[asterisk-users] SIP OPTIONS "storm"?

[Steven Howes]

On 13 Feb 2014, at 18:10, Tim Nelson <tnelson at rockbochs.com> wrote:
> I recently experienced an odd situation. I have an Asterisk 11.5.0 system (Box A) with a SIP peering to another Asterisk 1.8.23.0 system (Box B). At some point, Box A started sending over 65Mbps of SIP OPTIONS packets to Box A. I do have qualify=yes for the peer on both sides, and the qualifyfreq is not set (aka default of 60secs).

Just because Box B was receiving 65MBps doesn’t mean box A was sending them. I suspect it’s probably the same one repeated, due to some kind of network problem. Do you have a pcap so you can look for the ID in the packets to see if they are the same? Would be good if you can prove A sent them too (traffic stats from SNMP monitoring or something).

S