Upgrade to 11.5 and sipgate.de is no longer working

Asterisk Asterisk Support
1

Sorry, been trying to figure this one out myself, but am failing miserably…
I just upgraded my Asterisk from 1.2 (yes, I know) to 11.5.0. In the process, I upgraded the underlying OS from Solaris 10 to Solaris 11.1 (0.5.11-0.175.1.9.0.5.1) - not that I think the OS is the problem.

After the upgrade (and the appropriate re-configuration of the asterisk config files), I can no longer receive calls on my sipgate.de number. My voiptalk.org connection works just fine.
When dialing into my sipgate.de number, the phone rings on my end but the person dialing doesn’t hear a dial tone. Once picked up, no sound passes either way and eventually both sides auto-hangup.
I obviously figured there is a NAT problem here as the Asterisk is behind my nating Cisco 837 router.

Here is the sip.conf config for sipgate.de:

[code]register => :@sipgate.de/

[sipgate-out]
type=friend
secret=
username=
fromuser=
host=sipgate.de
fromdomain=sipgate.de
dtmfmode=rfc2833
insecure=invite
qualify=yes
nat=force_rport,comedia
context =
canreinvite=no[/code]

This does not differ from my config for voiptalk.org and only differs from my config for asterisk 1.2 in the insecure line which used to read: insecure=very

In my [general] section, I have the following configuration:

[general] context=default allowoverlap=no realm=<my relm> udpbindaddr=0.0.0.0 tcpenable=no tcpbindaddr=0.0.0.0 transport=udp srvlookup=yes localnet=192.168.0.0/255.255.0.0 nat=auto_force_rport directmediadeny=0.0.0.0/0 directmediapermit=192.168.0.0/16

Enabling sip set debug on gives me two lines that concern me:

Sending to 217.10.79.9:5060 (no NAT) Sending to 217.10.79.9:5060 (no NAT)

I can forward on the entire sip debug Xterm log if that helps.

Any pointers greatly appreciated. I would like to keep my sipgate number…

Thanks.
Eric

2

Hello,

Think you are missing your externip value in the sip.conf general section.

voip-info.org/wiki/view/Aste … P+externip

But it is difficult to be sure without some sip captures.

So try adding the externip value and try again.

Good luck.

3

Unfortunately, adding the externip makes it worse… There is no visible change in behaviour for sipgate.de but voiptalk.org now doesn’t work any more. When I ring it, while the ring tone is there, after a while (during the voicemail message) asterisk hangs up with:

I also get this:

== Spawn extension (default, myincoming, 22) exited non-zero on 'SIP/voiptalk-00000125' [Sep 3 19:20:30] NOTICE[17]: chan_sip.c:15071 sip_reg_timeout: -- Registration for '<voiptalk-id>@voiptalk.org' timed out, trying again (Attempt #7)

What part of the sip trace would help? The entire thing is rather large of course…

Thanks for your help.
Eric

4

Eric,

How is your setup?
So we can get a good picture of it.

Also install ngrep on your *.

When done give the command > ngrep -d any -qt -W byline port 5060

Then make a phone call, or try…

Then the signaling can be looked at.

Good luck.

5

Hallo Eric,

just look at the configuration snippets below. They are (adopted to Your situation) working configs for sipgate.de an a 11.5 environment in Germany. Until today I didn’t find any provider which may be incompatible with the setting in the general-section supposed Your box is behind a NAT-Router and the providers are willing to communicate in IPv4.
For further assistance You may PM me.

[general] context=default allowoverlap=no realm=<my relm> udpbindaddr=0.0.0.0 tcpenable=no tcpbindaddr=0.0.0.0 transport=udp srvlookup=yes localnet=192.168.0.0/255.255.0.0 [b]nat=force_rport,comedia[/b] [b]externhost=<Your domain name> externrefresh=60[/b] -- or alternative -- [b]externip=<Your fixed IP>[/b] directmediadeny=0.0.0.0/0 directmediapermit=192.168.0.0/16 [b]sendrpid=yes trustrpid=yes rpid_update=yes[/b]

And the SIPGATE-specific parts

register => <sipgate id>:<sipgate pass>@sipgate.de/<sipgate id>

-- we configure only one section for sipgate handling in- and outbound 
[sipgate-out]
type=peer
usereqphone=no
t38pt_udptl=no
nat=force_rport,comedia
directmedia=no
disallow=all
allow=g722
allow=ulaw
allow=alaw
dtmfmode=rfc2833
context=<my context>
remotesecret=<sipgate pass>
defaultuser=<sipgate id>
fromuser=<sipgate id>
fromdomain=sipgate.de
host=sipgate.de
sendrpid=pai
qualify=yes
6

Thanks both for your help.

So I started by trying Olaf’s suggestion.
I can set all value’s as you have suggested, with the exception of the externip, at this point bad things happen.
Once the externip parameter, my voiptalk.org line goes straight through to the voicemail box I have set up with them, suggesting that they can no longer see me. calling my sipgate.de number from my mobile still does ring the phone but alas, I still don’t get a ring tone on the mobile, i.e. the calling side.

However, I think we are getting somewhat closer by looking at some network traces. mightee’s suggestion of ngrep doesn’t seen to work, as ngrep doesn’t appear to be solaris zones aware and doesn’t capture any network traffic when run inside the zone. As it’s an exclusive IP zone, the global zone doesn’t have access to the network traffic, so ngrep is out…
I did however run a snoop and I’m seeing this on an incoming call:

root@ariel # snoop -d ariel40 port 5060 Using device ariel40 (promiscuous mode) sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=12 sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=1299 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=921 sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=1339 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=954 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=12 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=937 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=460 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=598 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 sipgate.de -> ariel-cable UDP D=5060 S=5060 LEN=12 ariel-cable -> sipgate.de UDP D=5060 S=5060 LEN=725 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980 ariel-cable -> fw-int UDP D=5060 S=5060 LEN=980

The problem lines in here are the ones where it tries to send to fw-int.
This happens to be the internal address of my firewall and shouldn’t be in the path of the asterisk server at all as that has an interface directly to the adsl router.
I therefore suspect some trickery on the adsl router that is interfering.

I’ve got to run now, but I’ll have a go at the adsl router later today or tomorrow to see if I can get it to behave better.

Thanks all for your kind help.
I’ll post an update once I’ve got more data.
Eric

7

OK, we’re getting closer. At the point where my asterisk receives a call from through my sipgate.de trunk, it tries to look up the following addresses:

G421.<my dns domain> G422.<my dns domain> G423.<my dns domain> G424.<my dns domain> G425.<my dns domain>

It doesn’t do the same thing for an incoming call from voiptalk.org.

Now, unsurprisingly, my cisco adsl router re-writes the lookup it receives (which, irrespective of what name you look up always ends up with my external IP) to the address it has it its “ip nat inside source static” rule.
I’ve tried preventing it from doing that, as in my particular setup, this serves no purpose, but alas, it’s quite stubborn on that matter.

I then tried defining these addresses in /etc/hosts with my external IP, but unfortunately, asterisk seems to ignore that an instead force a DNS lookup every time.

So, I think there could be two possible solutions:
[ul]1. - I prevent asterisk with some magic config command from attempting to look up these addresses (why does it look them up in the first place, they look like codec names to me? and what would the magic command be?)
2. - I somehow convince asterisk to use the system libraries to look up host names rather than going straight to DNS itself (I suspect that might be a coding thing?)[/ul]

Any pointers on either of these two options would be greatly appreciated.

Thanks again all for your help and patience.
Eric

8

I think you need to provide a SIP trace, but I assume it looks them up because it needs their addresses.

9

Well, clearly it’s looking them up because of something that sipgate.de sends back that is particular to it.
It’s clearly not a requirement for SIP to work per-se as voiptalk.org works just fine without looking up seemingly random DNS names.
Presumably sipgate.de is trying to be clever and “make something work better” but in the process is breaking something. So how do I tell asterisk not to try and accept sipgate.de’s clever suggestion?

Re a SIP trace, more than happy to provide one but running a sip set debug on produces more data than I can reasonably post into this forum… So if someone could narrow down what it is we are looking for…?

Thanks for your help.
Eric

10

Hmm, let’s see if I can break the forum.
Here’s a tshark output (part 1) from a SIP conversation of my mobile calling my sipgate.de number.
Hope this might help someone to explain what’s going on.
Any help greatly appreciated.

(Oh, I should point out that my work-around for sipgate.de looking up the odd DNS entries was to define them with an IP of 0.0.0.0 in DNS. asterisk seems clever enough not to try and do anything with such obviously false IPs)

[code]Frame 10: 1366 bytes on wire (10928 bits), 1366 bytes captured (10928 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:22.689046000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727902.689046000 seconds
[Time delta from previous captured frame: 0.657205000 seconds]
[Time delta from previous displayed frame: 8.686786000 seconds]
[Time since reference or first frame: 8.787471000 seconds]
Frame Number: 10
Frame Length: 1366 bytes (10928 bits)
Capture Length: 1366 bytes (10928 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip:sdp]
Ethernet II, Src: Cisco_da:fa:6c (00:11:20:da:fa:6c), Dst: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Destination: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: 217.10.79.9 (217.10.79.9), Dst: ()
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 1348
Identification: 0x9a24 (39460)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (17)
Header checksum: 0xd5a4 [correct]
[Good: True]
[Bad: False]
Source: 217.10.79.9 (217.10.79.9)
Destination: ()
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 1328
Checksum: 0x48d4 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (INVITE)
Request-Line: INVITE sip:@:5060 SIP/2.0
Method: INVITE
Request-URI: sip:@:5060
Request-URI User Part:
Request-URI Host Part:
Request-URI Host Port: 5060
[Resent Packet: False]
Message Header
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Record-Route: sip:172.20.40.2;lr=on
Record-Route URI: sip:172.20.40.2;lr=on
Record-Route Host Part: 172.20.40.2
Record-Route URI parameter: lr=on
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
Max-Forwards: 67
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
Contact: <sip:0044@217.116.117.4>
Contact URI: sip:0044@217.116.117.4
Contact URI User Part: 0044
Contact URI Host Part: 217.116.117.4
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Content-Type: application/sdp
Content-Length: 432
Message Body
Session Description Protocol
Session Description Protocol Version (v): 0
Owner/Creator, Session Id (o): root 1132120235 1132120235 IN IP4 217.10.77.242
Owner Username: root
Session ID: 1132120235
Session Version: 1132120235
Owner Network Type: IN
Owner Address Type: IP4
Owner Address: 217.10.77.242
Session Name (s): sipgate VoIP GW
Data (358 bytes)

Frame 11: 961 bytes on wire (7688 bits), 961 bytes captured (7688 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:22.690804000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727902.690804000 seconds
[Time delta from previous captured frame: 0.001758000 seconds]
[Time delta from previous displayed frame: 0.001758000 seconds]
[Time since reference or first frame: 8.789229000 seconds]
Frame Number: 11
Frame Length: 961 bytes (7688 bits)
Capture Length: 961 bytes (7688 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 943
Identification: 0x7f99 (32665)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x27c4 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 923
Checksum: 0x5442 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (100)
Status-Line: SIP/2.0 100 Trying
Status-Code: 100
[Resent Packet: False]
[Request Frame: 10]
[Response Time (ms): 1]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Record-Route: sip:172.20.40.2;lr=on
Record-Route URI: sip:172.20.40.2;lr=on
Record-Route Host Part: 172.20.40.2
Record-Route URI parameter: lr=on
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Session-Expires: 1800;refresher=uas
Contact: <sip:@:5060>
Contact URI: sip:@:5060
Contact URI User Part:
Contact URI Host Part:
Contact URI Host Port: 5060
Content-Length: 0

Frame 21: 1403 bytes on wire (11224 bits), 1403 bytes captured (11224 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:23.148088000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727903.148088000 seconds
[Time delta from previous captured frame: 0.032762000 seconds]
[Time delta from previous displayed frame: 0.457284000 seconds]
[Time since reference or first frame: 9.246513000 seconds]
Frame Number: 21
Frame Length: 1403 bytes (11224 bits)
Capture Length: 1403 bytes (11224 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip:sdp]
Ethernet II, Src: Cisco_da:fa:6c (00:11:20:da:fa:6c), Dst: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Destination: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: 217.10.79.9 (217.10.79.9), Dst: ()
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 1385
Identification: 0x9a26 (39462)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (17)
Header checksum: 0xd57d [correct]
[Good: True]
[Bad: False]
Source: 217.10.79.9 (217.10.79.9)
Destination: ()
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 1365
Checksum: 0x270c [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (INVITE)
Request-Line: INVITE sip:@:5060 SIP/2.0
Method: INVITE
Request-URI: sip:@:5060
Request-URI User Part:
Request-URI Host Part:
Request-URI Host Port: 5060
[Resent Packet: True]
[Suspected resend of frame: 10]
Message Header
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Record-Route: sip:109.69.233.141:1049;lr=on
Record-Route URI: sip:109.69.233.141:1049;lr=on
Record-Route Host Part: 109.69.233.141
Record-Route Host Port: 1049
Record-Route URI parameter: lr=on
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 109.69.233.141:1049;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1049
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=109.69.233.141:1050;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 109.69.233.141:1050
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 109.69.233.141:1051;received=109.69.233.141:1051;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1051
Received: 109.69.233.141:1051
Branch: z9hG4bK6ed3a5ad
RPort: 5060
Max-Forwards: 67
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
Contact: <sip:0044@109.69.233.141:1051>
Contact URI: sip:0044@109.69.233.141:1051
Contact URI User Part: 0044
Contact URI Host Part: 109.69.233.141
Contact URI Host Port: 1051
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Content-Type: application/sdp
Content-Length: 432
Message Body
Session Description Protocol
Session Description Protocol Version (v): 0
Owner/Creator, Session Id (o): root 1132120235 1132120235 IN IP4 217.10.77.242
Owner Username: root
Session ID: 1132120235
Session Version: 1132120235
Owner Network Type: IN
Owner Address Type: IP4
Owner Address: 217.10.77.242
Session Name (s): sipgate VoIP GW
Data (358 bytes)

Frame 22: 992 bytes on wire (7936 bits), 992 bytes captured (7936 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:23.148317000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727903.148317000 seconds
[Time delta from previous captured frame: 0.000229000 seconds]
[Time delta from previous displayed frame: 0.000229000 seconds]
[Time since reference or first frame: 9.246742000 seconds]
Frame Number: 22
Frame Length: 992 bytes (7936 bits)
Capture Length: 992 bytes (7936 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 974
Identification: 0x7fae (32686)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x2790 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 954
Checksum: 0x4da5 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (100)
Status-Line: SIP/2.0 100 Trying
Status-Code: 100
[Resent Packet: False]
[Request Frame: 10]
[Response Time (ms): 460]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 109.69.233.141:1049;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1049
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=109.69.233.141:1050;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 109.69.233.141:1050
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 109.69.233.141:1051;received=109.69.233.141:1051;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1051
Received: 109.69.233.141:1051
Branch: z9hG4bK6ed3a5ad
RPort: 5060
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Record-Route: sip:109.69.233.141:1049;lr=on
Record-Route URI: sip:109.69.233.141:1049;lr=on
Record-Route Host Part: 109.69.233.141
Record-Route Host Port: 1049
Record-Route URI parameter: lr=on
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Session-Expires: 1800;refresher=uas
Contact: <sip:@:5060>
Contact URI: sip:@:5060
Contact URI User Part:
Contact URI Host Part:
Contact URI Host Port: 5060
Content-Length: 0

Frame 44: 977 bytes on wire (7816 bits), 977 bytes captured (7816 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:24.186364000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727904.186364000 seconds
[Time delta from previous captured frame: 0.318414000 seconds]
[Time delta from previous displayed frame: 1.038047000 seconds]
[Time since reference or first frame: 10.284789000 seconds]
Frame Number: 44
Frame Length: 977 bytes (7816 bits)
Capture Length: 977 bytes (7816 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 959
Identification: 0x7fcb (32715)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x2782 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 939
Checksum: 0x933d [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (180)
Status-Line: SIP/2.0 180 Ringing
Status-Code: 180
[Resent Packet: False]
[Request Frame: 10]
[Response Time (ms): 1498]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Record-Route: sip:172.20.40.2;lr=on
Record-Route URI: sip:172.20.40.2;lr=on
Record-Route Host Part: 172.20.40.2
Record-Route URI parameter: lr=on
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Session-Expires: 1800;refresher=uas
Contact: <sip:@:5060>
Contact URI: sip:@:5060
Contact URI User Part:
Contact URI Host Part:
Contact URI Host Port: 5060
Content-Length: 0

Frame 48: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:28.138114000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727908.138114000 seconds
[Time delta from previous captured frame: 0.454618000 seconds]
[Time delta from previous displayed frame: 3.951750000 seconds]
[Time since reference or first frame: 14.236539000 seconds]
Frame Number: 48
Frame Length: 64 bytes (512 bits)
Capture Length: 64 bytes (512 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:data]
Ethernet II, Src: Cisco_da:fa:6c (00:11:20:da:fa:6c), Dst: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Destination: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Padding: 00000000000000000000
Trailer: 00000000
Internet Protocol Version 4, Src: 217.10.79.9 (217.10.79.9), Dst: ()
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 32
Identification: 0x1700 (5888)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 58
Protocol: UDP (17)
Header checksum: 0x58ed [correct]
[Good: True]
[Bad: False]
Source: 217.10.79.9 (217.10.79.9)
Destination: ()
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 12
Checksum: 0x0000 (none)
[Good Checksum: False]
[Bad Checksum: False]
Data (4 bytes)

0000 00 00 00 00 …
Data: 00000000
[Length: 4]

Frame 52: 498 bytes on wire (3984 bits), 498 bytes captured (3984 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:30.825651000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727910.825651000 seconds
[Time delta from previous captured frame: 0.734415000 seconds]
[Time delta from previous displayed frame: 2.687537000 seconds]
[Time since reference or first frame: 16.924076000 seconds]
Frame Number: 52
Frame Length: 498 bytes (3984 bits)
Capture Length: 498 bytes (3984 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: Cisco_da:fa:6c (00:11:20:da:fa:6c), Dst: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Destination: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: 217.10.79.9 (217.10.79.9), Dst: ()
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 480
Identification: 0x9a28 (39464)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 53
Protocol: UDP (17)
Header checksum: 0xd904 [correct]
[Good: True]
[Bad: False]
Source: 217.10.79.9 (217.10.79.9)
Destination: ()
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 460
Checksum: 0xdc8a [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (CANCEL)
Request-Line: CANCEL sip:@:5060 SIP/2.0
Method: CANCEL
Request-URI: sip:@:5060
Request-URI User Part:
Request-URI Host Part:
Request-URI Host Port: 5060
[Resent Packet: False]
Message Header
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 109.69.233.141:1049;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1049
Branch: z9hG4bKe68f.d3f86871.0
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
To: <sip:0049@sipgate.de>
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
CSeq: 102 CANCEL
Sequence Number: 102
Method: CANCEL
Max-Forwards: 69
Content-Length: 0
[/code]

11

and here is part 2 of this capture…

[code]Frame 53: 765 bytes on wire (6120 bits), 765 bytes captured (6120 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:30.826115000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727910.826115000 seconds
[Time delta from previous captured frame: 0.000464000 seconds]
[Time delta from previous displayed frame: 0.000464000 seconds]
[Time since reference or first frame: 16.924540000 seconds]
Frame Number: 53
Frame Length: 765 bytes (6120 bits)
Capture Length: 765 bytes (6120 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 747
Identification: 0x7fcc (32716)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x2855 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 727
Checksum: 0x582e [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (487)
Status-Line: SIP/2.0 487 Request Terminated
Status-Code: 487
[Resent Packet: False]
[Request Frame: 52]
[Response Time (ms): 8137]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

Frame 54: 636 bytes on wire (5088 bits), 636 bytes captured (5088 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:30.826206000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727910.826206000 seconds
[Time delta from previous captured frame: 0.000091000 seconds]
[Time delta from previous displayed frame: 0.000091000 seconds]
[Time since reference or first frame: 16.924631000 seconds]
Frame Number: 54
Frame Length: 636 bytes (5088 bits)
Capture Length: 636 bytes (5088 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 618
Identification: 0x7fcd (32717)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x28d5 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 598
Checksum: 0xa883 [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (200)
Status-Line: SIP/2.0 200 OK
Status-Code: 200
[Resent Packet: False]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 109.69.233.141:1049;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 109.69.233.141
Sent-by port: 1049
Branch: z9hG4bKe68f.d3f86871.0
Record-Route: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route URI: sip:217.10.79.9;lr;ftag=as408397fd
Record-Route Host Part: 217.10.79.9
Record-Route URI parameter: lr
Record-Route URI parameter: ftag=as408397fd
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 CANCEL
Sequence Number: 102
Method: CANCEL
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

Frame 55: 765 bytes on wire (6120 bits), 765 bytes captured (6120 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:30.925599000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727910.925599000 seconds
[Time delta from previous captured frame: 0.099393000 seconds]
[Time delta from previous displayed frame: 0.099393000 seconds]
[Time since reference or first frame: 17.024024000 seconds]
Frame Number: 55
Frame Length: 765 bytes (6120 bits)
Capture Length: 765 bytes (6120 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 747
Identification: 0x7fd2 (32722)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x284f [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 727
Checksum: 0x582e [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (487)
Status-Line: SIP/2.0 487 Request Terminated
Status-Code: 487
[Resent Packet: False]
[Request Frame: 52]
[Response Time (ms): 8236]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

Frame 56: 765 bytes on wire (6120 bits), 765 bytes captured (6120 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:31.125806000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727911.125806000 seconds
[Time delta from previous captured frame: 0.200207000 seconds]
[Time delta from previous displayed frame: 0.200207000 seconds]
[Time since reference or first frame: 17.224231000 seconds]
Frame Number: 56
Frame Length: 765 bytes (6120 bits)
Capture Length: 765 bytes (6120 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 747
Identification: 0x7fd7 (32727)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x284a [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 727
Checksum: 0x582e [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (487)
Status-Line: SIP/2.0 487 Request Terminated
Status-Code: 487
[Resent Packet: True]
[Suspected resend of frame: 55]
[Request Frame: 52]
[Response Time (ms): 8437]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

Frame 57: 765 bytes on wire (6120 bits), 765 bytes captured (6120 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:31.525892000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727911.525892000 seconds
[Time delta from previous captured frame: 0.400086000 seconds]
[Time delta from previous displayed frame: 0.400086000 seconds]
[Time since reference or first frame: 17.624317000 seconds]
Frame Number: 57
Frame Length: 765 bytes (6120 bits)
Capture Length: 765 bytes (6120 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 747
Identification: 0x7fd8 (32728)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x2849 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 727
Checksum: 0x582e [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (487)
Status-Line: SIP/2.0 487 Request Terminated
Status-Code: 487
[Resent Packet: True]
[Suspected resend of frame: 55]
[Request Frame: 52]
[Response Time (ms): 8837]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0

Frame 58: 765 bytes on wire (6120 bits), 765 bytes captured (6120 bits) on interface 0
Interface id: 0
WTAP_ENCAP: 1
Arrival Time: Sep 9, 2013 12:58:32.326900000 BST
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1378727912.326900000 seconds
[Time delta from previous captured frame: 0.801008000 seconds]
[Time delta from previous displayed frame: 0.801008000 seconds]
[Time since reference or first frame: 18.425325000 seconds]
Frame Number: 58
Frame Length: 765 bytes (6120 bits)
Capture Length: 765 bytes (6120 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:vlan:ip:udp:sip]
Ethernet II, Src: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85), Dst: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Destination: Cisco_da:fa:6c (00:11:20:da:fa:6c)
Address: Cisco_da:fa:6c (00:11:20:da:fa:6c)
… …0. … … … … = LG bit: Globally unique address (factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Source: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
Address: MS-NLB-PhysServer-08_20:5a:5e:85 (02:08:20:5a:5e:85)
… …1. … … … … = LG bit: Locally administered address (this is NOT the factory default)
… …0 … … … … = IG bit: Individual address (unicast)
Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 40
000. … … … = Priority: Best Effort (default) (0)
…0 … … … = CFI: Canonical (0)
… 0000 0010 1000 = ID: 40
Type: IP (0x0800)
Internet Protocol Version 4, Src: (), Dst: 217.10.79.9 (217.10.79.9)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
Total Length: 747
Identification: 0x7fd9 (32729)
Flags: 0x00
0… … = Reserved bit: Not set
.0… … = Don’t fragment: Not set
…0. … = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: UDP (17)
Header checksum: 0x2848 [correct]
[Good: True]
[Bad: False]
Source: ()
Destination: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 727
Checksum: 0x582e [validation disabled]
[Good Checksum: False]
[Bad Checksum: False]
Session Initiation Protocol (487)
Status-Line: SIP/2.0 487 Request Terminated
Status-Code: 487
[Resent Packet: True]
[Suspected resend of frame: 55]
[Request Frame: 52]
[Response Time (ms): 9638]
Message Header
Via: SIP/2.0/UDP 217.10.79.9:5060;branch=z9hG4bKe68f.d3f86871.0;received=217.10.79.9;rport=5060
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Branch: z9hG4bKe68f.d3f86871.0
Received: 217.10.79.9
RPort: 5060
Via: SIP/2.0/UDP 172.20.40.2;branch=z9hG4bKe68f.d3f86871.0
Transport: UDP
Sent-by Address: 172.20.40.2
Branch: z9hG4bKe68f.d3f86871.0
Via: SIP/2.0/UDP 217.10.79.9:5060;received=217.10.68.6;branch=z9hG4bK6ed3a5ad
Transport: UDP
Sent-by Address: 217.10.79.9
Sent-by port: 5060
Received: 217.10.68.6
Branch: z9hG4bK6ed3a5ad
Via: SIP/2.0/UDP 217.116.117.4:5060;received=217.116.117.4;branch=z9hG4bK6ed3a5ad;rport=5060
Transport: UDP
Sent-by Address: 217.116.117.4
Sent-by port: 5060
Received: 217.116.117.4
Branch: z9hG4bK6ed3a5ad
RPort: 5060
From: “0044” <sip:0044@sipgate.de>;tag=as408397fd
SIP Display info: "0044"
SIP from address: sip:0044@sipgate.de
SIP from address User Part: 0044
SIP from address Host Part: sipgate.de
SIP from tag: as408397fd
To: <sip:0049@sipgate.de>;tag=as000003f7
SIP to address: sip:0049@sipgate.de
SIP to address User Part: 0049
SIP to address Host Part: sipgate.de
SIP to tag: as000003f7
Call-ID: 2c4655790428c16d0f0eda3652df27b5@sipgate.de
CSeq: 102 INVITE
Sequence Number: 102
Method: INVITE
Server: Asterisk PBX 11.5.0
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH
Supported: replaces, timer
Content-Length: 0
[/code]

12

Anyone got any good ideas what’s going on here at all?

Thanks.
Eric

13

Your traces are far too detailed to be easy to read. The latest trace has a 487 quite early, which means that a call has been cancelled by party A, before answer.

The most important information from the trace tends to be, the actual IP and port used, the request line, from and to line, status line, contact line, and any associated SDP. Generally only the information for INVITE and BYE is useful, although sometimes REGISTER is relevant. Any unusual X- headers, or obvious supplementary diagnostics are useful.

Whilst there is a balance between missing important information and causing an information overload, you are way too far towards the latter,a t the moment. If there is any doubt about the relevance of a detail, provide both a summarised and complete version.

14

Just another tip to be able to provide a good log.

As mentioned by me earlier, use ngrep…

For example : ngrep -qt -W byline port 5060 and src x.y.z.v or dst a.b.c.d

By using src x.y.z.v or dst a.b.c.d you can limit the collected data.

By using ngrep on port 5060 you get the signaling in a clear text file without all the extra info that is collected when using tshark.

15

I think insecure=very does not work in 11.5 any more.
I had that in my config too, but after reloading, asterisk annonunced an error on insecure=very…

Check Asterisk messages…

16

Thanks for your help, guys.

mightee: Unfortunately, ngrep is not zones aware and doesn’t work for me, see also my earlier post on that subject.

juergen852: yes, insecure=very is no longer supported, I believe the correct replacement for it is insecure=port,invite
Alas, that still doesn’t make this thing work… :frowning: