Hello,
we have (again) problems with a Cisco 7960 SIP phone.
# U 2004/11/17 13:18:55.664760 1.2.3.4:50520 -> 11.22.33.44:5060 INVITE sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. User-Agent: CSCO/7. Contact: sip:koenig@1.2.3.4:5065. Expires: 180. Content-Type: application/sdp. Content-Length: 246. Accept: application/sdp. Remote-Party-ID: "Koenig" sip:koenig@1.2.3.4;party=calling;id-type=subscriber;privacy=off;screen=no. . (sdp stripped)
# U 2004/11/17 13:18:55.665068 11.22.33.44:5060 -> 1.2.3.4:5065 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. Proxy-Authenticate: Digest realm="testbed.de", nonce="419b42db55c1a65dac6b825b8c2f8bfa62539beb", qop="auth". Server: Sip EXpress router (0.8.14-2 (i386/linux)). Content-Length: 0. Warning: 392 11.22.33.44:5060 "Noisy feedback tells: pid=2660 req_src_ip=1.2.3.4 req_src_port=50520 in_uri=sip:07216636445@testbed.de out_uri=sip:07216636445@testbed.de via_cnt==1". .
# U 2004/11/17 13:18:55.764578 1.2.3.4:51368 -> 11.22.33.44:5060 ACK sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
# U 2004/11/17 13:18:55.764915 11.22.33.44:5060 -> 11.22.33.55:5060 ACK sip:+497216636445@213.218.10.130:5060 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 11.22.33.44;branch=0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
As you can see, the ACK for the 407 gets forwarded by SER. It does not match the previous transaction. This should not be the case. Is there anything we can do about this, except flying to munich and beat on cisco?
Best regards, Martin
Martin:
Just out of curiousity what version of phone software are you running?
-Steve
Martin Koenig wrote:
Hello,
we have (again) problems with a Cisco 7960 SIP phone.
# U 2004/11/17 13:18:55.664760 1.2.3.4:50520 -> 11.22.33.44:5060 INVITE sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. User-Agent: CSCO/7. Contact: sip:koenig@1.2.3.4:5065. Expires: 180. Content-Type: application/sdp. Content-Length: 246. Accept: application/sdp. Remote-Party-ID: "Koenig" sip:koenig@1.2.3.4;party=calling;id-type=subscriber;privacy=off;screen=no. . (sdp stripped)
# U 2004/11/17 13:18:55.665068 11.22.33.44:5060 -> 1.2.3.4:5065 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. Proxy-Authenticate: Digest realm="testbed.de", nonce="419b42db55c1a65dac6b825b8c2f8bfa62539beb", qop="auth". Server: Sip EXpress router (0.8.14-2 (i386/linux)). Content-Length: 0. Warning: 392 11.22.33.44:5060 "Noisy feedback tells: pid=2660 req_src_ip=1.2.3.4 req_src_port=50520 in_uri=sip:07216636445@testbed.de out_uri=sip:07216636445@testbed.de via_cnt==1". .
# U 2004/11/17 13:18:55.764578 1.2.3.4:51368 -> 11.22.33.44:5060 ACK sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
# U 2004/11/17 13:18:55.764915 11.22.33.44:5060 -> 11.22.33.55:5060 ACK sip:+497216636445@213.218.10.130:5060 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 11.22.33.44;branch=0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
As you can see, the ACK for the 407 gets forwarded by SER. It does not match the previous transaction. This should not be the case. Is there anything we can do about this, except flying to munich and beat on cisco?
Best regards, Martin
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hello,
-----Original Message----- From: Steve Blair [mailto:blairs@isc.upenn.edu] Sent: Wednesday, November 17, 2004 12:43 PM To: Martin Koenig Cc: serusers@lists.iptel.org Subject: Re: [Serusers] Cisco 7960 and 407 Proxy Auth Required
Martin:
Just out of curiousity what version of phone software are you running?
It is the POS3-07-1-00 (7.1) SIP Firmware, should be the latest one.
Martin
-Steve
Martin Koenig wrote:
Hello,
we have (again) problems with a Cisco 7960 SIP phone.
# U 2004/11/17 13:18:55.664760 1.2.3.4:50520 -> 11.22.33.44:5060 INVITE sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. User-Agent: CSCO/7. Contact: sip:koenig@1.2.3.4:5065. Expires: 180. Content-Type: application/sdp. Content-Length: 246. Accept: application/sdp. Remote-Party-ID: "Koenig" sip:koenig@1.2.3.4;party=calling;id-type=subscriber;privacy
=off;screen=no.
. (sdp stripped)
# U 2004/11/17 13:18:55.665068 11.22.33.44:5060 -> 1.2.3.4:5065 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. Proxy-Authenticate: Digest realm="testbed.de", nonce="419b42db55c1a65dac6b825b8c2f8bfa62539beb", qop="auth". Server: Sip EXpress router (0.8.14-2 (i386/linux)). Content-Length: 0. Warning: 392 11.22.33.44:5060 "Noisy feedback tells: pid=2660 req_src_ip=1.2.3.4 req_src_port=50520
in_uri=sip:07216636445@testbed.de
out_uri=sip:07216636445@testbed.de via_cnt==1". .
# U 2004/11/17 13:18:55.764578 1.2.3.4:51368 -> 11.22.33.44:5060 ACK sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
# U 2004/11/17 13:18:55.764915 11.22.33.44:5060 -> 11.22.33.55:5060 ACK sip:+497216636445@213.218.10.130:5060 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 11.22.33.44;branch=0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
As you can see, the ACK for the 407 gets forwarded by SER.
It does not match
the previous transaction. This should not be the case. Is
there anything we
can do about this, except flying to munich and beat on cisco?
Best regards, Martin
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
--
ISC Network Engineering The University of Pennsylvania 3401 Walnut Street, Suite 221A Philadelphia, PA 19104
voice: 215-573-8396
215-746-7903fax: 215-898-9348
sip:blairs@net.isc.upenn.edu (8 rings for vm)
Hi Martin,
The problem is that you have different VIAs in INVITE and ACK - the port is different. SL module (used by auth) use the ip:port from VIA for ACK to INVITE matching.
Best regards, Marian
Martin Koenig wrote:
Hello,
we have (again) problems with a Cisco 7960 SIP phone.
# U 2004/11/17 13:18:55.664760 1.2.3.4:50520 -> 11.22.33.44:5060 INVITE sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. User-Agent: CSCO/7. Contact: sip:koenig@1.2.3.4:5065. Expires: 180. Content-Type: application/sdp. Content-Length: 246. Accept: application/sdp. Remote-Party-ID: "Koenig" sip:koenig@1.2.3.4;party=calling;id-type=subscriber;privacy=off;screen=no. . (sdp stripped)
# U 2004/11/17 13:18:55.665068 11.22.33.44:5060 -> 1.2.3.4:5065 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. Proxy-Authenticate: Digest realm="testbed.de", nonce="419b42db55c1a65dac6b825b8c2f8bfa62539beb", qop="auth". Server: Sip EXpress router (0.8.14-2 (i386/linux)). Content-Length: 0. Warning: 392 11.22.33.44:5060 "Noisy feedback tells: pid=2660 req_src_ip=1.2.3.4 req_src_port=50520 in_uri=sip:07216636445@testbed.de out_uri=sip:07216636445@testbed.de via_cnt==1". .
# U 2004/11/17 13:18:55.764578 1.2.3.4:51368 -> 11.22.33.44:5060 ACK sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
# U 2004/11/17 13:18:55.764915 11.22.33.44:5060 -> 11.22.33.55:5060 ACK sip:+497216636445@213.218.10.130:5060 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 11.22.33.44;branch=0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08db64.371f. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
As you can see, the ACK for the 407 gets forwarded by SER. It does not match the previous transaction. This should not be the case. Is there anything we can do about this, except flying to munich and beat on cisco?
Best regards, Martin
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
Hello,
Thanks for the analysis. Meaning that Cisco does not act properly if there is a port != 5060 set as communication port. Damn.
Regards, Martin
-----Original Message----- From: Marian Dumitru [mailto:marian.dumitru@voice-sistem.ro] Sent: Wednesday, November 17, 2004 6:48 PM To: Martin Koenig Cc: serusers@lists.iptel.org Subject: Re: [Serusers] Cisco 7960 and 407 Proxy Auth Required
Hi Martin,
The problem is that you have different VIAs in INVITE and ACK
- the port
is different. SL module (used by auth) use the ip:port from VIA for ACK to INVITE matching.
Best regards, Marian
Martin Koenig wrote:
Hello,
we have (again) problems with a Cisco 7960 SIP phone.
# U 2004/11/17 13:18:55.664760 1.2.3.4:50520 -> 11.22.33.44:5060 INVITE sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To: sip:07216636445@testbed.de. Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. User-Agent: CSCO/7. Contact: sip:koenig@1.2.3.4:5065. Expires: 180. Content-Type: application/sdp. Content-Length: 246. Accept: application/sdp. Remote-Party-ID: "Koenig"
sip:koenig@1.2.3.4;party=calling;id-type=subscriber;privacy= off;screen=no.
. (sdp stripped)
# U 2004/11/17 13:18:55.665068 11.22.33.44:5060 -> 1.2.3.4:5065 SIP/2.0 407 Proxy Authentication Required. Via: SIP/2.0/UDP 1.2.3.4:5065;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 INVITE. Proxy-Authenticate: Digest realm="testbed.de", nonce="419b42db55c1a65dac6b825b8c2f8bfa62539beb", qop="auth". Server: Sip EXpress router (0.8.14-2 (i386/linux)). Content-Length: 0. Warning: 392 11.22.33.44:5060 "Noisy feedback tells: pid=2660 req_src_ip=1.2.3.4 req_src_port=50520
in_uri=sip:07216636445@testbed.de
out_uri=sip:07216636445@testbed.de via_cnt==1". .
# U 2004/11/17 13:18:55.764578 1.2.3.4:51368 -> 11.22.33.44:5060 ACK sip:07216636445@testbed.de SIP/2.0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
# U 2004/11/17 13:18:55.764915 11.22.33.44:5060 -> 11.22.33.55:5060 ACK sip:+497216636445@213.218.10.130:5060 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 11.22.33.44;branch=0. Via: SIP/2.0/UDP 1.2.3.4:5060;branch=z9hG4bK218ce466. From: "Koenig" sip:koenig@testbed.de;tag=0006283e0a68009a4d72450f-0d8cfd54. To:
sip:07216636445@testbed.de;tag=16ac3fc2258766c821c391b58b08d b64.371f.
Call-ID: 0006283e-0a680093-034392eb-37bfeedf@1.2.3.4. CSeq: 101 ACK. Content-Length: 0. .
As you can see, the ACK for the 407 gets forwarded by SER.
It does not match
the previous transaction. This should not be the case. Is
there anything we
can do about this, except flying to munich and beat on cisco?
Best regards, Martin
Serusers mailing list serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers
-- Voice Sistem http://www.voice-sistem.ro
At 09:26 PM 11/17/2004, Martin Koenig wrote:
Hello,
Thanks for the analysis. Meaning that Cisco does not act properly if there is a port != 5060 set as communication port.
The problem is not use of non-default port numbers. The problem is printing different port numbers in INVITE and non-200 ACK, which violates the rules for generating the ACK.
-jiri
Hello,
-----Original Message----- From: Jiri Kuthan [mailto:jiri@iptel.org] Sent: Thursday, November 18, 2004 7:33 AM To: Martin Koenig; marian.dumitru@voice-sistem.ro Cc: serusers@lists.iptel.org Subject: RE: [Serusers] Cisco 7960 and 407 Proxy Auth Required
At 09:26 PM 11/17/2004, Martin Koenig wrote:
Hello,
Thanks for the analysis. Meaning that Cisco does not act
properly if there
is a port != 5060 set as communication port.
The problem is not use of non-default port numbers. The problem is printing different port numbers in INVITE and non-200 ACK, which violates the rules for generating the ACK.
I understand. Is this a known problem for the 7960 or any other Cisco SIP device?
-jiri
Regards, Martin
At 09:17 AM 11/19/2004, Martin Koenig wrote:
The problem is not use of non-default port numbers. The problem is printing different port numbers in INVITE and non-200 ACK, which violates the rules for generating the ACK.
I understand. Is this a known problem for the 7960 or any other Cisco SIP device?
It seems to be known from now :)
-jiri
-
Jiri Kuthan -
Marian Dumitru -
Martin Koenig -
Steve Blair