[Serusers] UDP

[Klaus Darilion]

MAy it be that you make the dump with tcpdump, and display it with ethereal?

tcpdump usually only captures not the whole package. Try to capture the 
whole packet, e.g
tcpdump -s 0 ......

Just because ethereal can't decode the SIP message does not mean that it 
is not a valid SIP message. But therefore we need a complete dump to 
analyze the problem.

klaus

Sebastian Kühner wrote:
> Hi!
> 
> Maybe there is a fragmentation... if I make a dump of "normal" phone calls,
> the "INVITE" package also has 54 Bytes (but the difference is that there is
> protocol=SIP in the ethereal).
> 
> What is IOS? :-S
> 
> Thanks!
> 
> 
> ----- Original Message ----- 
> From: "Klaus Darilion" <klaus.mailinglists at pernau.at>
> To: "Sebastian Kühner" <skuehner at veraza.com>
> Cc: <serusers at lists.iptel.org>
> Sent: Wednesday, August 03, 2005 12:26 PM
> Subject: Re: [Serusers] UDP
> 
> 
> 
>>Strange. There is only 54 bytes of UDP data although the UDP header says
>>there are 1212 bytes of payload.
>>
>>Is there fragmentation?
>>
>>Do you use the newest IOS?
>>
>>Klaus
>>
>>Sebastian Kühner wrote:
>>
>>>Hi!
>>>
>>>Well, I don't like to send the dump because of the IP-Addresses. I sent
> 
> you
> 
>>>a picture of my ethereal tracedump and I hope that someone can give me a
>>>hint...
>>>
>>>Here is my ngrep:
>>>
>>>U 2005/08/02 15:43:56.584366 xxx.xxx.xxx.xxx:51403 ->
> 
> xxx.xxx.xxx.xxx:5060
> 
>>>INVITE sip:10099999999999 at xxx.xxx.xxx.xxx:5060 SIP/2.0.
>>>Via: SIP/2.0/UDP  xxx.xxx.xxx.xxx:5060;x-route-tag="tgrp:OutTrunkGroup".
>>>From: "anonymous" <sip:54 at xxx.xxx.xxx.xxx>;tag=CEA94420-184A.
>>>To: <sip:10099999999999 at xxx.xxx.xxx.xxx>.
>>>Date: Tue, 02 Aug 2005 18:43:56 GMT.
>>>Call-ID: 375AFBE2-2BC11DA-B615D293-1A0569D1 at xxx.xxx.xxx.xxx.
>>>Supported: timer,100rel.
>>>Min-SE:  1800.
>>>Cisco-Guid: 927669769-45879770-3054686867-436562385.
>>>User-Agent: Cisco-SIPGateway/IOS-12.x.
>>>Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, COMET, REFER,
> 
> SUBSCRIBE,
> 
>>>NOTIFY, INFO.
>>>CSeq: 101 INVITE.
>>>Max-Forwards: 6.
>>>Remote-Party-ID:
>>><sip:54 at xxx.xxx.xxx.xxx>;party=calling;screen=yes;privacy=full.
>>>Timestamp: 1123008236.
>>>Contact: <sip:54 at xxx.xxx.xxx.xxx:5060>.
>>>Expires: 180.
>>>Allow-Events: telephone-event.
>>>Content-Type: application/sdp.
>>>Content-Length: 382.
>>>
>>>Many thanks for your help!!
>>>
>>>Sebastian
>>>
>>>
>>>----- Original Message ----- 
>>>
>>>
>>>Most likely Cisco is sending you a malformed request. Try to fix the
> 
> problem
> 
>>>on the Cisco side. Maybe you can send the dump to the list and we can
> 
> help
> 
>>>identify the problem.
>>>
>>>
>>>------------------------------------------------------------------------
>>>
>>>
>>>------------------------------------------------------------------------
>>>
>>>_______________________________________________
>>>Serusers mailing list
>>>serusers at lists.iptel.org
>>>http://lists.iptel.org/mailman/listinfo/serusers
>>
>>
>>
> 
> 
> _______________________________________________
> Serusers mailing list
> serusers at lists.iptel.org
> http://lists.iptel.org/mailman/listinfo/serusers
> 
>