On 2016-02-06 16:45, Roger wrote:
Hi Swinogers since a few weeks i see following messages on a server in Europe kernel:nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:23:54:d7:7c:12:80:71:1f:e2:71:81:08:00 SRC=191.189.9.153 DST=62.75.177.146 LEN=513 TOS=0x00 PREC=0x00 TTL=115 ID=27879 PROTO=UDP SPT=29012 DPT=5060 LEN=493
There are various IP´s causing this problem. In common: all IP´s causing those Messages are originating from a CGN Gateway The example above is an Brazilian Cableprovider.
Client behind those networks complaining getting sometimes dropped calls, or one way speech in some cases not able to Register some of Sip-devices while others work. mostly in times the Kernel drop packets.
SIP requires state, well, the RTP part of a SIP call requires state.
Some device is dropping state somewhere for you.
Welcome to the wonderful world of forced NAT.
Did you deploy IPv6 already? It is 2016, aka 201_IPv6_....
Does someone have any idea what is causing this ? even why the hell an invalid MAC address could made it so far.
Linux tends to show all the MAC addresses in a stack of packets, eg 802.1Q
00:23:54:d7:7c:12 is likely the switch you are connected to.
00:23:54 ASUSTek COMPUTER INC -- the VM bridge you are using?
80:71:1f:e2:71:81 80:71:1f Juniper Networks -- your actual router
08:00 just shows it is IPv4.
Greets, Jeroen