Hi
Most of use may not have access to a extensive list of client or testing
scenarios in a lab. Would it be a good idea to get a list together of
what has been tested, and what works, not sure of the format of the
list, but I guess it will format itself (entropy).
Iqbal
Heres my understanding...hope it helps (may even confuse), and looking
for corrections...its a long read
1. There are 4 different types of NAT
a) Full Cone
b) restricted cone
c) port restricted
d) symmetric
a,b,c are also referred to as asymmetric NAT.
2. SIP has a problem because the siganalling uses one path and the media
stream another.
3. Full cone - Anyone of the internet can send packets to the IP:port
combo, this is mapped to a internal IP:port.
4. Restricted Cone - Only those external PC which have been contacted are
ALLOWED to contact via the mapping, i.e if I contact PC(a) from internal
Ip 10.1.1.1:123 then PC(a) can contact me on that NAT mapping, PC(b)
cannot
10.1.1.1:123 ---NAT ---> 202.70.65.78:10000 ------pc(a)
If pc(b) sends to 202.70.65.78:10000 there will be nothing sent through
to 10.1.1.1:123
5. Port restricted Cone - Same as restricted but instead of just
detecting that the source IP is that of pc(a), it also looks to see if
the source port is the same
10.1.1.1:123 --->NAT---->202.70.65.78:10000 -----> pc(a)
[213.123.324.34:8000]
The nat will only accept inbound from 213.123.324.34 and if it comes from
port 8000
6. Symmetric - This is the easy one,
10.1.1.1:1000 ----NAT -----> 200.123.123.34:1234 ----pc(a)
10.1.1.1:1000 ----NAT -----> 200.123.123.34:2222----pc(b)
In the NAT the IP:port pair is different for each external client, so
eeach external client has a mapping of its own
7. The problem RTP
In RTP the message body has the info needed for the UA to communicate
successfully. This body is called the SDP message. The problem is that
the client doesnt know anything about the NAT, hence the IP addresses
which are contained in the SDP are usually the internal ones, i.e what
the client knows....so when the endpoints want to "talk" they look at
the IP in the message and you get nothing because these are usually
internal IP addresses.
EG
INVITE sip:040600@192.168.20.2:5060 SIP/2.0.
Record-Route: <sip:143.248.130.35;ftag=3a7ceb24a6ac50c4;lr=on>.
Via: SIP/2.0/UDP 143.248.130.35;branch=z9hG4bK758e.976609c7.0.
Via: SIP/2.0/UDP
192.168.20.3;rport=1024;received=223.178.140.109;branch=z9hG4bK34efcab2403aa20d.
From: "Iqbal" <sip:040618@sip.dom.com>;tag=3a7ceb24a6ac50c4.
To: <sip:040600@sip.dom.com>.
Contact: <sip:040618@223.178.140.109:1024>.
Supported: replaces.
Call-ID: 7f2c327896a5b0e1(a)192.168.20.3.
CSeq: 8717 INVITE.
User-Agent: Grandstream HT487 1.0.5.18.
Max-Forwards: 16.
Allow: INVITE,ACK,CANCEL,BYE,NOTIFY,REFER,OPTIONS,INFO,SUBSCRIBE.
Content-Type: application/sdp.
Content-Length: 343.
.
v=0.
o=040618 8000 1 IN IP4 192.168.20.3.
s=SIP Call.
c=IN IP4 192.168.20.3.
t=0 0.
m=audio 38660 RTP/AVP 0 8 4 18 2 15 99.
a=sendrecv.
a=rtpmap:0 PCMU/8000/3.
a=rtpmap:8 PCMA/8000/3.
This header is just like email headers hence u read it backwards, so if
you look at the line above the From: line you see the first Via, which
is what the client thinks it is i.e 192.168.20.3, BUT the proxy is
clever, it knows where it received the message from , and it adds the
rport and received tags
Via: SIP/2.0/UDP
192.168.20.3;rport=1024;received=223.178.140.109;branch=z9hG4bK34efcab2403aa20d.
Soooo the proxy can talk SIP fine, because it knows these IP addresses.
BUT...poor old RTP is stuck because its headers or should I say direction
is held lower down :
v=0.
o=040618 8000 1 IN IP4 192.168.20.3.
s=SIP Call.
c=IN IP4 192.168.20.3.
t=0 0.
m=audio 38660 RTP/AVP 0 8 4 18 2 15 99.
a=sendrecv.
a=rtpmap:0 PCMU/8000/3.
a=rtpmap:8 PCMA/8000/3.
The client expects to receive on port m=38660 and IP c= 192.168.20.3,
which is where the other endpoint will try to send "voice" to.
8 Solution - You need to tell the client, not to act so dumb, and work
out what the NAT settings are and put them in the SDP section of the
message. So the client can ask the NAT....or it can ask someone on the
outside what it should be.
9. Ask the NAT - use UPnP...I dont have much info on this..:-)
10. Ask someone on the outside --
You send a probe packet to the server sitting outside, it then sends a
message back, with the details it received, the client then decides if
its behind a NAT. This can be used for all 4 cases of NAT.
EG lets say we send out a packet from 10.1.1.1:1000 so in the SDP message
m=1000 and c=10.1.1.1, but if I send out a probe first, and I get back
212.134.123.23:12345 then I can rewrite the SDP so m=12345 and
c=10.1.1.1 , simple
Problem -- Since NAT settings are dynamic, and hence tend to change, you
really need to get the SIP message out very soon after sending the
probing message out,
The client send and receive ports must be the same
And....if you recall the restricted cones (port restricted included) will
not allow replies unless there has been a packet sent out to that
destination first, hence the client needs to send a packet out to the
endpoint, b4 he can be allowed in via the NAT (but we dont need to worry
about that)
IT WILL NOT WORK FOR SYMMETRIC NAT....because it wont :-), because the
external UA IP:port is different to that where we sent the probe, hence
the voice packet coming back will not have the correct path set.
11. The above is usually done with a STUN server, and sending the packet
out to this server
12. Symmetric NAT--- use a relay in the middle...Nathelper+ rtpproxy or
mediaproxy
13 Nathelper
a) fix_nated_contact - rewrites contact Hf to source IP:port
b) fix_nated_sdp - rewritres media IP and also direction ????
c) force_rtp_proxy - forces media to go through proxy
d) nat_uac_test - mode=1 then as shown above the "received" header is
compared to c= in sdp
mode=2 then the Contact header is looked at to see if its private
mode=3 (1+2) means it does both of the above
14) mediaproxy is much the same...and good examples are available
15)Summary
4 types of NAT, which can be combined into 2 main sets, asymmetric and
symmetric.
Asymmetric issues can be resolved by using STUN, hence no need for
mediaproxy/nathelper
Symmetric clients cant use STUN, hence u need to use mediaproxy/nathelper
(or some other server end...also known as far-end nat traversal solution)
However if you didnt want to use STUN and mediaproxy/nathelper, then you
could just use mediaproxy/nathelper and setup port forwarding on your
NAT device.
I think that covers most, any suggestions let me know, I wrote this for
my own use, but if its useful, I'll tidy it up.
One question....
Is there any way via a debug log, albeit, ngrep, tcpdump, sip_scenario
display that I can from the server side detect if the NAT is asymmetric
or Symmetric.
tks
Iqbal
Hello all,
is it possible to store the User-Part of the current state of the RURI,
do manipulations then and revert the User-Part later in Ser.cfg.
Scenario is the following:
1) Incoming RURI is e164@proxy, e164 is saved.
2) e164@proxy is aliased to username@proxy
3) username@proxy is looked-up in registrar, now contact@client-ip
4) contact@client-ip should be rewritten to saved-e164@client-ip
Is this possible using avps?
With best regards,
Martin Koenig
Has anyone ever user SER with Oracle or developed an Oracle plugin for use with SER?
Doug
This message is for the designated recipient only and may contain
privileged, proprietary, or otherwise private information. If you have
received it in error, please notify the sender immediately and delete the
original. Any other use of the email by you is prohibited.
I've just build the deb for ser 9.0 from berlios,
Apr 4 15:01:35 ser /usr/sbin/ser[1982]: init_mod(): Error while
initializing module auth_db
any ideas ?
thanks for you replies.
--
Pozdrawiam,
Wojciech Ziniewicz
Optocomp sp.z.o.o, www.optocomp.pl
mailto: wojtekz(a)optocomp.pl
+48(0)691031535
Hi all,
I have download sems via CVS, but I don't see the VM module on SER 0.9.0
version.
How can I use SEMS with SER 0.9.0 ?
Best Regards
Nicolas RUIZ
France, Paris
Thanks for the reponse, I gathered that much. My question is how long
before the contact gets "removed"? It's late morning now and it's still
there :-)
-----Original Message-----
From: Marian Dumitru [mailto:marian.dumitru@voice-sistem.ro]
Sent: Saturday, March 26, 2005 5:37 AM
To: Matt Schulte
Cc: serusers(a)lists.iptel.org
Subject: Re: [Serusers] usrloc and replication
Hi Matt,
After expiration an before being removed, the contact are still kept in
ZOMBIE state - you can see the state in DB changes.
Best regards,
Marian
Matt Schulte wrote:
> Ok, I'm using usrloc db_mode 2, I understand the timer checks every 60
> seconds default to see who should be expired and all. What I don't
> understand is why I keep getting these messages:
>
> Keeping binding '+13142664004','sip:s@69.29.57.253:3105' for
> replication
>
> This contact expired nonetheless and should be removed, is there
> something I'm missing?
>
> +--------------+--------------------------------------+---------------
> +--------------+--------------------------------------+--
> ----+
> | username | contact | expires
> |
> +--------------+--------------------------------------+---------------
> +--------------+--------------------------------------+--
> ----+
> | +13142664004 | sip:s@69.29.57.253:3105 | 2005-03-26
> 00:42:35 |
> | +13142664004 | sip:s@69.29.57.253:3118 | 2005-03-26
> 01:24:58 |
> +--------------+--------------------------------------+---------------
> +--------------+--------------------------------------+--
> ----+
--
Voice System
http://www.voice-system.ro
Dear SER experts,
I installed serweb (last CVS version) for web-based accounts management.
I can successfully log in, but, when I change my timezone or password,
then logout and login again, I see that all values are left unchanged.
Immediately after values changing, the browser thinks a bit, but after
that writes nothing, neither errors, no anything else. On the other hand, the
according page on the `iptel.org' writes that `values changed successfully'.
Where am I wrong?
Thank you very much.
--
Best regards,
Timur Elzhov
Warelex LLC
...REALM: insert the domain you want to provide with ser and you have
configured in ser.cfg (e.g. "leonardo.it"). So the database will be prepared
for this domain.
The second problem with "HA1 calculation failed" can be easy solved by
editing the script file ser_mysql.sh:
search the line "GENHA1='gen_ha1' and replace the filename 'gen_ha1' with
the absolute path to that file (e.g. "GENHA1='/usr/local/sbin/gen_ha1'").
Then it should work.
BR
klaus
-----------------------------
thx for your answer,
i lunch the command but i have this problem...
neo:~# ser_mysql.sh create
MySql password for root:
neo:~# ser_mysql.sh create
MySql password for root:
Domain (realm) for the default user 'admin':
HA1 calculation failed
neo:~#
have u any idea? (i dont understand this realm...) thx in advance leo
On Mon, 04 Apr 2005 21:48:45 +0200, Klaus Feichtinger
<tw01e007(a)technikum-wien.at> wrote:
> ...did you already use the included script "ser_mysql.sh"? If no, just
> do it. So you get installed the database with the correct structure
> and users.
>
> Klaus
>
> P.S. The default PSWD for ser is "heslo" ;-)
>
> -----Ursprüngliche Nachricht-----
> Von: serusers-bounces(a)iptel.org [mailto:serusers-bounces@lists.iptel.org] Im
> Auftrag von Leonardo Altieri
> Gesendet: Montag, 4. April 2005 21:29
> An: serusers(a)lists.iptel.org
> Betreff: [Serusers] help on ser_mysql
>
> Hi everyone,
> there is someone that can help me about my ser with mysql support...
> I've debian distro i've compiled everything about ser v0.8.14 with
> mysql.so module (without db support everything works, i've seen serctl
> moni output; mysqlserver is well installed and working) but something
> is wrong. The output is...
>
> neo:/home# ser -f /etc/ser/ser.cfg
> Listening on
> neo [127.0.0.1]:5060
> Aliases: matrix.it:5060
> WARNING: no fork mode
> stateless - initializing
> Maxfwd module- initializing
> 0(9184) connect_db(): Access denied for user: 'ser@localhost' (Using
> password: YES)
> 0(9184) db_init(): Error while trying to connect database
> 0(9184) mod_init(): Error while connecting database
> 0(9184) init_mod(): Error while initializing module usrloc
> ERROR: error while initializing modules
>
> I cant find psw for ser user...please help me..
> thx in advance
> leo altieri
>
--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/
--
Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX
Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms
