Forum Discussion

satish_txt_2254's avatar
May 30, 2017

F5 looping SIP ACK packet over and over

F5 sending ACK over and over to SIP proxy server in response of 200 OK and later after max out request SIP Proxy dropping packets, it's very strange behavior, following is pcap of SIP request. You can see in last 3 ACK (there are many but i capture only 3 for this question)

70.xx.xx.202 - SNAT IP 70.xx.xx.180 - VIP Address 70.xx.xx.29 - SIP Server


U 70.xx.xx.29:5060 -> 70.xx.xx.202:4371
SIP/2.0 100 trying -- your call is important to us.
Via: SIP/2.0/UDP 10.0.30.101:5060;branch=z9hG4bK-38590-1-0;rport=4371;received=70.xx.xx.202.
From: "anon" ;tag=38590SIPpTag001.
To: service .
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 INVITE.
Content-Length: 0.
.


U 70.xx.xx.29:5060 -> 70.xx.xx.202:4371
SIP/2.0 200 OK.
Record-Route: .
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-0.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 INVITE.
Record-Route: .
Content-Type: application/sdp.
Contact: .
Content-Length: 321.
P-hint: DIRECT-RTP.
.
v=0.
o=- 3705165012 3705165012 IN IP4 74.xx.xx.28.
s=session.
c=IN IP4 74.xx.xx.28.
t=0 0.
m=audio 18424 RTP/AVP 0.
a=rtpmap:0 PCMU/8000.
a=sp_media_cookie:4ac9631c1f904ac9631c1f9a014ac9631c47f8.
a=candidate 900568881 1 pas900568881 UDP 1.0 74.xx.xx.28 18424.
a=sp_chan_type:echo.
a=sp_max_gain:1.700000.
a=sp_rtcp:0.


U 70.xx.xx.202:4371 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Via: SIP/2.0/UDP 10.0.30.101:5060;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@10.0.30.101:5060.
Max-Forwards: 70.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
.


U 70.xx.xx.202:8553 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Record-Route: .
Record-Route: .
Via: SIP/2.0/UDP 70.xx.xx.29:5060;branch=0.
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@70.xx.xx.202:4371.
Max-Forwards: 16.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
.


U 70.xx.xx.202:8553 -> 70.xx.xx.29:5060
ACK sip:service@70.xx.xx.180:5060 SIP/2.0.
Record-Route: .
Record-Route: .
Record-Route: .
Record-Route: .
Via: SIP/2.0/UDP 70.xx.xx.29:5060;branch=0.
Via: SIP/2.0/UDP 70.xx.xx.29:5060;rport=8553;received=70.xx.xx.202;branch=0.
Via: SIP/2.0/UDP 10.0.30.101:5060;rport=4371;received=70.xx.xx.202;branch=z9hG4bK-38590-1-5.
From: "anon" ;tag=38590SIPpTag001.
To: service ;tag=a6a1c5f60faecf035a1ae5b6e96e979a-3c64.
Call-ID: 1-38590@10.0.30.101.
CSeq: 1 ACK.
Contact: sip:.anon.@70.xx.xx.202:8553.
Max-Forwards: 15.
Subject: Performance Test.
Content-Length: 0.
P-hint: PROXY-RTP..
Record-Route: .
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
P-hint: PROXY-RTP.
P-hint: NON-LOCAL.
  • Hi Satish,
       The request URI in ACK is in-correct it has to be set what is there in Contact header of 200 OK.
    
    Thanks
    Syed Nazir    
    
    • satish_txt_2254's avatar
      satish_txt_2254
      Icon for Cirrus rankCirrus

      I am using SIPp scenario to test some stuff and found F5 looping ACK, Do you know how to figure out what could be wrong? following is my scenarios file ACK section.

      
        
        
          
      
            ACK sip:[service]@[remote_ip]:[remote_port] SIP/2.0
            Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch]
            From: "anon" <sip:anon@foo.example.com:[local_port]>;tag=[pid]SIPpTag00[call_number]
            To: [service] <sip:[service]@foo.example.com:[remote_port]>[peer_tag_param]
            Call-ID: [call_id]
            CSeq: 1 ACK
            Contact: sip:anon@[local_ip]:[local_port]
            Max-Forwards: 70
            Subject: Performance Test
            Content-Length: 0
            P-hint: PROXY-RTP.
            User-Agent: sipp
      
          
         
      
  • Hi Satish,

     

    You may have to modify SIPp as below

     

    
      
        
      
     
    

    </send></p> <pre><code> ACK [$contact] SIP/2.0 Via: SIP/2.0/[transport] [local_ip]:[local_port];branch=[branch] From: "anon" <sip:anon@foo.example.com:[local_port]>;tag=[pid]SIPpTag00[call_number] To: [service] <sip:[service]@foo.example.com:[remote_port]>[peer_tag_param] Call-ID: [call_id] CSeq: 1 ACK Contact: sip:anon@[local_ip]:[local_port] Max-Forwards: 70 Subject: Performance Test Content-Length: 0 P-hint: PROXY-RTP. User-Agent: sipp

     

     

    Thanks

     

    Syed Nazir

     

    • satish_txt_2254's avatar
      satish_txt_2254
      Icon for Cirrus rankCirrus

      Thanks! but look like

      tmp
      variable is missing somewhere to define..

      sipp -sf foo.xml -i 10.0.0.100 -d 1 -l 1 -m 1 -r 1 proxy.example.com
      2017-06-16  15:47:49.584341 1497642469.584341: Variable $tmp is referenced 1 times!
      

      I am wondering what if some bad client send this kind of header to my proxy? is there any good solution we can use in iRules on F5 which can take care of it.. instead of fixing sipp..