[asterisk-users] SIP OPTIONS "storm"?

[Eric Wieling]

Attach the packet capture to your Jira bug report or post it online somewhere.   Hopefully someone will look at it.


-----Original Message-----
From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of Tim Nelson
Sent: Tuesday, February 18, 2014 9:42 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: Re: [asterisk-users] SIP OPTIONS "storm"?

----- Original Message -----
> On 13 Feb 2014, at 18:10, Tim Nelson <tnelson at rockbochs.com> wrote:
> > I recently experienced an odd situation. I have an Asterisk 11.5.0 
> > system (Box A) with a SIP peering to another Asterisk 1.8.23.0 
> > system (Box B). At some point, Box A started sending over 65Mbps of 
> > SIP OPTIONS packets to Box A. I do have qualify=yes for the peer on 
> > both sides, and the qualifyfreq is not set (aka default of 60secs).
> 
> Just because Box B was receiving 65MBps doesn’t mean box A was sending 
> them. I suspect it’s probably the same one repeated, due to some kind 
> of network problem. Do you have a pcap so you can look for the ID in 
> the packets to see if they are the same? Would be good if you can 
> prove A sent them too (traffic stats from SNMP monitoring or 
> something).
> 

Right, but a packet capture shows the source to be box A, and the destination to be box B. NMS reports from the same time period confirm the traffic flows. I'm not guessing or stabbing in the dark, I did my homework before posting. :)

Checking the IDs across ~25 packets, all have different SIP IDs.

Any thoughts?

--Tim

--
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com -- New to Asterisk? Join us for a live introductory webinar every Thurs:
               http://www.asterisk.org/hello

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users