[cisco-voip] RTP arriving early generating ICMP unreachable

[Wes Sisk]

inline, ws.

On Tuesday, May 18, 2010 7:04:31 AM, Dale Shaw 
<dale.shaw+cisco-voip at gmail.com> wrote:
> [ probably should've marked this thread 'OT' ]
>
> Thanks to Nick and Wes for their replies.
>
> Keeping the original scenario in mind, I'm curious what the audience
> thinks of the behaviour described in this Juniper KB article:
>
> http://kb.juniper.net/index?page=content&id=KB16823
>
> ..what would you expect the impact of this behaviour to be in your networks?
>   
ws: juniper behaves as I would expect.  if implemented by the protocols 
the firewall is correct in closing the port.
> I guess what I'm trying to gauge is, how common is the 'early RTP'
> situation in real, properly tuned networks (Nick and Wes's replies
> indicate it can be 'normal'), 
ws: not particularly common, but it does happen.  And since it does 
happen we have to address it so "the network works".
> and how much sense does it make for the
> Juniper SRX routers to respond the way described in the article linked
> above?
>
>   
ws: IMHO it is valid response.  The endpoint really should be a more 
responsible network participant.
> cheers,
> Dale
> (bitten! ;-))
>
> On Tue, May 18, 2010 at 7:49 AM, Dale Shaw
> <dale.shaw+cisco-voip at gmail.com> wrote:
>   
>> Hi,
>>
>> Disclaimer: The scenario I describe below is not present in a Cisco
>> deployment -- at the moment I'm just trying to get a feel from this
>> audience for how normal (or not) this behaviour is in other voice over
>> IP environments.
>>
>> I'm investigating a situation at the moment where IP phones are
>> generating an ICMP unreachable (destination port unreachable) packet
>> on receipt of the first RTP packet during voice mail access.
>>
>> To me, it indicates a signalling timing/sequencing problem -- the
>> phone is indicating it wasn't yet ready to process RTP and effectively
>> wasn't listening. A very short time later, RTP begins flowing
>> bi-directionally and everything is OK.
>>
>> Is there a generic explanation for this behaviour? Is it 'normal'? If
>> you saw this in your network, would you investigate and tune?
>>
>> cheers,
>> Dale
>>