27 Jul
2007
27 Jul
'07
3 a.m.
On Thu, Jul 26, 2007 at 10:24:18PM -0400, SIP wrote:
[...]
a=rtpmap:18 G729/8000/1.
a=rtpmap:98 telephone-event/8000/1.
a=rtpmap:13
[...]
The ONLY thing I noticed about this that's completely non-standard, is
that every other packet seems to have this period after it (indicating,
perhaps, the end of a line... I don't know enough about the display of
ngrep to tell). This INVITE does not. It goes almost immediately into
the next packet, and it's almost as though this one never ends.
It looks like there's a part missing at the end (the last line isn't
complete). In other words, the packet is probably fragmented.
Unfortunately you can't tell this from ngrep's output.
If the packet is fragmented, and the second fragment is dropped on the
way (due to broken firewalls or sth), then the kernel will not be able
to reassemble the packet, and it won't even be processed by SER. Which
would explain that no reaction is observed.
Note also that with ngrep you won't see the successive fragments if you
use a filter expression like "port 5060", because the port numbers are
only contained in the first fragment.
Regards,
Jan
--
Jan Andres <jan.andres(a)freenet.ag>