On Thu, Jul 26, 2007 at 10:24:18PM -0400, SIP wrote: [...]
a=rtpmap:18 G729/8000/1. a=rtpmap:98 telephone-event/8000/1. a=rtpmap:13
[...]
The ONLY thing I noticed about this that's completely non-standard, is that every other packet seems to have this period after it (indicating, perhaps, the end of a line... I don't know enough about the display of ngrep to tell). This INVITE does not. It goes almost immediately into the next packet, and it's almost as though this one never ends.
It looks like there's a part missing at the end (the last line isn't complete). In other words, the packet is probably fragmented. Unfortunately you can't tell this from ngrep's output.
If the packet is fragmented, and the second fragment is dropped on the way (due to broken firewalls or sth), then the kernel will not be able to reassemble the packet, and it won't even be processed by SER. Which would explain that no reaction is observed.
Note also that with ngrep you won't see the successive fragments if you use a filter expression like "port 5060", because the port numbers are only contained in the first fragment.
Regards, Jan