[asterisk-dev] A new SIP message started to appear (missing CSeq)

[Pavel Troller]

Hi!

  Since a certain time (a few days ago), I'm observing the following "bursts"
of SIP notice messages appearing in the Asterisk console:
[Jul 19 19:08:00] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:08] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:12] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:14] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:18] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:22] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:26] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:30] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:34] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
[Jul 19 19:08:38] NOTICE[689]: chan_sip.c:10081 copy_header: No field 'CSeq' present to copy
  They typically appear in a pace of about 1 per 3 - 4 seconds and their
number is obviously between 10 - 15 per "burst".
  Maybe they started to appear with my latest Asterisk (1.8 branch) SVN 
update, but I'm not sure.
  Now such bursts appear in a frequency about 10 - 15 per day.
  Around the time, when the messages are produced, there are no CDRs written
(or they aren't related to SIP).
  I looked at the sources and I understand the "low-level logic" (the CSeq
header is not present in the message when it is required to be copied), but
I'm somewhat missing the "high-level" explanation, i.e. what does it mean
in practice.
  1) Is it a symptom of broken UA ? Maybe some user changed the client and
the new one is buggy ?
  2) Or is it a new kind of SIP attack ?
  3) Or maybe a newly introduced chan_sip bug ?
  4) Or maybe chan_sip now reports an error condition which was not reported
before ?
  5) Is it a symptom of degraded SIP service ? I still didn't receive any
complaints of my users, but I would like to proactively fix any possible
problems before they will be reported to me...

  Thank you for explanation/advice!
  With regards,
    Pavel Troller