08:56.492114 IP (tos 0x60, ttl 64, id 20112, offset 0, flags [none], proto UDP (17), length 1217)
70.38.15.82.sip > 64.2.142.109.GIGe-net.vitel.net.sip: SIP, length: 1189
INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 494e 5649 5445 2073 6970 3a31 3431 3632
0x0010: 3331 3335 3636 406f 7574 626f 756e 642e
0x0020: 7669 7465 6c69 7479 2e6e 6574 2053 4950

15:08:56.539621 IP (tos 0x0, ttl 53, id 44259, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.109.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via: \0x09\0xd6\0x01ZFT\0x88\0xecrP\0x01t9 \0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E\0x01\0xc8\0x03\0xb3@\0x11Q.F&\0x0fR@\0x02\0x8ej\0x13\0xc4\0x13\0xc4\0x01\0xb4%\0xaaACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrPD > \0x11\0x08\0x02\0x01\0x04\0x06\0x08'\0xe8\0x8eC\0x08't~\0x08'\0xe8\0x8eC\0x08E\0x04\0xc1\0x03\0xb4@\0x11N4F&\0x0fR@\0x02\0x8ej\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xa3INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:56.540636 IP (tos 0x60, ttl 64, id 947, offset 0, flags [none], proto UDP (17), length 456)
70.38.15.82.sip > 64.2.142.106.GIGe-net.vitel.net.sip: SIP, length: 428
ACK sip:14165551212@outbound.vitelity.net SIP/2.\0x09\0xcf\0x04ZFT\0x88\0xecrPD > \0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E`\0x04\0xc1\0x03\0xb4@\0x11N4F&\0x0fR@\0x02\0x8ej\0x13\0xc4\0x13\0xc4\0x04\0xad(\0xa3INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 4143 4b20 7369 703a 3134 3136 3233 3133
0x0010: 3536 3640 6f75 7462 6f75 6e64 2e76 6974
0x0020: 656c 6974 792e 6e65 7420 5349 502f 322e

15:08:56.540942 IP (tos 0x60, ttl 64, id 948, offset 0, flags [none], proto UDP (17), length 1217)
70.38.15.82.sip > 64.2.142.106.GIGe-net.vitel.net.sip: SIP, length: 1189
INVITE sip:14165551212@outbound.vitelity.net SIP
0x0000: 494e 5649 5445 2073 6970 3a31 3431 3632
0x0010: 3331 3335 3636 406f 7574 626f 756e 642e
0x0020: 7669 7465 6c69 7479 2e6e 6574 2053 4950

15:08:56.588631 IP (tos 0x0, ttl 53, id 44260, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.106.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via: \0x09\0xd6\0x01ZFT\0x88\0xecrP\0xe3\0x84##\0x11\0x08\0x02\0x01\0x04\0x06\0x08’\0xe8\0x8eC\0x08’t~\0x08’\0xe8\0x8eC\0x08E`\0x01\0xc8\0xb0\0xc1@\0x11\0xa3\0xccF&\0x0fR@\0x02\0x8e\0xbd\0x13\0xc4\0x13\0xc4\0x01\0xb4%\0xfdACK sip:14165551212@outbound.vitelity.net SIP/2.
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:56.589530 IP (tos 0x60, ttl 64, id 45249, offset 0, flags [none], proto UDP (17), length 456)
70.38.15.82.sip > 64.2.142.189.GIGe-net.vitel.net.sip: SIP, length: 428
ACK sip:14165551212@outbound.vitelity.net SIP/2.
0x0000: 4143 4b20 7369 703a 3134 3136 3233 3133
0x0010: 3536 3640 6f75 7462 6f75 6e64 2e76 6974
0x0020: 656c 6974 792e 6e65 7420 5349 502f 322e

15:08:57.441544 IP (tos 0x0, ttl 53, id 7354, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.188.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:57.496310 IP (tos 0x0, ttl 53, id 7355, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.187.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:57.539028 IP (tos 0x0, ttl 53, id 44261, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.109.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:57.587001 IP (tos 0x0, ttl 53, id 44262, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.106.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:58.440646 IP (tos 0x0, ttl 53, id 7356, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.188.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:58.489820 IP (tos 0x0, ttl 53, id 7357, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.187.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:58.538299 IP (tos 0x0, ttl 53, id 44263, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.109.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:08:58.587821 IP (tos 0x0, ttl 53, id 44264, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.106.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:09:00.439822 IP (tos 0x0, ttl 53, id 7358, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.188.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:09:00.488000 IP (tos 0x0, ttl 53, id 7359, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.187.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:09:00.537618 IP (tos 0x0, ttl 53, id 44265, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.109.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

15:09:00.585598 IP (tos 0x0, ttl 53, id 44266, offset 0, flags [none], proto UDP (17), length 571)
64.2.142.106.GIGe-net.vitel.net.sip > 70.38.15.82.sip: SIP, length: 543
SIP/2.0 407 Proxy Authentication Required
Via:
0x0000: 5349 502f 322e 3020 3430 3720 5072 6f78
0x0010: 7920 4175 7468 656e 7469 6361 7469 6f6e
0x0020: 2052 6571 7569 7265 640d 0a56 6961 3a20

6

The VoIP provider now says: “DNS resolution in Asterisk is known to be buggy. In the log you uploaded, ACK and the second INVITE that includes the digest credentials are not going to the same server that sent the 407 challenge. This is not RFC-compliant.”

Logic suggests that (a) multiple outbound VoIP servers under a round-robin DNS must be pretty common amongst providers; and (b) lots of Asterisk boxes would be sending calls to such providers.

Perhaps my search skills are weak but I didn’t find another case of this… Am I really the first? Should I be filing a bug report?

Thanks in advance - community support works!

7

It does look like a bug to me. Why has the provider not submitted a bug report themselves? (It may well be well known to the provider, but if it were well known to the developers, it woudl have been fixed.)

If this has just started on a recent version of Asterisk, it may be a response to people who expect instant transitions between 3G and Wifi addresses for their mobile devices, i.e. there are a lot of people with improper multi-homed systems (no BGP and autonomous system numbers) who expect seamless transitions between interfaces.

Bugs need to be reported on issues.asterisk.org/jira For a SIP issue, they will generally expect core set debug 5, core set verbose 5 and sip set debug on, output, although raw pcap output might be accepted in place of the latter. You can redact sensitive information in the debug output, but that might be difficult with a pcap.

8

Thanks very much david55, this has been helpful. The provider’s last word is:
"There is no change that could have possibly been made on our side that would cause your device to respond in such a way. It simply is not normal or desireable for a SIP UA to send digest credentials to a different proxy than what sent the 401/407. There is nothing different about the 407s that we are sending today vs. the 407s that we sent a week or a month or a year ago. That is the only thing that are servers are doing; they are sending a 407, and then your Asterisk install is responding with ACK to the wrong address.

They have given me a workaround (a single server with IP- versus user-based authentication); it remains a mystery why this worked fine for a year and then suddenly broke!

9

My guess is that there used to be a caching DNS server in the chain and that has gone away. Running one on your own machine might work.

10

Opened a bug: issues.asterisk.org/jira/browse/ASTERISK-20539

11

You ought to link this thread to the bug report. I can’t do so at the moment, because it is in feedback status, allocated to you.

12

I’m sure you are right, but I don’t know how - sorry. I’ve given feedback on the bug now - the behavior disappeared with 1.8.17.0. Thanks again for the help!