VoIP Mailing List Archives :: View topic - [asterisk-users] More fun but with Wireshark capture

Sponsor: VoiceMeUp - Corporate & Wholesale VoIP Services

VoIP Mailing List Archives
Mailing list archives for the VoIP community

[asterisk-users] More fun but with Wireshark capture

VoIP Mailing List Archives Forum Index -> Asterisk Users

View previous topic :: View next topic

Author

Message

support at drdos.info
Guest

Posted: Thu May 22, 2008 9:56 am Post subject: [asterisk-users] More fun but with Wireshark capture

I've replaced the phone system and it still didn't make any difference with the phones bouncing. I've got a capture of a conversation between one of the phones and the phone system. It would appear that when the drop out occurs, the phone does not respond. After several attempts, the phone responds to the system, all at once, like it was being queued! Looking at the CPU usage on the phone during this, it's at 1.1% and not in use that the time. Capture below: No. Time Source Destination Protocol Info 2073 19.612852 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 2078 19.652114 10.10.10.187 10.10.10.15 SIP Status: 200 OK 12652 79.653488 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 12661 79.691635 10.10.10.187 10.10.10.15 SIP Status: 200 OK 13558 86.161216 10.10.10.187 10.10.10.15 NTP NTP client 20703 139.694144 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 20708 139.731448 10.10.10.187 10.10.10.15 SIP Status: 200 OK 30559 199.730780 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 30568 199.770198 10.10.10.187 10.10.10.15 SIP Status: 200 OK 32966 211.161401 10.10.10.187 10.10.10.15 NTP NTP client 42165 259.771379 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 42281 260.771205 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 43371 270.770814 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 43478 271.770589 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 44554 281.770153 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 44660 282.769979 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 45702 292.769568 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 45805 293.769365 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 46874 303.768933 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 46983 304.768750 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 48056 314.768323 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 48176 315.768133 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 49229 325.767696 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 49338 326.767516 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 50366 336.161585 10.10.10.187 10.10.10.15 NTP NTP client 50428 336.767138 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 50532 337.766900 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 51593 347.766455 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 51698 348.766284 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 52834 358.765859 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 52939 359.765666 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 54045 369.765222 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 54154 370.765050 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 55225 380.764638 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 55331 381.764436 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 56402 391.764016 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 56507 392.763817 10.10.10.15 10.10.10.187 SIP Request: OPTIONS sip:4258 at 10.10.10.187 56537 393.043569 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56542 393.079512 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56546 393.107197 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56550 393.144498 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56555 393.171905 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56560 393.210323 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56564 393.237941 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56570 393.276830 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56575 393.305895 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56579 393.341771 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56583 393.367875 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56587 393.406231 10.10.10.187 10.10.10.15 SIP Status: 200 OK 56591 393.433383 10.10.10.187 10.10.10.15 SIP Status: 200 OK

Alex.Lopez at OpSys.com
Guest

Posted: Thu May 22, 2008 10:31 am Post subject: [asterisk-users] More fun but with Wireshark capture

Is it possible that the phones loaded a new Firmware or that the
configuration file has changed?

It is really strange that you have done all that you have done and the
problem persists.

IIRC you have:

Swapped switches
Swapped NICs
Swapped Servers

The only common elements left are:
Cabling (can go bad but ALL at once), you may try swapping out the cable
to the CPU, Heck you done everything else!!!

Phones, Can you load a soft phone into a laptop of PC and see if the
problem persists??

You mentioned that this all became with a DHCP failure, what about the
DNS settings, is it possible that the phone is waiting on a reverse
lookup on the IP address and once it times out it responds to all at
once??

Quote:

-----Original Message-----
From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-
bounces at lists.digium.com] On Behalf Of Doug Lytle
Sent: Thursday, May 22, 2008 10:57 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: [asterisk-users] More fun but with Wireshark capture

I've replaced the phone system and it still didn't make any difference
with the phones bouncing. I've got a capture of a conversation

between

Quote:

one of the phones and the phone system. It would appear that when the
drop out occurs, the phone does not respond. After several attempts,
the phone responds to the system, all at once, like it was being

queued!

Quote:

Looking at the CPU usage on the phone during this, it's at 1.1% and

not

Quote:

in use that the time.

Capture below:

No. Time Source Destination

Protocol

Quote:

Info
2073 19.612852 10.10.10.15 10.10.10.187 SIP

SNIP....

michael_bulk at wildga...
Guest

Posted: Thu May 22, 2008 10:41 am Post subject: [asterisk-users] More fun but with Wireshark capture

Something is certainly wrong here. Can you check the netmask? I assume
you're just using a full class C, which would make the netmask
255.255.255.0. Also, should I assume the trace is being done on the
Asterisk machine?

Try running a trace on all interfaces for port 5060:

]# tethereal -i any port 5060

Hopefully that will shed some light on the problem.

Mik

Doug Lytle wrote:

Quote:

I've replaced the phone system and it still didn't make any difference
with the phones bouncing. I've got a capture of a conversation between
one of the phones and the phone system. It would appear that when the
drop out occurs, the phone does not respond. After several attempts,
the phone responds to the system, all at once, like it was being queued!

Looking at the CPU usage on the phone during this, it's at 1.1% and not
in use that the time.

Capture below:

No. Time Source Destination Protocol
Info
2073 19.612852 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
2078 19.652114 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
12652 79.653488 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
12661 79.691635 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
13558 86.161216 10.10.10.187 10.10.10.15 NTP
NTP client
20703 139.694144 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
20708 139.731448 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
30559 199.730780 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
30568 199.770198 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
32966 211.161401 10.10.10.187 10.10.10.15 NTP
NTP client
42165 259.771379 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
42281 260.771205 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
43371 270.770814 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
43478 271.770589 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
44554 281.770153 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
44660 282.769979 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
45702 292.769568 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
45805 293.769365 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
46874 303.768933 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
46983 304.768750 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
48056 314.768323 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
48176 315.768133 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
49229 325.767696 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
49338 326.767516 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
50366 336.161585 10.10.10.187 10.10.10.15 NTP
NTP client
50428 336.767138 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
50532 337.766900 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
51593 347.766455 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
51698 348.766284 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
52834 358.765859 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
52939 359.765666 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
54045 369.765222 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
54154 370.765050 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
55225 380.764638 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
55331 381.764436 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
56402 391.764016 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
56507 392.763817 10.10.10.15 10.10.10.187 SIP
Request: OPTIONS sip:4258 at 10.10.10.187
56537 393.043569 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56542 393.079512 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56546 393.107197 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56550 393.144498 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56555 393.171905 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56560 393.210323 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56564 393.237941 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56570 393.276830 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56575 393.305895 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56579 393.341771 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56583 393.367875 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56587 393.406231 10.10.10.187 10.10.10.15 SIP
Status: 200 OK
56591 393.433383 10.10.10.187 10.10.10.15 SIP
Status: 200 OK

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

support at drdos.info
Guest

Posted: Thu May 22, 2008 11:24 am Post subject: [asterisk-users] More fun but with Wireshark capture

Mik Cheez wrote:

Quote:

Something is certainly wrong here. Can you check the netmask? I assume
you're just using a full class C, which would make the netmask

That would be correct.

Quote:

255.255.255.0. Also, should I assume the trace is being done on the
Asterisk machine?

Yes

Quote:

Try running a trace on all interfaces for port 5060:

]# tethereal -i any port 5060

Hopefully that will shed some light on the problem.

Waiting for the Network admin to bring up the other 2 Cisco switches.
He's cut them off, thinking he's identified a failure of some type.

Doug

support at drdos.info
Guest

Posted: Thu May 22, 2008 11:41 am Post subject: [asterisk-users] More fun but with Wireshark capture

Alexander Lopez wrote:

Quote:

Is it possible that the phones loaded a new Firmware or that the
configuration file has changed?

No, they are the older IP300 and IP500s. They're currently running
2.1.2.0078. I was going to move them up to the 2.2.0, but the firmware
won't work on these older phones.

No configurations have changed. I have been told that in the last two
weeks, they've had power issues. Burning up several circuit boards in
the press room.

Quote:

It is really strange that you have done all that you have done and the
problem persists.

IIRC you have:

Swapped switches

I power cycled the switches and the router.

Quote:

Swapped NICs
Swapped Servers

The only common elements left are:
Cabling (can go bad but ALL at once), you may try swapping out the cable
to the CPU, Heck you done everything else!!!

I'll give this a try right now.

Quote:

Phones, Can you load a soft phone into a laptop of PC and see if the
problem persists??

I'll give that a try as well

Quote:

You mentioned that this all became with a DHCP failure, what about the
DNS settings, is it possible that the phone is waiting on a reverse
lookup on the IP address and once it times out it responds to all at
once??

It's always possible. I'll consult with the network admin.

Thanks for your input!

Alex.Lopez at OpSys.com
Guest

Posted: Thu May 22, 2008 1:14 pm Post subject: [asterisk-users] More fun but with Wireshark capture

Please let us know the outcome, no matter how simple...

Quote:

-----Original Message-----
From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-
bounces at lists.digium.com] On Behalf Of Doug Lytle
Sent: Thursday, May 22, 2008 12:41 PM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] More fun but with Wireshark capture

Alexander Lopez wrote:

Quote:

Is it possible that the phones loaded a new Firmware or that the
configuration file has changed?

No, they are the older IP300 and IP500s. They're currently running
2.1.2.0078. I was going to move them up to the 2.2.0, but the

firmware

Quote:

won't work on these older phones.

No configurations have changed. I have been told that in the last two
weeks, they've had power issues. Burning up several circuit boards in
the press room.

Quote:

It is really strange that you have done all that you have done and

the

Quote:

problem persists.

IIRC you have:

Swapped switches

I power cycled the switches and the router.

Quote:

Swapped NICs
Swapped Servers

The only common elements left are:
Cabling (can go bad but ALL at once), you may try swapping out the

cable

Quote:

to the CPU, Heck you done everything else!!!

I'll give this a try right now.

Quote:

Phones, Can you load a soft phone into a laptop of PC and see if the
problem persists??

I'll give that a try as well

Quote:

You mentioned that this all became with a DHCP failure, what about

the

Quote:

DNS settings, is it possible that the phone is waiting on a reverse
lookup on the IP address and once it times out it responds to all at
once??

It's always possible. I'll consult with the network admin.

Thanks for your input!

_______________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
http://lists.digium.com/mailman/listinfo/asterisk-users

support at drdos.info
Guest

Posted: Thu May 22, 2008 5:25 pm Post subject: [asterisk-users] More fun but with Wireshark capture

Doug Lytle wrote:

Quote:

Mik Cheez wrote:

Quote:

Something is certainly wrong here. Can you check the netmask? I assume
you're just using a full class C, which would make the netmask

We may have tracked it down. We started looking at the DNS issues that
Alexander mentioned and saw that the new DHCP was indeed getting a lot
of queries. We took one phone, setup a firewall rule to allow it to
access an outside DNS. It hasn't dropped since.

My guess is that, the original DHCP didn't have Bind installed, the port
was closed.

So, when the Polycom's tried a DNS entry to the server, saw the port was
closed and didn't try further. With the new DHCP (It's also our
squid/bind/DansGuardian server), it does, but bind isn't setup to
respond to queries to that interface.

The phones, seeing the port open, tried to make the queries until the
timeout value and then caught up on the queued requests.
Thanks for everybody's help!

Doug

Display posts from previous:

	VoIP Mailing List Archives Forum Index -> Asterisk Users	All times are GMT - 5 Hours
Page 1 of 1

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum