Solved Incorrect SIP message header

[adamr]

Hello,

I have a customer with an old IPECS which looks to be having some interop issues with the new 3CX that we're deploying in the cloud, using a SBC on-prem. Versions are the latest available.

After a period of time where all lights are green, ALL phones start deregistering and failing to reregister, then they register, they don't, it's hit and miss. Phones are Yealink T54W FW 96.85.0.5. Call parking is dodgy when things start falling down. BLFs the same.

When this happens the old recption phone on the IPECS starts to fail registration. I shut down the SBC which fixes it. Weird!

Wiresharking a phones pcap shows this on the REGISTER packets;

-------------------------------------------------------
Session Initiation Protocol (REGISTER)
Request-Line: REGISTER sip:xxx.3cx.com.au:5060 SIP/2.0
Method: REGISTER
Request-URI: sip:xxx.3cx.com.au:5060
Request-URI Host Part: xxx.3cx.com.au
Request-URI Host Port: 5060
[Resent Packet: True]
[Suspected resend of frame: 14]
Message Header
Via: SIP/2.0/UDP 192.168.24.88:5060;branch=z9hG4bK424486720
Transport: UDP
Sent-by Address: 192.168.24.88
Sent-by port: 5060
Branch: z9hG4bK424486720
From: "xxx" <sip:[email protected]:5060>;tag=2666342206
SIP from display info: "xxx"
SIP from address: sip:[email protected]:5060
SIP from address User Part: 200
SIP from address Host Part: xxx.3cx.com.au
SIP from address Host Port: 5060
SIP from tag: 2666342206
To: "xxx" <sip:[email protected]:5060>
SIP to display info: "xxx"
SIP to address: sip:[email protected]:5060
SIP to address User Part: 200
SIP to address Host Part: xxx.3cx.com.au
SIP to address Host Port: 5060
Call-ID: [email protected]
[Generated Call-ID: [email protected]]
CSeq: 1 REGISTER
Sequence Number: 1
Method: REGISTER
Contact: <sip:[email protected]:5060>
Contact URI: sip:[email protected]:5060
Contact URI User Part: 200
Contact URI Host Part: 192.168.24.88
Contact URI Host Port: 5060
Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE
Max-Forwards: 70
User-Agent: Yealink SIP-T54W 96.85.0.5 805ec0e47e12
Expires: 120
Allow-Events: talk,hold,conference,refer,check-sync
Mac: 80:5e:c0:e4:7e:12
[Expert Info (Note/Undecoded): Unrecognised SIP header (mac)]
[Unrecognised SIP header (mac)]
[Severity level: Note]
[Group: Undecoded]
Content-Length: 0

-------------------------------------------------------

Note the last 5 lines. Has anyone seen this before? Or may know what's causing it?

There are also CDP, SDP etc packets flying around, not sure if this may be interfering with what the phone puts in its SIP header?

Regards,
Adam

 

[Evolute IT]

Oh no, not iPECS that's like the worst PBX to have ever been made.

 

[JohnS_3CX]

Have you installed the 3CX SBC or are you referring to some 3rd party SBC solution?

Is the SBC and the old IPECS on the same machine/IP ?

 

[adamr]

It's the 3CX SBC, a nice bit o hassle free kit. Different IP addresses.

 

[JohnS_3CX]

And what did you mean when you mentioned the word interop? Was there any attempt to connect the two systems?

To be frank, even with both in place, there should not be any interaction between the two. The Yealinks should only care about talking to the SBC and each other, and would be blissfully unaware of any other system on the network, unless you have a firewall/smart switch that runs SIP ALG or something similar on the LAN-level

 

[adamr]

Hey JohnS, and yes I think you are right, something at the LAN level is interfering with things. What local network protocols could do this do you know? CDP etc?

Adam

 

[JohnS_3CX]

SIP ALG (or whatever name the manufacturer may use for it) would be first place to go to.

 

[adamr]

Factory reset the managed switches and removed old phone system, fixed. Pretty sure the switches had a config in them that was doing it, but can't be 100% certain sorry.

 

[JohnS_3CX]

No worries Adam, glad to hear it was all resolved with a good old factory reset