wireshark equivalent for an adsl router ?

[regfixit]

I am trying to diagnose problem with external extension and wondering if there is a way to trace packets that the router sends to the internet. The external extenstion is a Thomson 780WL ADSL router with built in VOIP so there is no firewall or STUN stuff to configure.

When external extension makes a call I use wireshark on the 3cx server host to see what happens:

receive INVITE from external extension
reply with status 407 -proxy auth required
receive ACK
receive INVITE with Cseq 2 and proxy authorisation stuff
send status 100 trying, 180 ringing
send status 200 OK with session descriptor
then 3cx repeatedly sends the status 200OK until after 30 sec it disconnects the call with a BYE and a note that no ACK was received.

If I look on the external extension router system log I see
VOIP send INVITE
VOIP recv 407 proxy auth required
VOIP send ACK
VOIP Send INVITE
VOIP recv 100
VOIP recv 180
Voip recv 200 OK
VOIP send ACK

So the extension is telling me it sent an ACK, but it does not arrive at 3cx. The audio is working fine in both directions until the call is cut by 3cx because it didn't receive the final ACK.

What is puzzling me is that the first ACK is received no problem.

So what I want to do is analyse the packets coming out of the external extension to see what desintaion is used on the final ACK - but I can't use wireshark as this is all internal to the router.

The router has telnet interface and various commands like ip debug traceconfig plus snmp - is there a way to make it foward its packets to the LAN or dump them to a log file or something like that ?

Alterhativel anyone have an idea why the first ACK makes it OK, but the second ACK gets lost ?

 

[regfixit]

Update: Just "for fun", I changed the 3cx SIP port in the General settings to 5061 instead of 5060. After doing this and updating external extension to register to 5061 it all works fine and the final ACK is now received.

So all working, but still interested to know if anyone can explain why and also original Q about how to trace packets that are going straight out of the router.

 

[Powermage]

So you sistuation is

3cx server ------- NAT router ------ internet ------ thomson with problems ???

Probably there is somekind of SIP awarenes in the NAT router and that will recieve the ACK and doesnt send this to 3cx.

edit: in the partner forum there is a whole discussion about 3cx and external extensions, the only 2 relyable options are: hardware VPN or Tunnel, the rest is trial and error.

 

[regfixit]

OK thanks for that. I did have hardware VPN setup, but wanted to avoid rtp stream for calls via voip provider having to be routed by 3cx so wanted to make the extension external again.

Ie. external extension places call via voiptalk - I want voiptalk to send rtp stream direct to external extension and not to my 3cx to forward down vpn to "internal" extension.

Will keep trying...

I also read in RFC3263 that the ACK to a 200 response is passed straight to the transport stream so it kind of explains why even though I get the ACK for the 407 auth req'd I don't get the 200 ACK.

 

[Powermage]

I dont know for sure, but when you disable all the PBX delivers audio (on handset and on the voip lines) .
Will the RTP traffic still go through the 3cx or will the handset make a new route to the sip provider through his local internet connection? at least with internal phones it will because we have 2 branch offices and without an VPN from branch to branch we didnt get voip audio between the phones.

 

[Kevin Attard Compagno]

Hi there

Since this router is VoIP-aware/capable, it is very likely that it monopolizes port 5060 for itself. So this could explain why changing to another port resolves the issue.

Regards

Kevin