conntrack_sip messages showing up in 2.6.32

All of lore.kernel.org
 help / color / mirror / Atom feed

* conntrack_sip messages showing up in 2.6.32
@ 2009-12-10 15:19 Joerg Dorchain
  2009-12-14 11:20 ` Patrick McHardy
  0 siblings, 1 reply; 3+ messages in thread
From: Joerg Dorchain @ 2009-12-10 15:19 UTC (permalink / raw)
  To: netfilter

[-- Attachment #1: Type: text/plain, Size: 723 bytes --]

Hello all,

after upgrading to kernel 2.6.32 I see some new message I did not
see before (i.e. 2.6.31).

I am using just nf_conntrack_sip (options sip_direct_media=0)
in order to have sip and related
rtp connection accepted as related connections, no nat
involved. On a different machine I am running twinkle as a sip
client, registering to an asterisk running on the machine in
question[1].

When twinkle is just idling and renewing its registration once in
a while, I get kernel: nf_ct_sip: dropping packet.. messsages
several times a day.

Do anyone have an idea where this comes from and what can be done
about it?

Bye,

Joerg

[1] The asterisk is doing application level gateway for
connections to the outside world.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 267 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: conntrack_sip messages showing up in 2.6.32
  2009-12-10 15:19 conntrack_sip messages showing up in 2.6.32 Joerg Dorchain
@ 2009-12-14 11:20 ` Patrick McHardy
  2009-12-15 11:24   ` Joerg Dorchain
  0 siblings, 1 reply; 3+ messages in thread
From: Patrick McHardy @ 2009-12-14 11:20 UTC (permalink / raw)
  To: Joerg Dorchain; +Cc: netfilter

Joerg Dorchain wrote:
> Hello all,
> 
> after upgrading to kernel 2.6.32 I see some new message I did not
> see before (i.e. 2.6.31).
> 
> I am using just nf_conntrack_sip (options sip_direct_media=0)
> in order to have sip and related
> rtp connection accepted as related connections, no nat
> involved. On a different machine I am running twinkle as a sip
> client, registering to an asterisk running on the machine in
> question[1].
> 
> When twinkle is just idling and renewing its registration once in
> a while, I get kernel: nf_ct_sip: dropping packet.. messsages
> several times a day.
> 
> Do anyone have an idea where this comes from and what can be done
> about it?

Conntrack logs packets dropped by helpers automatically starting in
2.6.32. If you can capture those packets (either using tcpdump or
the ULOG pcap output plugin) I can have a look at why they are dropped.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: conntrack_sip messages showing up in 2.6.32
  2009-12-14 11:20 ` Patrick McHardy
@ 2009-12-15 11:24   ` Joerg Dorchain
  0 siblings, 0 replies; 3+ messages in thread
From: Joerg Dorchain @ 2009-12-15 11:24 UTC (permalink / raw)
  To: Patrick McHardy; +Cc: netfilter


[-- Attachment #1.1: Type: text/plain, Size: 587 bytes --]

On Mon, Dec 14, 2009 at 12:20:47PM +0100, Patrick McHardy wrote:
> 
> Conntrack logs packets dropped by helpers automatically starting in
> 2.6.32. If you can capture those packets (either using tcpdump or
> the ULOG pcap output plugin) I can have a look at why they are dropped.

Attached. The first 4 packets are ok, I'd say.

The other (dropped) attempts might have something to do with the
fact the the machine in question has several interfaces with
several ip addresses, and the internal DNS resolves to all of
them, as they are reachable from intern.

Bye,

Joerg

[-- Attachment #1.2: sipdrop --]
[-- Type: text/plain, Size: 7044 bytes --]

ÔÃ²¡\x02\0\x04\0\0\0\0\0\0\0\0\0Ü\x05\0\0\x01\0\0\0]]'KZh\x06\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x11ÜÙ¬\x11\x02\a¬\x11\x02\x01\x13Ä\x13Ä\x01Õ¥«REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKrowvfuqz
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=cdyak
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 546 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

]]'K\x17k\x06\0>\x02\0\0>\x02\0\0\0\x1c%\x14ÆÏ\0\vj\x13)Ù\b\0E`\x020—w\0\0@\x11„»¬\x11\x02\x01¬\x11\x02\a\x13Ä\x13Ä\x02\x1c×-SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.17.2.7;branch=z9hG4bKrowvfuqz;received=172.17.2.7;rport=5060
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=cdyak
To: "Joerg" <sip:joerg-intern@dorchain.net>;tag=as3c9168c7
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 546 REGISTER
Server: Asterisk PBX 1.6.2.0~rc7-1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="dorchain.net", nonce="5ddd6bd6"
Content-Length: 0

]]'Kür\x06\0\x02\0\0\x02\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x02\0\0@\0@\x11Ü3¬\x11\x02\a¬\x11\x02\x01\x13Ä\x13Ä\x02{@^[REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKhctucsvj
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=cdyak
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 547 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Authorization: Digest username="joerg-intern",realm="dorchain.net",nonce="5ddd6bd6",uri="sip:dorchain.net",response="8b65512b41ea901a90575cab8971eb68",algorithm=MD5
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

]]'K\r€\x06\0K\x02\0\0K\x02\0\0\0\x1c%\x14ÆÏ\0\vj\x13)Ù\b\0E`\x02=—x\0\0@\x11„¬\x11\x02\x01¬\x11\x02\a\x13Ä\x13Ä\x02)\x0ffSIP/2.0 200 OK
Via: SIP/2.0/UDP 172.17.2.7;branch=z9hG4bKhctucsvj;received=172.17.2.7;rport=5060
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=cdyak
To: "Joerg" <sip:joerg-intern@dorchain.net>;tag=as3c9168c7
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 547 REGISTER
Server: Asterisk PBX 1.6.2.0~rc7-1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Expires: 3600
Contact: sip:joerg-intern@172.17.2.7;expires=3600
Date: Tue, 15 Dec 2009 09:56:45 GMT
Content-Length: 0

hk'KÛ.\x05\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x110ú¬\x11\x02\aÔX…™\x13Ä\x13Ä\x01Õ\x17¤REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKzlguqamq
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

hk'KƒÐ\f\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x110ú¬\x11\x02\aÔX…™\x13Ä\x13Ä\x01Õ\x17¤REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKzlguqamq
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

ik'KTÑ\f\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x110ú¬\x11\x02\aÔX…™\x13Ä\x13Ä\x01Õ\x17¤REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKzlguqamq
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

kk'K…é\f\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x110ú¬\x11\x02\aÔX…™\x13Ä\x13Ä\x01Õ\x17¤REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKzlguqamq
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

ok'KPÒ\f\0÷\x01\0\0÷\x01\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x01é\0\0@\0@\x110ú¬\x11\x02\aÔX…™\x13Ä\x13Ä\x01Õ\x17¤REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKzlguqamq
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

ok'K¦Ô\f\0>\x02\0\0>\x02\0\0\0\x1c%\x14ÆÏ\0\vj\x13)Ù\b\0E`\x020W1\0\0@\x11\x19"ÔX…™¬\x11\x02\a\x13Ä\x13Ä\x02\x1c3\x06SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 172.17.2.7;branch=z9hG4bKzlguqamq;received=172.17.2.7;rport=5060
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
To: "Joerg" <sip:joerg-intern@dorchain.net>;tag=as4d9e6bef
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 548 REGISTER
Server: Asterisk PBX 1.6.2.0~rc7-1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
WWW-Authenticate: Digest algorithm=MD5, realm="dorchain.net", nonce="392b99bd"
Content-Length: 0

ok'K[Ù\f\0\x02\0\0\x02\0\0\0\vj\x13)Ù\0\x1c%\x14ÆÏ\b\0E\0\x02\0\0@\0@\x110T¬\x11\x02\aÔX…™\x13Ä\x13Ä\x02{ “REGISTER sip:dorchain.net SIP/2.0
Via: SIP/2.0/UDP 172.17.2.7;rport;branch=z9hG4bKrksmokjy
Max-Forwards: 70
To: "Joerg" <sip:joerg-intern@dorchain.net>
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 549 REGISTER
Contact: <sip:joerg-intern@172.17.2.7>;expires=3600
Authorization: Digest username="joerg-intern",realm="dorchain.net",nonce="392b99bd",uri="sip:dorchain.net",response="2a7c353d7e0dca7f05c9095befb03b58",algorithm=MD5
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
User-Agent: Twinkle/1.4.2
Content-Length: 0

ok'KËæ\f\0K\x02\0\0K\x02\0\0\0\x1c%\x14ÆÏ\0\vj\x13)Ù\b\0E`\x02=W2\0\0@\x11\x19\x14ÔX…™¬\x11\x02\a\x13Ä\x13Ä\x02),õSIP/2.0 200 OK
Via: SIP/2.0/UDP 172.17.2.7;branch=z9hG4bKrksmokjy;received=172.17.2.7;rport=5060
From: "Joerg" <sip:joerg-intern@dorchain.net>;tag=uyhuk
To: "Joerg" <sip:joerg-intern@dorchain.net>;tag=as4d9e6bef
Call-ID: stkvrcjwnjpljph@whisker.dorchain.net
CSeq: 549 REGISTER
Server: Asterisk PBX 1.6.2.0~rc7-1
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO
Supported: replaces, timer
Expires: 3600
Contact: sip:joerg-intern@172.17.2.7;expires=3600
Date: Tue, 15 Dec 2009 10:56:47 GMT
Content-Length: 0


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 267 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2009-12-15 11:24 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-12-10 15:19 conntrack_sip messages showing up in 2.6.32 Joerg Dorchain
2009-12-14 11:20 ` Patrick McHardy
2009-12-15 11:24   ` Joerg Dorchain

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.