asterisk users - Feb 2014 - SIP OPTIONS "storm"?

Greetings-

I recently experienced an odd situation. I have an Asterisk 11.5.0 system (Box
A) with a SIP peering to another Asterisk 1.8.23.0 system (Box B). At some
point, Box A started sending over 65Mbps of SIP OPTIONS packets to Box A. I do
have qualify=yes for the peer on both sides, and the qualifyfreq is not set (aka
default of 60secs).

Of course, logs on Box A were not set to show debug info, so there is no
indication of a problem. Logs on Box B show no issues, only at a very specific
start time, there are suddenly tons of:

[2014-02-13 00:12:50] DEBUG[31516] chan_sip.c: Allocating new SIP dialog for
2a338cf5518531e31190bd4b7826d137 at x.y.z.166:5060 - OPTIONS (No RTP)

I've done quite a bit of searching, but am not finding anything of
consequence. Also, the Asterisk changelogs are not providing anything that would
indicate this is known and fixed, at least for the 11.x branch.

Thoughts/suggestions? Thanks!

--Tim

SIP options message is due to check the peer registration is keepalive. As
per my understanding it might be because of network flap may be wireshark
trace can give you any clue.

Regards
On 13 Feb 2014 23:41, "Tim Nelson" <tnelson at rockbochs.com>
wrote:
> Greetings-
>
> I recently experienced an odd situation. I have an Asterisk 11.5.0 system
> (Box A) with a SIP peering to another Asterisk 1.8.23.0 system (Box B). At
> some point, Box A started sending over 65Mbps of SIP OPTIONS packets to Box
> A. I do have qualify=yes for the peer on both sides, and the qualifyfreq is
> not set (aka default of 60secs).
>
> Of course, logs on Box A were not set to show debug info, so there is no
> indication of a problem. Logs on Box B show no issues, only at a very
> specific start time, there are suddenly tons of:
>
> [2014-02-13 00:12:50] DEBUG[31516] chan_sip.c: Allocating new SIP dialog
> for 2a338cf5518531e31190bd4b7826d137 at x.y.z.166:5060 - OPTIONS (No RTP)
>
> I've done quite a bit of searching, but am not finding anything of
> consequence. Also, the Asterisk changelogs are not providing anything that
> would indicate this is known and fixed, at least for the 11.x branch.
>
> Thoughts/suggestions? Thanks!
>
> --Tim
>
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>                http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>    http://lists.digium.com/mailman/listinfo/asterisk-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.digium.com/pipermail/asterisk-users/attachments/20140214/52786af7/attachment.html>

On 13 Feb 2014, at 18:10, Tim Nelson <tnelson at rockbochs.com>
wrote:
> I recently experienced an odd situation. I have an Asterisk 11.5.0 system
(Box A) with a SIP peering to another Asterisk 1.8.23.0 system (Box B). At some
point, Box A started sending over 65Mbps of SIP OPTIONS packets to Box A. I do
have qualify=yes for the peer on both sides, and the qualifyfreq is not set (aka
default of 60secs).
Just because Box B was receiving 65MBps doesn?t mean box A was sending them. I
suspect it?s probably the same one repeated, due to some kind of network
problem. Do you have a pcap so you can look for the ID in the packets to see if
they are the same? Would be good if you can prove A sent them too (traffic stats
from SNMP monitoring or something).

S