[Users] Problem with BYE method getting a 404 not found response

Russ Daigle rdaigle at musecurity.com
Fri Nov 10 11:10:51 CET 2006 

I can reproduce this easily.  Do you see anything wrong with the  
below packet traces?

Here is the sequence:

Bob  ----- UDP Invite ----->  OpenSER   ---------- UDP Invite ------ 
 >  Alice

Alice responds back with 180 ringing, then 200 Ok.

Upon getting the 200 OK, Bob sends an ACK (to complete the INVITE),  
followed by an Immediate BYE.

THE TROUBLE IS......  the ACK that Bob sends is dropped (never  
forwarded to Alice) and the BYE that Bob sends is responded by  
OpenSER with a 404 not found, and never forwarded onto Alice!!!!   I  
see nothing wrong with the messages.   WHat is happening?

Below is the message exchanges.  Followed by "openserctl ul show" to  
show Alice is still registered.

01:18:19.801230 IP 10.10.2.6.5080 > 10.10.1.234.sip: UDP, length 597
INVITE sip:alice at siptest2.com:5060 SIP/2.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>
CSeq: 1 INVITE
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Contact: <sip:bob at 10.10.2.6:5080>;transport=UDP
Max-Forwards: 70
Content-Type: application/sdp
Content-Length: 195

v=0
o=- 817933771 817933775 IN IP4 10.10.2.6
s=darkness
c=IN IP4 10.10.2.6
t=0 0
m=audio 5000 RTP/AVP 0 4 97
a=rtpmap:0 PCMU/8000
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000



01:18:19.802801 IP 10.10.1.234.sip > 10.10.2.6.5080: UDP, length 539
SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>
CSeq: 1 INVITE
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Server: OpenSer (1.1.0-notls (i386/darwin))
Content-Length: 0
Warning: 392 10.10.1.234:5060 "Noisy feedback tells:  pid=11955  
req_src_ip=10.10.2.6 req_src_port=5080 in_uri=sip:alice at siptest2.com: 
5060 out_uri=sip:alice at 10.10.2.6:5070 via_cnt==1"


01:18:19.802885 IP 10.10.1.234.sip > 10.10.2.6.5070: UDP, length 734
INVITE sip:alice at 10.10.2.6:5070 SIP/2.0
Record-Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
Via: SIP/2.0/UDP 10.10.1.234;branch=z9hG4bKcbde.5492991.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>
CSeq: 1 INVITE
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Contact: <sip:bob at 10.10.2.6:5080>;transport=UDP
Max-Forwards: 69
Content-Type: application/sdp
Content-Length: 195
P-hint: usrloc applied

v=0
o=- 817933771 817933775 IN IP4 10.10.2.6
s=darkness
c=IN IP4 10.10.2.6
t=0 0
m=audio 5000 RTP/AVP 0 4 97
a=rtpmap:0 PCMU/8000
a=rtpmap:4 G723/8000/1
a=rtpmap:97 telephone-event/8000


01:18:19.891076 IP 10.10.2.6.5070 > 10.10.1.234.sip: UDP, length 362
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 10.10.1.234;branch=z9hG4bKcbde.5492991.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
To: Alice <sip:alice at siptest2.com:5060>
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
CSeq: 1 INVITE
Server: mjsip stack 1.6
Content-Length: 0



01:18:19.957284 IP 10.10.2.6.5070 > 10.10.1.234.sip: UDP, length 420
SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 10.10.1.234;branch=z9hG4bKcbde.5492991.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
Record-Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
To: Alice <sip:alice at siptest2.com:5060>
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
CSeq: 1 INVITE
Server: mjsip stack 1.6
Content-Length: 0


01:18:19.957363 IP 10.10.2.6.5070 > 10.10.1.234.sip: UDP, length 643
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.10.1.234;branch=z9hG4bKcbde.5492991.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
Record-Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
CSeq: 1 INVITE
Contact: <sip:alice at 192.168.0.3:5070>
Server: mjsip stack 1.6
Content-Length: 135
Content-Type: application/sdp

v=0
o=- 817933771 817933775 IN IP4 10.10.2.6
s=darkness
c=IN IP4 192.168.0.3
t=0 0
m=audio 21000 RTP/AVP 0
a=rtpmap:0 PCMU/8000


01:18:19.957995 IP 10.10.1.234.sip > 10.10.2.6.5080: UDP, length 584
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
Record-Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
CSeq: 1 INVITE
Contact: <sip:alice at 192.168.0.3:5070>
Server: mjsip stack 1.6
Content-Length: 135
Content-Type: application/sdp

v=0
o=- 817933771 817933775 IN IP4 10.10.2.6
s=darkness
c=IN IP4 192.168.0.3
t=0 0
m=audio 21000 RTP/AVP 0
a=rtpmap:0 PCMU/8000

01:18:20.047797 IP 10.10.2.6.5080 > 10.10.1.234.sip: UDP, length 365
ACK sip:alice at siptest2.com:5060 SIP/2.0
Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK0
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
CSeq: 1 ACK
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Max-Forwards: 70


01:18:20.047803 IP 10.10.2.6.5080 > 10.10.1.234.sip: UDP, length 370
BYE sip:alice at siptest2.com:5060 SIP/2.0
Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK767774
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
CSeq: 2 BYE
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Max-Forwards: 70

01:18:20.049706 IP 10.10.1.234.sip > 10.10.2.6.5080: UDP, length 561
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK767774
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
CSeq: 2 BYE
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
Server: OpenSer (1.1.0-notls (i386/darwin))
Content-Length: 0
Warning: 392 10.10.1.234:5060 "Noisy feedback tells:  pid=11955  
req_src_ip=10.10.1.234 req_src_port=5060 in_uri=sip: 
10.10.1.234;lr=on;ftag=fromhackblah out_uri=sip: 
10.10.1.234;lr=on;ftag=fromhackblah via_cnt==2"



01:18:20.421033 IP 10.10.2.6.5070 > 10.10.1.234.sip: UDP, length 643
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.10.1.234;branch=z9hG4bKcbde.5492991.0
Via: SIP/2.0/UDP 10.10.2.6:5080;branch=z9hG4bK15
Record-Route: <sip:10.10.1.234;lr=on;ftag=fromhackblah>
To: Alice <sip:alice at siptest2.com:5060>;tag=d418a42d9b1c6819
From: Bob <sip:bob at siptest2.com>;tag=fromhackblah
Call-ID:  
TUNQQQNWAYJDYCXGYAIWQEMRGOLILIBMMJMLNTFVLIBIBUORMDALF at musecurity.com
CSeq: 1 INVITE
Contact: <sip:alice at 192.168.0.3:5070>
Server: mjsip stack 1.6
Content-Length: 135
Content-Type: application/sdp

v=0
o=- 817933771 817933775 IN IP4 10.10.2.6
s=darkness
c=IN IP4 192.168.0.3
t=0 0
m=audio 21000 RTP/AVP 0
a=rtpmap:0 PCMU/8000


'alice'
sip:~ russdaigle$ sudo openserctl ul show
WARINIG: no database engine found - tried ''
Dumping all contacts may take long: are you sure you want to proceed?  
[Y|N] y
===Domain list===
---Domain---
name : 'aliases'
size : 512
table: 0x2191b90
d_ll {
     n    : 0
     first: 0x0
     last : 0x0
}
---/Domain---
---Domain---
name : 'location'
size : 512
table: 0x218fa08
d_ll {
     n    : 1
     first: 0x2193c90
     last : 0x2193c90
}

...Record(0x2193c90)...
domain: 'location'
aor   : 'alice'
~~~Contact(0x2193cd0)~~~
domain    : 'location'
aor       : 'alice'
Contact   : 'sip:alice at 10.10.2.6:5070'
Expires   : 794
q         :
Call-ID   :  
'XQQZRLTJDMQZUMPKAJZBQEVGSPRAFOXTCGRQQCSIWPKMJLTGHFC at musecurity.com'
CSeq      : 1
User-Agent: 'n/a'
received  : ''
Path      : ''
State     : CS_NEW
Flags     : 0
Sock      : 10.10.1.234:5060 (0xfa6e8)
Methods   : 4294967295
next      : 0x0
prev      : 0x0
~~~/Contact~~~~
.../Record...

---/Domain---
===/Domain list===

More information about the Users mailing list