PDA

Archiv verlassen und diese Seite im Standarddesign anzeigen : SIP Netzwerktraffic stolpert


Wallnerm
21. December 2010, 22:44
Hallo,

bei mir stolpert der SIP Netzwerktraffic etwas. Dahinter steckt eine Asterisk Anlage. Evtl. kann sich das mal jemand anschauen, der da fit ist.

Es beginnt mit dem normalen "hello" und endet auch wieder mit dem "hello" als sich alles wieder gefangen hat.
192.168.1.150 ist die Asterisk-Anlage
192.168.1.1 ist natürlich der Router
213.148.136.2 ist sip.qsc.de
217.0.43.129 ist die Telekom, warum auch immer ?!?


Time Source Destination Protocol Info
2010-12-21 21:08:56.917993 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:05.111048 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:13.303850 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:21.496413 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:29.688955 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:37.881760 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:46.074811 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:09:54.267370 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:02.459935 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:10.652816 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:18.845542 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:27.038597 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:32.650225 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:32.705981 217.0.43.145 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:10:32.748159 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:35.231244 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:37.654036 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:37.719146 217.0.43.129 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:10:37.719270 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:42.658184 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:42.713644 217.0.43.145 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:10:42.713803 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:43.423704 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:47.662212 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:47.747783 217.0.43.129 192.168.1.150 DNS Standard query response SRV 10 10 5060 farm02.sip.qsc.de SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:10:47.747915 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:51.617034 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:10:52.666474 192.168.1.150 192.168.1.1 DNS Standard query A sip.qsc.de
2010-12-21 21:10:52.720917 192.168.1.1 192.168.1.150 DNS Standard query response A 213.148.136.2
2010-12-21 21:10:52.721290 192.168.1.150 192.168.1.1 DNS Standard query A meinAccount.dyndns.info
2010-12-21 21:10:52.874802 192.168.1.1 192.168.1.150 DNS Standard query response A 84.164.150.140
2010-12-21 21:10:52.875132 192.168.1.150 213.148.136.2 SIP Request: REGISTER sip:sip.qsc.de
2010-12-21 21:10:52.943917 213.148.136.2 192.168.1.150 SIP Status: 401 Unauthorized (0 bindings)
2010-12-21 21:10:52.944423 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:53.017200 217.0.43.145 192.168.1.150 DNS Standard query response SRV 10 10 5060 farm02.sip.qsc.de SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:10:53.030566 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:57.945780 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:10:57.989006 217.0.43.129 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:10:57.989131 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:10:59.809314 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:02.949884 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:03.004668 217.0.43.145 192.168.1.150 DNS Standard query response SRV 30 10 5060 farm01.sip.qsc.de SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:11:03.004785 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:07.953876 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:07.997175 217.0.43.129 192.168.1.150 DNS Standard query response SRV 30 10 5060 farm01.sip.qsc.de SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:11:07.997288 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:08.002326 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:12.958208 192.168.1.150 192.168.1.1 DNS Standard query A sip.qsc.de
2010-12-21 21:11:12.958445 192.168.1.1 192.168.1.150 DNS Standard query response A 213.148.136.2
2010-12-21 21:11:12.958689 192.168.1.150 213.148.136.2 SIP Request: REGISTER sip:sip.qsc.de
2010-12-21 21:11:12.959023 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:13.027720 213.148.136.2 192.168.1.150 SIP Status: 200 OK (1 bindings)
2010-12-21 21:11:13.028363 217.0.43.145 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:11:13.047675 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:16.194946 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:17.962081 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:18.004349 217.0.43.129 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de
2010-12-21 21:11:18.004476 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:22.966265 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:23.021263 217.0.43.145 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:11:23.021432 192.168.1.150 217.0.43.145 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:24.463337 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:27.970239 192.168.1.150 192.168.1.1 DNS Standard query SRV _sip._UDP.sip.qsc.de
2010-12-21 21:11:28.013517 217.0.43.129 192.168.1.150 DNS Standard query response SRV 20 10 5060 farm03.sip.qsc.de SRV 10 10 5060 farm02.sip.qsc.de SRV 30 10 5060 farm01.sip.qsc.de
2010-12-21 21:11:28.013687 192.168.1.150 217.0.43.129 ICMP Destination unreachable (Port unreachable)
2010-12-21 21:11:32.587011 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:32.974454 192.168.1.150 192.168.1.1 DNS Standard query A sip.qsc.de
2010-12-21 21:11:32.974687 192.168.1.1 192.168.1.150 DNS Standard query response A 213.148.136.2
2010-12-21 21:11:32.974998 192.168.1.150 192.168.1.1 DNS Standard query A meinAccount.dyndns.info
2010-12-21 21:11:32.975219 192.168.1.1 192.168.1.150 DNS Standard query response A 84.164.150.140
2010-12-21 21:11:32.975475 192.168.1.150 213.148.136.2 SIP Request: REGISTER sip:sip.qsc.de
2010-12-21 21:11:33.044111 213.148.136.2 192.168.1.150 SIP Status: 200 OK (1 bindings)
2010-12-21 21:11:40.773332 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:48.965873 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:11:57.158704 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:12:05.351468 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip
2010-12-21 21:12:13.544042 213.148.136.2 192.168.1.150 UDP Source port: sip Destination port: sip


Sobald eine DNS Abfrage gemacht wird, gerät das ganze ins Stolpern. Da wird dann ein ICMP Paket an die Telekom-IP versandt. Keine Ahnung was das soll.
Dann wird von Asterisk ein Register an QSC gesendet, das aber erst mal mit 401 Unauthorized abgelehnt wird, aber irgendwann fängt es sich wieder.

Die Auswirkung dabei ist, die Asterisk-Anlage während dieses Stolperns natürlich von außen nicht erreichbar ist.

Vielen Dank für Eure Mühen schon mal!!!!