Hi Lars,

ALG = Application layer Gateway.

- Atle

* Lars Sundqvist lars.sundqvist@home.se [060424 09:57]:

Sorry if it is obvious, but what does ALGs stand for? and is there any way this can be prevented or any way i can find out from where these requests come?

When I do a tcpdump and view the result in ethereal I can see we are getting some UDP packets (that do not get classified as SIP) to the openser port. These contain 2, 4 or 18 bytes with: 0a 0d, 00 00 00 00 or the string "KEEP ALIVE MESSAGE"

I've only captured a small amount of data so these might only be a small subset of the ones we actually receive (non-sip packets that is).

Could these packets be whats causing the errors in the log? and if so, can i somehow prevent openser to try to parse them as SIP?

Thanks

Lars Sundqvist

Atle Samuelsen wrote:

...

Whild Whild Guess, but I bet itt+s some ALGs that?s fucking up for you..

-A

• Lars Sundqvist lars.sundqvist@home.se [060424 09:11]:

...

Hello,

We have a few hundred users registered to a openser we are running and everything works fine, however i get som error messages in the logs I would like to get rid of...

//sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: xl_get_from: ERROR cannot parse FROM header /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: xl_get_to: ERROR cannot parse TO header /sbin/openser[28867]: [REGISTER] from [<null>] to [<null>] /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:maxfwd:is_maxfwd_present : parsing MAX_FORWARD header failed! /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: insert_RR(): From parsing failed /sbin/openser[28867]: record_route(): Error while inserting Record-Route line /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_first_route: Error while parsing headers /sbin/openser[28867]: analyzing REGISTER request /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_credentials(): Error while parsing headers /sbin/openser[28867]: pre_auth(): Error while looking for credentials /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: build_res_buf_from_sip_req: alas, parse_headers failed /sbin/openser[28867]: pre_auth(): Error while sending 400 reply / Anyone has a clue what I can do to debug this to find out where the request are coming from or what can be done to stop the invalid(?) requests from being processed and clutter my logs?

Thanks

Lars Sundqvist

...

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users

Bogdan,

Thanks, I will analyze the traffic a bit closer and see if I can find anyone sending corrupt messages then.

Lars Sundqvist

Bogdan-Andrei Iancu wrote:

Hi Lars,

openser automatically drops incoming messages less than 32 bytes - if you wan to increase it, see the config.h, MIN_UDP_PACKET.

but not the keep alive packages may be the problem and you may have indeed some broken sip messages.

regards, bogdan

Lars Sundqvist wrote:

...

Sorry if it is obvious, but what does ALGs stand for? and is there any way this can be prevented or any way i can find out from where these requests come?

When I do a tcpdump and view the result in ethereal I can see we are getting some UDP packets (that do not get classified as SIP) to the openser port. These contain 2, 4 or 18 bytes with: 0a 0d, 00 00 00 00 or the string "KEEP ALIVE MESSAGE"

I've only captured a small amount of data so these might only be a small subset of the ones we actually receive (non-sip packets that is).

Could these packets be whats causing the errors in the log? and if so, can i somehow prevent openser to try to parse them as SIP?

Thanks

Lars Sundqvist

Atle Samuelsen wrote:

...

Whild Whild Guess, but I bet itt+s some ALGs that´s fucking up for you..

-A

• Lars Sundqvist lars.sundqvist@home.se [060424 09:11]:

...

Hello,

We have a few hundred users registered to a openser we are running and everything works fine, however i get som error messages in the logs I would like to get rid of...

//sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: xl_get_from: ERROR cannot parse FROM header /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: xl_get_to: ERROR cannot parse TO header /sbin/openser[28867]: [REGISTER] from [<null>] to [<null>] /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:maxfwd:is_maxfwd_present : parsing MAX_FORWARD header failed! /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: insert_RR(): From parsing failed /sbin/openser[28867]: record_route(): Error while inserting Record-Route line /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_first_route: Error while parsing headers /sbin/openser[28867]: analyzing REGISTER request /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_credentials(): Error while parsing headers /sbin/openser[28867]: pre_auth(): Error while looking for credentials /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: build_res_buf_from_sip_req: alas, parse_headers failed /sbin/openser[28867]: pre_auth(): Error while sending 400 reply / Anyone has a clue what I can do to debug this to find out where the request are coming from or what can be done to stop the invalid(?) requests from being processed and clutter my logs?

Thanks

Lars Sundqvist

...

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users

---

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users

Hello,

since several months there is a module called sanity which you can tell to try to parse the essential headers. If it encounters an error while parsing it will automatically send back the right error response (if possible). It has already proven in real world deployments to reduce the log message drastically.

Greetings Nils

On Wednesday 10 January 2007 21:58, Joao Pereira wrote:

Im having this messages too.... Whats happening? How can I stop it? Thanks Joao Pereira

Lars Sundqvist wrote:

...

Hello,

We have a few hundred users registered to a openser we are running and everything works fine, however i get som error messages in the logs I would like to get rid of...

//sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: xl_get_from: ERROR cannot parse FROM header /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: xl_get_to: ERROR cannot parse TO header /sbin/openser[28867]: [REGISTER] from [<null>] to [<null>] /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR:maxfwd:is_maxfwd_present : parsing MAX_FORWARD header failed! /sbin/openser[28867]: ERROR:parse_from_header: bad from header /sbin/openser[28867]: insert_RR(): From parsing failed /sbin/openser[28867]: record_route(): Error while inserting Record-Route line /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_first_route: Error while parsing headers /sbin/openser[28867]: analyzing REGISTER request /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: find_credentials(): Error while parsing headers /sbin/openser[28867]: pre_auth(): Error while looking for credentials /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: get_hdr_field: bad to header /sbin/openser[28867]: ERROR: bad header field /sbin/openser[28867]: ERROR: build_res_buf_from_sip_req: alas, parse_headers failed /sbin/openser[28867]: pre_auth(): Error while sending 400 reply / Anyone has a clue what I can do to debug this to find out where the request are coming from or what can be done to stop the invalid(?) requests from being processed and clutter my logs?

Thanks

Lars Sundqvist

---

---

Users mailing list Users@openser.org http://openser.org/cgi-bin/mailman/listinfo/users

---

Serusers mailing list Serusers@lists.iptel.org http://lists.iptel.org/mailman/listinfo/serusers