[cisco-voip] What debug should I be looking at..

[Wes Sisk]

Ed,

Definitely looks like something suspicious in TCP.  A packet capture would be very helpful.

Example:
Syslogs.txt:47: VoiceGateway 1517086: Nov  1 15:19:00: TCB68A623F8 setting property TCP_NONBLOCKING_READ (14) 688A4118
Syslogs.txt:48: VoiceGateway 1517137: Nov  1 15:20:00: TCP0: keepalive timeout (0/4)
Syslogs.txt:49: VoiceGateway 1517177: Nov  1 15:21:00: TCP0: keepalive timeout (0/4)
Syslogs.txt:50: VoiceGateway 1517230: Nov  1 15:22:00: TCP0: keepalive timeout (0/4)
Syslogs.txt:54: VoiceGateway 1517233: Nov  1 15:22:01: TCP0: state was ESTAB -> CLOSEWAIT [28020 -> CUCM-SUB-A(2000)]

Looks like IOS is setting up this TCP session with TCP keepalive enabled.  TCP Keepalive is different from SCCP keepalive.  You see here that the TCP keepalive is is not ACK'd and this eventually leads to session abort.

Regards,
Wes


On Nov 3, 2011, at 8:57 AM, Ed Leatherman wrote:

Attached zip file of debugs w/ the tcp transaction over about an hour.

I've filtered out a TON of "TCP0: ACK timeout timer expired" messages,
and some setting "TCP_TOS Properties" messages.

This was over a 1 hour period, the only sccp profile that gets
mentioned in the sccp debugs is 888 which is the conference bridge -
also looks like that is application type 3.
Looks like a lot of keep alive time-outs for application types 2 and 3.

Not knowing anything more about interpreting the syslog messages, I
would guess that the gateway is not getting keepalives in a timely
fashion from CM and is initiating the switch itself. The same device
also has 6 MGCP controlled PRI's, seems odd that connectivity for
those is not a problem (as far as I can tell).

Still trying to arrange a packet cap at the gateways.

> 
> On Mon, Oct 31, 2011 at 5:08 PM, Wes Sisk <wsisk at cisco.com> wrote:
>> Thanks Ed,
>> 
>> Can you grab these debugs as well:
>> debug sccp message
>> debug sccp event
>> debug ip tcp transaction
>> 
>> deb ip tcp trans can be busy if this box terminates or originates many TCP sessions.  Use with caution.
>> 
>> Regards,
>> Wes
>> 




-- 
Ed Leatherman
<Syslogs.zi_>