Forum Discussion

satish_txt_2254's avatar
satish_txt_2254
Icon for Cirrus rankCirrus
May 30, 2017

F5 looping SIP ACK packet over and over

F5 sending ACK over and over to SIP proxy server in response of 200 OK and later after max out request SIP Proxy dropping packets, it's very strange behavior, following is pcap of SIP request. You can see in last 3 ACK (there are many but i capture only 3 for this question)

70.xx.xx.202 - SNAT IP 70.xx.xx.180 - VIP Address 70.xx.xx.29 - SIP Server


U 70.xx.xx.29:5060 -> 70.xx.xx.202:4371
SIP/2.0 100 trying -- your call is important to us.
Via: SIP/2.0/UDP 10.0.30.101:5060;branch=z9hG4bK-38590-1-0;rport=4371;received=70.xx.xx.202.
From: "anon" ;tag=38590SIPpTag001.
To: service .
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 INVITE.
Content-Length: 0.
.


U 70.xx.xx.29:5060 -> 70.xx.xx.202:4371
SIP/2.0 200 OK.
Record-Route: .
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-0.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 INVITE.
Record-Route: .
Content-Type: application/sdp.
Contact: .
Content-Length: 321.
P-hint: DIRECT-RTP.
.
v=0.
o=- 3705165012 3705165012 IN IP4 74.xx.xx.28.
s=session.
c=IN IP4 74.xx.xx.28.
t=0 0.
m=audio 18424 RTP/AVP 0.
a=rtpmap:0 PCMU/8000.
a=sp_media_cookie:4ac9631c1f904ac9631c1f9a014ac9631c47f8.
a=candidate 900568881 1 pas900568881 UDP 1.0 74.xx.xx.28 18424.
a=sp_chan_type:echo.
a=sp_max_gain:1.700000.
a=sp_rtcp:0.


U 70.xx.xx.202:4371 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Via: SIP/2.0/UDP 10.0.30.101:5060;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@10.0.30.101:5060.
Max-Forwards: 70.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
.


U 70.xx.xx.202:8553 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Record-Route: .
Record-Route: .
Via: SIP/2.0/UDP 70.xx.xx.29:5060;branch=0.
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@70.xx.xx.202:4371.
Max-Forwards: 16.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
.


U 70.xx.xx.202:8553 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Record-Route: .
Record-Route: .
Record-Route: .
Record-Route: .
Via: SIP/2.0/UDP 70.xx.xx.29:5060;branch=0.
Via: SIP/2.0/UDP 70.xx.xx.29:5060;rport=8553;received=70.xx.xx.202;branch=0.
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@70.xx.xx.202:8553.
Max-Forwards: 15.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
application delivery
BIG-IP
devops
LTM
sip express router
  • Nazir_52641's avatar
    Nazir_52641
    Icon for Cirrus rankCirrus
    May 31, 2017
    Hi Satish,
   The request URI in ACK is in-correct it has to be set what is there in Contact header of 200 OK.

Thanks
Syed Nazir
    • satish_txt_2254's avatar
      satish_txt_2254
      Icon for Cirrus rankCirrus
      Jun 01, 2017

      I am using SIPp scenario to test some stuff and found F5 looping ACK, Do you know how to figure out what could be wrong? following is my scenarios file ACK section.

      
  
  
    

      ACK sip:[service]@[remote_ip]:[remote_port] SIP/2.0
      Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
      From: "anon" <sip:anon@foo.example.com:[local_port]>;tag=[pid]SIPpTag00[call_number]
      To: [service] <sip:[service]@foo.example.com:[remote_port]>[peer_tag_param]
      Call-ID: [call_id]
      CSeq: 1 ACK
      Contact: sip:anon@[local_ip]:[local_port]
      Max-Forwards: 70
      Subject: Performance Test
      Content-Length: 0
      P-hint: PROXY-RTP.
      User-Agent: sipp
  • Nazir_52641's avatar
    Nazir_52641
    Icon for Cirrus rankCirrus
    Jun 06, 2017

    Hi Satish,

     

    You may have to modify SIPp as below

     

    </send></p> <pre><code> ACK [$contact] SIP/2.0 Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch] From: "anon" <sip:anon@foo.example.com:[local_port]>;tag=[pid]SIPpTag00[call_number] To: [service] <sip:[service]@foo.example.com:[remote_port]>[peer_tag_param] Call-ID: [call_id] CSeq: 1 ACK Contact: sip:anon@[local_ip]:[local_port] Max-Forwards: 70 Subject: Performance Test Content-Length: 0 P-hint: PROXY-RTP. User-Agent: sipp

     

     

    Thanks

     

    Syed Nazir

     

    • satish_txt_2254's avatar
      satish_txt_2254
      Icon for Cirrus rankCirrus
      Jun 16, 2017

      Thanks! but look like 

      tmp
      variable is missing somewhere to define.. 

      sipp -sf foo.xml -i 10.0.0.100 -d 1 -l 1 -m 1 -r 1 proxy.example.com
2017-06-16  15:47:49.584341 1497642469.584341: Variable $tmp is referenced 1 times!

      I am wondering what if some bad client send this kind of header to my proxy? is there any good solution we can use in iRules on F5 which can take care of it.. instead of fixing sipp..