[cisco-voip] 7942 Phone reporting 404 errors

Thu Feb 12 11:05:44 EST 2009

Highly doubtful.  For the phone to event accept an incoming xml  
request it has to authenticate the incoming request via the  
Authentication URL.   This authentication is device-association based  
so the app sending the xml request has to know the userid and  
password of a user that has the phone associated to it.  Informacast  
likes to use its own auth URL so that you don't have to actually  
associate devices to the informacast user.

Absent of device association the only time a phone will randomly hit  
a web page is an idle URL as Jason pointed out.

If some of the phones are 3rd gens then you may have luck with  
getting console logs from the phone after a 404.   Browse to the IP  
address of the phone and you'll see a link for console logs.  Get  
them all and look for anything web related.  You'll want to get them  
relatively close to the time of the error as there are only a few  
files kept in the phone's flash and they aren't very big.

-Ryan

On Feb 12, 2009, at 10:59 AM, Jason Aarons (US) wrote:

That is an interesting note.  I guess some hacker already knows this  
and I’m late to the party. They don’t have any 3rd party voip  
applications like Berbee, etc

I wonder if any type of security scanner like Nmap or GFI could cause  
this?

This could be in an episode of “24” where the firewall is hacked and  
Cisco phones start pop-ing up 404 messages and CTU tracks the culprit  
to a chemical storage facility in Ohio…

http://en.wikipedia.org/wiki/24_(TV_series)

From: Ryan Ratliff [mailto:rratliff at cisco.com]
Sent: Thursday, February 12, 2009 10:38 AM
To: Jason Aarons (US)
Cc: Jason Burns; cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

If it's some server in their network hitting the phones with an xml  
request shipping it to your site won't do any good.

-Ryan

On Feb 12, 2009, at 10:27 AM, Jason Aarons (US) wrote:

They never setup a idle url, everything was setup for IP addresses in  
Enterprise Parameters.

We are shipping a 7942G to our site to run WireShark off back of the  
phone.

From: cisco-voip-bounces at puck.nether.net [mailto:cisco-voip- 
bounces at puck.nether.net] On Behalf Of Jason Burns
Sent: Thursday, February 12, 2009 10:05 AM
To: Ryan Ratliff
Cc: cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

How about the idle url?
On Wed, Feb 11, 2009 at 3:08 PM, Ryan Ratliff <rratliff at cisco.com>  
wrote:
It's related in the fact that the phone is trying to access some  
webpage that isn't available.

The trick in his case is to find out why and what web page the phone  
is trying to hit.

-Ryan

On Feb 11, 2009, at 3:00 PM, Samuel Womack wrote:

Probably not Related to your Issue...but earlier today I saw an Issue  
with a 7940 getting a 404 when trying to Access Directories  
Button...etc etc.

Previously phone was registered on 4.1.3 system...System Upgraded to  
6.1.2....His TFTP Server Was Hard Coded  to a Server that had  
previously (pub) DeActivated that Service...URL Strings are Different  
between 4.1.3 and the Newer Version...Factory Reset Phone (restricted  
settings on phone) and Now Directory Works fine....

Again this doesn't even Remotely sound related to ur Scenario other  
that the 404 Error...

On Feb 11, 2009, at 1:38 PM, Jason Aarons (US) wrote:

Working on the sniffer trace off back of phone.

The 7942s don't have any services subscribed -jason

From: Ryan Ratliff [mailto:rratliff at cisco.com]
Sent: Wednesday, February 11, 2009 12:18 PM
To: Jason Aarons (US)
Cc: cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

Get a packet capture.  Either they are subscribed to some web service  
or something is telling the phone to retrieve a web page that is  
causing the 404.

-Ryan

On Feb 11, 2009, at 11:34 AM, Jason Aarons (US) wrote:

More details from end user on 7942 issue;

"404 message just pop's up on the phone without user selecting  
anything."

From: cisco-voip-bounces at puck.nether.net [mailto:cisco-voip- 
bounces at puck.nether.net] On Behalf Of Jason Aarons (US)
Sent: Wednesday, February 11, 2009 11:22 AM
To: cisco-voip at puck.nether.net
Subject: [cisco-voip] 7942 Phone reporting 404 errors

I have a customer with a new site across WAN using 7942/SCCP series  
phones. This new site the users are reporting seeing 404 errors (he  
didn't tell me what the users are doing when they see this).   
Majority of phones in cluster are older 7940/7960/7912/SCCP with no  
problems reported by users. They are using CallManager 6.1.2

I assume the p7942 hones are registered and can call in/out, but are  
getting the 404 when using the Directories or other keys.  The System  
 > CallManager is configured for IP addresses and not hostnames/dns,  
as well as all Enterprise Parameters set to ip addresses.  I'll ask  
him for a sniffer capture off back of phone but doubt he can get it - 
jason

Disclaimer: This e-mail communication and any attachments may contain  
confidential and privileged information and is for use by the  
designated addressee(s) named above only. If you are not the intended  
addressee, you are hereby notified that you have received this  
communication in error and that any use or reproduction of this email  
or its contents is strictly prohibited and may be unlawful. If you  
have received this communication in error, please notify us  
immediately by replying to this message and deleting it from your  
computer. Thank you.

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Disclaimer: This e-mail communication and any attachments may contain  
confidential and privileged information and is for use by the  
designated addressee(s) named above only. If you are not the intended  
addressee, you are hereby notified that you have received this  
communication in error and that any use or reproduction of this email  
or its contents is strictly prohibited and may be unlawful. If you  
have received this communication in error, please notify us  
immediately by replying to this message and deleting it from your  
computer. Thank you.

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Disclaimer: This e-mail communication and any attachments may contain  
confidential and privileged information and is for use by the  
designated addressee(s) named above only. If you are not the intended  
addressee, you are hereby notified that you have received this  
communication in error and that any use or reproduction of this email  
or its contents is strictly prohibited and may be unlawful. If you  
have received this communication in error, please notify us  
immediately by replying to this message and deleting it from your  
computer. Thank you.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090212/4a9d465b/attachment.html>