[asterisk-users] Strange Packet Behavior

[Elliot Murdock]

Hello Everybody!

My server is attempting to connect to a SIP device, but is not
succeeding to.  I checked the actual packets traveling back and forth
with ngrep and I noticed some odd packets coming in.

Here is the outgoing INVITE packet sent to the SIP device:

#
U asteriskserver:5060 -> sipdevice:15244
  INVITE sip:354 at sipdevice:15244 SIP/2.0..Via: SIP/2.0/UDP
asteriskserver:5060;branch=z9hG4bK7cb4b7a7;rport..From: "m"
<sip:6571234 at asteriskserver>;tag=as6e2a8098..To:
<sip:354 at sipdevice:15244>..Contact:
<sip:6571234 at asteriskserver>..Call-ID:
5f79e4897d6ab4793ed07249351920ca at asteriskserver..CSeq: 102
INVITE..User-Agent: Asterisk PBX..Max-Forwards: 70..Date: Sun, 01 Feb
2009  10:27:14 GMT..Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER,
SUBSCRIBE, NOTIFY..Supported: replaces..Content-Type:
application/sdp..Content-Length: 269....v=0..o=root 17661 17661 IN IP4
asteriskserver..s=session..c=IN IP4 asteriskserver..t=0 0..m=audio
11272 R TP/AVP 18 101..a=rtpmap:18 G729/8000..a=fmtp:18
annexb=no..a=rtpmap:101 telephone-event/8000..a=fmtp:101
0-16..a=silenceSupp:off - -  - -..a=ptime:20..a=sendrecv..

Unfortunately, there is no response from the sip device.  However,
this packet shows up with ngrep from the sipdevice:

#
I sipdevice -> asteriskserver 3:1
  ....E.......5...................INVITE sip:6571234 at sipdevice
SIP/2.0..Via: SIP/2.0/UDP asteriskserver:5060;branch=z9hG4bK
0102c4c0;rport..From: "m"
<sip:6571234 at asteriskserver>;tag=as47be5d18..To:
<sip:354 at 216.235.152.22>..Contact:
<sip:6571234 at asteriskserver>..Call-ID:
16e6211c310d36905520dcb625f86208 at asteriskserver..CSeq: 102
INVITE..User-Agent: Asterisk PBX..Max -Forwards: 70..Date: Sun, 01 Feb
2009 10:36:51 GMT..Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER,
SUBSCRIBE, NOTIFY..Supported: replaces..Content-Type: a

Apparently, the device is getting a packet, but its response is not
being sent back properly.  The sipdevice is sending a packet, but
instead of being sent to port 5060, it is sent an odd port of 3:1.
Moreover, there are some phantom characters that show up the beginning
of the return packet (....E.......5...................I).

Any help would be great!
Elliot