[Serusers] Is there something weird about this INVITE ?

[Jan Andres]

On Thu, Jul 26, 2007 at 10:24:18PM -0400, SIP wrote:
[...]
> a=rtpmap:18 G729/8000/1.
> a=rtpmap:98 telephone-event/8000/1.
> a=rtpmap:13
> 
[...]
> 
> The ONLY thing I noticed about this that's completely non-standard, is 
> that every other packet seems to have this period after it (indicating, 
> perhaps, the end of a line... I don't know enough about the display of 
> ngrep to tell). This INVITE does not. It goes almost immediately into 
> the next packet, and it's almost as though this one never ends.

It looks like there's a part missing at the end (the last line isn't
complete). In other words, the packet is probably fragmented.
Unfortunately you can't tell this from ngrep's output.

If the packet is fragmented, and the second fragment is dropped on the
way (due to broken firewalls or sth), then the kernel will not be able
to reassemble the packet, and it won't even be processed by SER. Which
would explain that no reaction is observed.

Note also that with ngrep you won't see the successive fragments if you
use a filter expression like "port 5060", because the port numbers are
only contained in the first fragment.

Regards,
Jan

-- 
Jan Andres <jan.andres at freenet.ag>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.sip-router.org/pipermail/sr-users/attachments/20070727/3f4822e3/attachment.pgp>