[cisco-voip] 7942 Phone reporting 404 errors

Fri Feb 20 11:46:39 EST 2009

The problem, only 7942G/SCCP shows these Service 404 http error once
every hour. No issues with 7912/7940/7960;

I ran the sniffer trace and found phone was making request for
/CCMCIP/idlelogo.xml. But wait, we aren't using IDLE URL!!!

I then verified the 404 error in Internet Explorer;

Then I checked Enterprise Parameters and did find URL IDEL set! Ooops
where did this come from?!?   They never had a idle URL, so I'm
wondering if this is default in 6.1.2-1000-2 or if customer somehow
added it by accident. They did recently change ip addresses for
CallManager, subscribers, etc. Perhaps when changing ip they deleted the
8080 or added it?

I think the case is closed as I deleted the URL Idle and URL Idle Time
and Saved.  I'll know in 1 hour if the 7942 pops up a 404 message.

My question are why didn't 7940/7960 running SCCP 8.0(8.0) pop up these
404 errors? Why only 7942?

Also should the URL shown below have 8080 in it if they did want a idle
logo?  Is there a factory default idle logo in 6.1(2) or like in 4.1(3)
I have to make a idle logo or use Phone Designer.

System version: 6.1.2.1002-1

Device MAC0021A02D0012

IP Address: 10.2

Load File SCCP42.8.3-4SR1S

App Load ID jar42sccp.8-3-3-17.sbn

JVM Load cvm42sccp.8-3-3-17.sbn

OS Load onu42.8-3-3-17.sbn

Boot Load tnp42.8-3-1-21a.bin

DSP Load dsp42.8-3-3-17.sbn

From: Ryan Ratliff [mailto:rratliff at cisco.com] 
Sent: Thursday, February 12, 2009 11:06 AM
To: Jason Aarons (US)
Cc: Jason Burns; cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

Highly doubtful.  For the phone to event accept an incoming xml request
it has to authenticate the incoming request via the Authentication URL.
This authentication is device-association based so the app sending the
xml request has to know the userid and password of a user that has the
phone associated to it.  Informacast likes to use its own auth URL so
that you don't have to actually associate devices to the informacast
user.

Absent of device association the only time a phone will randomly hit a
web page is an idle URL as Jason pointed out.  

If some of the phones are 3rd gens then you may have luck with getting
console logs from the phone after a 404.   Browse to the IP address of
the phone and you'll see a link for console logs.  Get them all and look
for anything web related.  You'll want to get them relatively close to
the time of the error as there are only a few files kept in the phone's
flash and they aren't very big.

-Ryan

On Feb 12, 2009, at 10:59 AM, Jason Aarons (US) wrote:

That is an interesting note.  I guess some hacker already knows this and
I'm late to the party. They don't have any 3rd party voip applications
like Berbee, etc

I wonder if any type of security scanner like Nmap or GFI could cause
this? 

This could be in an episode of "24" where the firewall is hacked and
Cisco phones start pop-ing up 404 messages and CTU tracks the culprit to
a chemical storage facility in Ohio...

http://en.wikipedia.org/wiki/24_(TV_series)

From: Ryan Ratliff [mailto:rratliff at cisco.com] 
Sent: Thursday, February 12, 2009 10:38 AM
To: Jason Aarons (US)
Cc: Jason Burns; cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

If it's some server in their network hitting the phones with an xml
request shipping it to your site won't do any good.

-Ryan

On Feb 12, 2009, at 10:27 AM, Jason Aarons (US) wrote:

They never setup a idle url, everything was setup for IP addresses in
Enterprise Parameters.

We are shipping a 7942G to our site to run WireShark off back of the
phone.

From: cisco-voip-bounces at puck.nether.net [
mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Jason Burns
Sent: Thursday, February 12, 2009 10:05 AM
To: Ryan Ratliff
Cc: cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

How about the idle url?

On Wed, Feb 11, 2009 at 3:08 PM, Ryan Ratliff <rratliff at cisco.com>
wrote:

It's related in the fact that the phone is trying to access some webpage
that isn't available.

The trick in his case is to find out why and what web page the phone is
trying to hit.

-Ryan

On Feb 11, 2009, at 3:00 PM, Samuel Womack wrote:

Probably not Related to your Issue...but earlier today I saw an Issue
with a 7940 getting a 404 when trying to Access Directories Button...etc
etc.

Previously phone was registered on 4.1.3 system...System Upgraded to
6.1.2....His TFTP Server Was Hard Coded  to a Server that had previously
(pub) DeActivated that Service...URL Strings are Different between 4.1.3
and the Newer Version...Factory Reset Phone (restricted settings on
phone) and Now Directory Works fine....

Again this doesn't even Remotely sound related to ur Scenario other that
the 404 Error...

On Feb 11, 2009, at 1:38 PM, Jason Aarons (US) wrote:

Working on the sniffer trace off back of phone.

The 7942s don't have any services subscribed -jason

From: Ryan Ratliff [mailto:rratliff at cisco.com] 
Sent: Wednesday, February 11, 2009 12:18 PM
To: Jason Aarons (US)
Cc: cisco-voip at puck.nether.net
Subject: Re: [cisco-voip] 7942 Phone reporting 404 errors

Get a packet capture.  Either they are subscribed to some web service or
something is telling the phone to retrieve a web page that is causing
the 404.

-Ryan

On Feb 11, 2009, at 11:34 AM, Jason Aarons (US) wrote:

More details from end user on 7942 issue;

"404 message just pop's up on the phone without user selecting
anything."

From: cisco-voip-bounces at puck.nether.net [
mailto:cisco-voip-bounces at puck.nether.net] On Behalf Of Jason Aarons
(US)
Sent: Wednesday, February 11, 2009 11:22 AM
To: cisco-voip at puck.nether.net
Subject: [cisco-voip] 7942 Phone reporting 404 errors

I have a customer with a new site across WAN using 7942/SCCP series
phones. This new site the users are reporting seeing 404 errors (he
didn't tell me what the users are doing when they see this).  Majority
of phones in cluster are older 7940/7960/7912/SCCP with no problems
reported by users. They are using CallManager 6.1.2

I assume the p7942 hones are registered and can call in/out, but are
getting the 404 when using the Directories or other keys.  The System >
CallManager is configured for IP addresses and not hostnames/dns, as
well as all Enterprise Parameters set to ip addresses.  I'll ask him for
a sniffer capture off back of phone but doubt he can get it -jason

________________________________

Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee,
you are hereby notified that you have received this communication in
error and that any use or reproduction of this email or its contents is
strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.

________________________________

Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee,
you are hereby notified that you have received this communication in
error and that any use or reproduction of this email or its contents is
strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.

_______________________________________________

cisco-voip mailing list

cisco-voip at puck.nether.net

https://puck.nether.net/mailman/listinfo/cisco-voip

________________________________

Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee,
you are hereby notified that you have received this communication in
error and that any use or reproduction of this email or its contents is
strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

________________________________

Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee,
you are hereby notified that you have received this communication in
error and that any use or reproduction of this email or its contents is
strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.

________________________________

Disclaimer: This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the designated
addressee(s) named above only. If you are not the intended addressee,
you are hereby notified that you have received this communication in
error and that any use or reproduction of this email or its contents is
strictly prohibited and may be unlawful. If you have received this
communication in error, please notify us immediately by replying to this
message and deleting it from your computer. Thank you.

-----------------------------------------
Disclaimer:

This e-mail communication and any attachments may contain
confidential and privileged information and is for use by the
designated addressee(s) named above only.  If you are not the
intended addressee, you are hereby notified that you have received
this communication in error and that any use or reproduction of
this email or its contents is strictly prohibited and may be
unlawful.  If you have received this communication in error, please
notify us immediately by replying to this message and deleting it
from your computer. Thank you.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090220/9d2406b6/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 5762 bytes
Desc: image007.jpg
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090220/9d2406b6/attachment.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 15780 bytes
Desc: image008.jpg
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090220/9d2406b6/attachment-0001.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 11934 bytes
Desc: image010.jpg
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090220/9d2406b6/attachment-0002.jpe>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 38736 bytes
Desc: image011.jpg
URL: <https://puck.nether.net/pipermail/cisco-voip/attachments/20090220/9d2406b6/attachment-0003.jpe>