[cisco-voip] debug isdn q931 --> FXO port
Mike Roberts
mroberts at hcs.net
Wed May 5 09:30:35 EDT 2004
-----Original Message-----
From: cisco-voip-bounces at puck.nether.net
[mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of
cisco-voip-request at puck.nether.net
Sent: Wednesday, May 05, 2004 9:22 AM
To: cisco-voip at puck.nether.net
Subject: cisco-voip Digest, Vol 15, Issue 4
Send cisco-voip mailing list submissions to
cisco-voip at puck.nether.net
To subscribe or unsubscribe via the World Wide Web, visit
https://puck.nether.net/mailman/listinfo/cisco-voip
or, via email, send a message with subject or body 'help' to
cisco-voip-request at puck.nether.net
You can reach the person managing the list at
cisco-voip-owner at puck.nether.net
When replying, please edit your Subject line so it is more specific than
"Re: Contents of cisco-voip digest..."
Today's Topics:
1. RE: CiscoWorks ITM (Tim Medley)
2. RE: a strange flood of packets from ccm (Leonardo D'Urso)
3. Re: a strange flood of packets from ccm (Ryan Ratliff)
4. RE: a strange flood of packets from ccm (Wes Sisk)
5. Cisco router as SIP gateway (Eric Pylko)
6. RE: a strange flood of packets from ccm (Leonardo D'Urso)
7. RE: a strange flood of packets from ccm (Wes Sisk)
8. RE: a strange flood of packets from ccm (Leonardo D'Urso)
9. debug isdn q931 --> FXO port (Voll, Scott)
----------------------------------------------------------------------
Message: 1
Date: Tue, 4 May 2004 11:37:48 -0500
From: "Tim Medley" <medley at mac.com>
Subject: RE: [cisco-voip] CiscoWorks ITM
To: <cisco-voip at puck.nether.net>
Message-ID: <200405041638.i44GcSTL009951 at mac.com>
Content-Type: text/plain; charset="US-ASCII"
I evaluated it a few months ago and unfortunately it did not fit my needs.
It is very powerful and has some interesting features.
The issues I ran into were that it could only use port 80 to communicate
with CallManager, we are using an alternate port for http access to the
CCM's. Also it didn't seem to be able to monitor/manage Unity servers. I
have 3 CCM Cluster (6 servers) but I have 30+ Unity servers.
The gateway statistics utility is nice, but requires a third party reporting
tool or you have to write your own. Also it only allows you to run a single
gateway study at a time; I'd like to study at least one gateway in each of
my PoP's.
Tim Medley
-----Original Message-----
From: cisco-voip-bounces at puck.nether.net
[mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Voll, Scott
Sent: Tuesday, May 04, 2004 9:35 AM
To: cisco-voip at puck.nether.net
Subject: [cisco-voip] CiscoWorks ITM
Anyone using CiscoWorks ITM?
http://www.cisco.com/en/US/customer/products/sw/cscowork/ps5431/index.ht
ml
Thoughts? Problems? Pro's and Con's?
Thanks
Scott
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 2
Date: Tue, 4 May 2004 18:55:57 +0200 (CEST)
From: "Leonardo D'Urso" <durso at alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: cisco-voip at puck.nether.net
Message-ID: <Pine.LNX.4.58.0405041845220.2156 at puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
thanks Wes, for reply. In the trace I have seen a lot of this
packets:
<trace><Date>05/04/2004 15:10:56.514
</Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></S
rcDev><SrcIp>10.89.52.17</Sr
cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
Controller=[0,0,0]</info></trace>
I think this could be related to the flood.
--
Leonardo D'Urso alter.net Srl
e-mail: durso at alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
------------------------------
Message: 3
Date: Tue, 4 May 2004 12:12:20 -0500
From: "Ryan Ratliff" <rratliff at cisco.com>
Subject: Re: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso at alter.it>, <cisco-voip at puck.nether.net>
Message-ID: <00ec01c431fa$f594a100$b89a6540 at amer.cisco.com>
Content-Type: text/plain; charset="iso-8859-1"
An IP phone will maintain a TCP session, and send skinny keepalives, to
every CM that it could potentially be registered with (ie in its CM group).
Only the CM that it is currently registered with will respond to the
keepalive though. The message below means that CM was a backup CM for that
particular phone, so there was no need to respond to the keepalive. It is
not related to your problem and is completely normal.
-Ryan
----- Original Message -----
From: "Leonardo D'Urso" <durso at alter.it>
To: <cisco-voip at puck.nether.net>
Sent: Tuesday, May 04, 2004 11:55 AM
Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
>
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></S
rcDev><SrcIp>10.89.52.17</Sr
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso at alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 4
Date: Tue, 4 May 2004 13:14:47 -0400
From: "Wes Sisk" <wsisk at cisco.com>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso at alter.it>, <cisco-voip at puck.nether.net>
Message-ID: <ELEMLGDGDBLINAJEIOCLCEPPOEAA.wsisk at cisco.com>
Content-Type: text/plain; charset="us-ascii"
Leo,
This is normal. This just means that the CM process on this node received a
SCCP KeepAlive from the device with TCPHandle=000003290. This device is
actively registered to another CM node in the cluster so this CM node will
basically ignore the message.
/Wes
> -----Original Message-----
> From: cisco-voip-bounces at puck.nether.net
> [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 12:56 PM
> To: cisco-voip at puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso at alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 5
Date: Tue, 4 May 2004 12:43:27 -0700
From: Eric Pylko <eric at infinitenetworks.us>
Subject: [cisco-voip] Cisco router as SIP gateway
To: cisco-voip at puck.nether.net
Message-ID:
<20040504194327.28423.qmail at webmail03.mesa1.secureserver.net>
Content-Type: text/plain; charset="us-ascii"
An HTML attachment was scrubbed...
URL:
https://puck.nether.net/pipermail/cisco-voip/attachments/20040504/5fd867c9/a
ttachment-0001.html
------------------------------
Message: 6
Date: Tue, 4 May 2004 22:07:44 +0200 (CEST)
From: "Leonardo D'Urso" <durso at alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: cisco-voip at puck.nether.net
Message-ID: <Pine.LNX.4.58.0405042202440.2215 at puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
hi there,
log start at: 05/04/2004 15:12:26.079
log ends at: 05/04/2004 15:12:50.111
number of keepalives: 915
so I think that this is the flood. I know that CCM and phones use
keepalives but this seems I have a paranoic firmware on phones ;-)
--
Leonardo D'Urso alter.net Srl
e-mail: durso at alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
On Tue, 4 May 2004, Wes Sisk wrote:
> Leo,
>
> This is normal. This just means that the CM process on this node received
a
> SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> actively registered to another CM node in the cluster so this CM node will
> basically ignore the message.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces at puck.nether.net
> > [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 12:56 PM
> > To: cisco-voip at puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > thanks Wes, for reply. In the trace I have seen a lot of this
> > packets:
> >
> > <trace><Date>05/04/2004 15:10:56.514
> > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> > Controller=[0,0,0]</info></trace>
> >
> > I think this could be related to the flood.
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso at alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
------------------------------
Message: 7
Date: Tue, 4 May 2004 16:56:33 -0400
From: "Wes Sisk" <wsisk at cisco.com>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso at alter.it>, <cisco-voip at puck.nether.net>
Message-ID: <ELEMLGDGDBLINAJEIOCLOEBCOFAA.wsisk at cisco.com>
Content-Type: text/plain; charset="us-ascii"
Default is:
phone KA to active CM: every 30 seconds
phone KA to backup CM: every 60 seconds.
This is the active server for how many phones?
This is the backup server for how many phones?
A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
calculator will help you find your answer.
/Wes
> -----Original Message-----
> From: cisco-voip-bounces at puck.nether.net
> [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 4:08 PM
> To: cisco-voip at puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> hi there,
>
> log start at: 05/04/2004 15:12:26.079
> log ends at: 05/04/2004 15:12:50.111
> number of keepalives: 915
>
> so I think that this is the flood. I know that CCM and phones use
> keepalives but this seems I have a paranoic firmware on phones ;-)
>
>
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso at alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> On Tue, 4 May 2004, Wes Sisk wrote:
>
> > Leo,
> >
> > This is normal. This just means that the CM process on this
> node received a
> > SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> > actively registered to another CM node in the cluster so this
> CM node will
> > basically ignore the message.
> >
> > /Wes
> >
> > > -----Original Message-----
> > > From: cisco-voip-bounces at puck.nether.net
> > > [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of
> Leonardo D'Urso
> > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > To: cisco-voip at puck.nether.net
> > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > >
> > >
> > >
> > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > packets:
> > >
> > > <trace><Date>05/04/2004 15:10:56.514
> > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> Port=6994, Device
> > > Controller=[0,0,0]</info></trace>
> > >
> > > I think this could be related to the flood.
> > >
> > > --
> > > Leonardo D'Urso alter.net Srl
> > > e-mail: durso at alter.it Via Attilio Ambrosini, 177
> > > VOICE: +39-06-5405740 I-00147 Roma
> > > FAX: +39-06-5405883 Italy
> > >
> > > _______________________________________________
> > > cisco-voip mailing list
> > > cisco-voip at puck.nether.net
> > > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
> _______________________________________________
> cisco-voip mailing list
> cisco-voip at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 8
Date: Wed, 5 May 2004 00:02:20 +0200 (CEST)
From: "Leonardo D'Urso" <durso at alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: Wes Sisk <wsisk at cisco.com>
Cc: cisco-voip at puck.nether.net
Message-ID: <Pine.LNX.4.58.0405042340120.18645 at puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
I have received 88236 keepalive package in 190 min, separated by few
milliseconds of gap. That means I have received an average of 232 packets
for every 30 seconds or 464 per minute. This on publisher that is the
secondary server. The primary is the subscriber.
I have 600 phones but up and running around 500. So this seems compliant
to your indication.
So this means that is not a keepalive flood. I'm tring to understand what
a kind of service starts packets like this:
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
IpLen:20
DgmLen:200
Len: 172
80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
consider that the source address is the publisher (secondary server in ccm
cluster) the destination is a cisco ios voice gateway mod. 3745 connected
via wan (MPLS network).
nb. I have used awk,vi and bc for doing calc. My casio calc doesn't
support embedded linux! ;-)
--
Leonardo D'Urso alter.net Srl
e-mail: durso at alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
On Tue, 4 May 2004, Wes Sisk wrote:
> Default is:
> phone KA to active CM: every 30 seconds
> phone KA to backup CM: every 60 seconds.
>
> This is the active server for how many phones?
> This is the backup server for how many phones?
>
> A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
> calculator will help you find your answer.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces at puck.nether.net
> > [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 4:08 PM
> > To: cisco-voip at puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > hi there,
> >
> > log start at: 05/04/2004 15:12:26.079
> > log ends at: 05/04/2004 15:12:50.111
> > number of keepalives: 915
> >
> > so I think that this is the flood. I know that CCM and phones use
> > keepalives but this seems I have a paranoic firmware on phones ;-)
> >
> >
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso at alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > On Tue, 4 May 2004, Wes Sisk wrote:
> >
> > > Leo,
> > >
> > > This is normal. This just means that the CM process on this
> > node received a
> > > SCCP KeepAlive from the device with TCPHandle=000003290. This device
is
> > > actively registered to another CM node in the cluster so this
> > CM node will
> > > basically ignore the message.
> > >
> > > /Wes
> > >
> > > > -----Original Message-----
> > > > From: cisco-voip-bounces at puck.nether.net
> > > > [mailto:cisco-voip-bounces at puck.nether.net]On Behalf Of
> > Leonardo D'Urso
> > > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > > To: cisco-voip at puck.nether.net
> > > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > > >
> > > >
> > > >
> > > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > > packets:
> > > >
> > > > <trace><Date>05/04/2004 15:10:56.514
> > > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive
Timer.
> > > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> > Port=6994, Device
> > > > Controller=[0,0,0]</info></trace>
> > > >
> > > > I think this could be related to the flood.
> > > >
> > > > --
> > > > Leonardo D'Urso alter.net Srl
> > > > e-mail: durso at alter.it Via Attilio Ambrosini, 177
> > > > VOICE: +39-06-5405740 I-00147 Roma
> > > > FAX: +39-06-5405883 Italy
> > > >
> > > > _______________________________________________
> > > > cisco-voip mailing list
> > > > cisco-voip at puck.nether.net
> > > > https://puck.nether.net/mailman/listinfo/cisco-voip
> > >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
debug vpm signal works pretty well
-Mike
------------------------------
Message: 9
Date: Wed, 5 May 2004 06:18:50 -0700
From: "Voll, Scott" <Scott.Voll at wesd.org>
Subject: [cisco-voip] debug isdn q931 --> FXO port
To: <cisco-voip at puck.nether.net>
Message-ID: <407055A92CECCB499C922A2D35FC19A6D9A3ED at apollo.wesd.org>
Content-Type: text/plain; charset="us-ascii"
What command on a FXO V-GW gives me basically the same info as Debug
isdn Q931? I just want to see the call coming into the GW's FXO.
TIA
Scott
------------------------------
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip
End of cisco-voip Digest, Vol 15, Issue 4
*****************************************
More information about the cisco-voip
mailing list