| 00:07.18 | *** join/#asterisk dovid (~dovid@ool-4573a525.dyn.optonline.net) |
| 00:15.24 | *** join/#asterisk infernix (~nix@unaffiliated/infernix) |
| 00:18.09 | *** join/#asterisk jormun (~jgrow@67-132-128-141.dia.static.qwest.net) |
| 00:23.19 | *** part/#asterisk kharwell (kharwell@nat/digium/x-ylkqbuppxnohefbr) |
| 00:42.29 | *** join/#asterisk cresl1n (~Adium@asterisk/libpri-and-libss7-expert/Cresl1n) |
| 00:42.29 | *** mode/#asterisk [+o cresl1n] by ChanServ |
| 00:53.18 | [TK]D-Fender | dmasiero, not possible |
| 01:00.25 | *** join/#asterisk shootbird (~quassel@beepbeep.serverpit.com) |
| 01:16.37 | *** join/#asterisk fstd (~fstd@unaffiliated/fisted) |
| 01:18.44 | *** part/#asterisk boson (~boson@cpe-174-100-64-46.neo.res.rr.com) |
| 01:47.21 | *** join/#asterisk cresl1n (~Adium@asterisk/libpri-and-libss7-expert/Cresl1n) |
| 01:47.21 | *** mode/#asterisk [+o cresl1n] by ChanServ |
| 01:48.59 | *** join/#asterisk pjm (~pjm_freen@uhfsatcom.plus.com) |
| 02:07.44 | Mango45 | same => n,Playback(${IF($["${X-Spam-Score}">="66"]?beep:beeperr)}) |
| 02:08.14 | Mango45 | This works from 66 to 99. If the variable is 100, it plays beeperr. |
| 02:08.34 | Mango45 | Why is this? |
| 02:12.05 | Akari | Don't use quotes |
| 02:12.14 | Mango45 | Then it fails if the variable is undefined. |
| 02:12.16 | Akari | Or you'll interpret the numbers as an ASCII string |
| 02:12.23 | Akari | Which is definitely not what you want |
| 02:12.39 | Mango45 | Ah, so it's sorting it based on the first number only. |
| 02:13.00 | Akari | It's kind of complicated. Just don't use quotes. |
| 02:15.44 | Mango45 | same => n,Set(X-Spam-Score=${IF($[${LEN(${X-Spam-Score})} > 0]?${X-Spam-Score}:0)}) |
| 02:16.03 | Mango45 | If the variable is undefined, assume it's 0. Any better way than that? |
| 02:35.24 | Akari | You could just set it to 0 some point prior to its assignment of a non-zero value. |
| 02:38.19 | Mango45 | Thanks. |
| 02:43.32 | *** join/#asterisk dovid (~dovid@ool-4573a525.dyn.optonline.net) |
| 03:45.41 | drmessano | Anyone have a good list of Canadian ITSPs? Asking for a friend. |
| 03:46.14 | Mango45 | What are the specifications for your project? |
| 03:46.52 | drmessano | Relocation |
| 03:47.05 | Mango45 | Heh. |
| 03:47.34 | Mango45 | We have many good ITSPs, but you may also stay home and be the change you wish to see in America. |
| 03:47.59 | drmessano | I think he's already packed |
| 03:48.57 | drmessano | You know.. I just got this great idea |
| 03:49.28 | drmessano | I should sign up for Les.net again or something.. offer free calling to Canada "Reconnect with your liberal loved ones" |
| 03:49.49 | *** join/#asterisk rpifan (~rpi@73.106.75.141) |
| 03:50.15 | drmessano | Samot: Dude.. |
| 04:27.21 | *** join/#asterisk sekil (~sekil@89.216.230.213) |
| 04:41.18 | *** join/#asterisk captain118 (uid167508@gateway/web/irccloud.com/x-idshgwhyqkgiwwqw) |
| 05:01.47 | *** join/#asterisk anthm (~anthm@freeswitch/developer/anthm) |
| 05:16.06 | *** join/#asterisk jeffspeff (~Jeff@209.141.208.197) |
| 05:40.20 | *** join/#asterisk evil_gordita (robert@ip70-188-41-127.rn.hr.cox.net) |
| 06:10.49 | *** join/#asterisk miralin (~Thunderbi@195.19.212.23) |
| 06:11.30 | *** join/#asterisk bof22 (~Thunderbi@ARennes-650-1-165-208.w92-135.abo.wanadoo.fr) |
| 06:39.14 | *** join/#asterisk ixyd (~denzs@b2b-46-252-133-250.unitymedia.biz) |
| 06:54.43 | *** join/#asterisk bof22 (~Thunderbi@185.13.183.107) |
| 07:15.23 | jeffspeff | why wouldn't the pjsip auth challenge show in a tcpdump being sent to the phone in reply to a register request, but the challenge does show in the pjsip debug log. |
| 07:39.14 | *** join/#asterisk pppingme (~pppingme@unaffiliated/pppingme) |
| 08:03.23 | *** join/#asterisk jkroon (~jkroon@dustpuppy.is.co.za) |
| 08:05.40 | *** join/#asterisk tzafrir (~tzafrir@local.xorcom.com) |
| 08:15.25 | *** join/#asterisk pchero_work (~pchero@109.70.54.56) |
| 08:18.14 | *** join/#asterisk pjm (~pjm_freen@uhfsatcom.plus.com) |
| 08:56.03 | *** join/#asterisk Chainsaw (~chainsaw@gentoo/developer/chainsaw) |
| 08:58.04 | Akari | Does your device support quantum teleportation? |
| 09:14.58 | *** join/#asterisk mirela666 (~mirkob@2a00:1950:400:0:e4eb:d6e1:f0a8:a0c6) |
| 09:19.33 | TandyUK | or its using TLS, and he was looking at 5060 not 5061 |
| 09:25.07 | *** join/#asterisk cmendes0101 (~cmendes01@47-144-223-7.lsan.ca.frontiernet.net) |
| 09:31.05 | *** join/#asterisk dovid (~dovid@ool-4573a525.dyn.optonline.net) |
| 09:31.39 | *** join/#asterisk miralin (~Thunderbi@195.19.212.23) |
| 09:38.32 | *** join/#asterisk evil_gordita (robert@ip70-188-41-127.rn.hr.cox.net) |
| 09:49.33 | *** join/#asterisk ixyd (~denzs@carbon.gonicus.de) |
| 09:59.22 | *** join/#asterisk Tiffon (~name@unaffiliated/tiff0n) |
| 10:08.59 | *** join/#asterisk M2K_ (5188f485@gateway/web/freenode/ip.81.136.244.133) |
| 10:09.08 | M2K_ | Hello everyone |
| 10:13.00 | *** join/#asterisk M2K__ (5188f485@gateway/web/freenode/ip.81.136.244.133) |
| 10:19.19 | *** join/#asterisk thiagoc (~thiagoc@unaffiliated/thiagoc) |
| 10:26.05 | *** join/#asterisk cmendes0101 (~cmendes01@47-144-223-7.lsan.ca.frontiernet.net) |
| 10:51.22 | *** join/#asterisk pdugas (~retentive@2001:558:6011:71:3d78:26dd:beb:dc2) |
| 11:09.46 | *** join/#asterisk clopez (~tau@neutrino.es) |
| 11:16.11 | *** join/#asterisk Dunsy (~martin.du@185.28.212.96) |
| 11:33.42 | *** join/#asterisk Dunsy (~Dunsy@185.28.212.96) |
| 11:39.10 | *** join/#asterisk miralin (~Thunderbi@195.19.212.23) |
| 12:09.48 | *** join/#asterisk Dunsy (~Dunsy@185.28.212.96) |
| 12:42.46 | jkroon | [Nov 9 10:45:30] WARNING[19152][C-00031fd9] chan_sip.c: Received response: "200 OK" from 'Doryoku' without SDP |
| 12:42.57 | jkroon | we're seeing a lot of that currently, all the endpoints are Huawei routers. |
| 12:44.15 | jkroon | Asterisk 11.21.1 - which we've been running since Feb. |
| 12:44.37 | jkroon | is anybody aware of some Firmware update or something to Huawei devices that introduced this braindead behaviour? |
| 12:55.53 | WIMPy | Switches or IADs? |
| 13:11.27 | *** join/#asterisk newtonr (~newtonr@173-17-133-211.client.mchsi.com) |
| 13:11.27 | *** mode/#asterisk [+o newtonr] by ChanServ |
| 13:21.05 | *** join/#asterisk Conradb (~Malideath@uls-154-73-35-201.wall.uls.co.za) |
| 13:24.37 | jkroon | IADs? We've got some Huawei based LTE routers that also act as a SIP client (basically SIP2FXS). |
| 13:24.45 | jkroon | these are responding with 200 OK but no SDP. |
| 13:24.55 | jkroon | trying to get hold of the exact models now ... |
| 13:25.34 | WIMPy | No SDP before, either? |
| 13:26.29 | jkroon | client reconnected a different device so can't check at the moment - the tech that did the initial check didn't bother to check, but I assume asterisk will re-use previous (180 / 183) SDP if it was received rather than just dropping the call. |
| 13:27.05 | jkroon | will revert with details as soon as I have it. |
| 13:29.16 | mmlj4 | revert? that's an Indian HR term, isn't it? |
| 13:30.10 | jkroon | hahaha, it's actually proper english but ok "I will get back to you with more details..." |
| 13:30.46 | jkroon | tech says it worked until recently, in the last two months, seeing that my last asterisk upgrade was in Feb ... |
| 13:32.48 | WIMPy | That's the good thing about SIP. You don't have to do anything to suddenly make it fail after it warked for some longer time. |
| 13:39.42 | jkroon | something changed. somewhere. silent updates on routers are both awesome and really crap. |
| 13:39.57 | *** join/#asterisk [TK]D-Fender (~joe@216-191-106-165.dedicated.allstream.net) |
| 14:07.21 | *** join/#asterisk brad_mssw (~brad@66.129.88.50) |
| 14:20.39 | defswork | hi - if I have a remote * server and extensions connecting via nat to it, how can I tell * to allow 2 extensions calling each other on the same private subnet to do directmedia ? |
| 14:22.57 | *** join/#asterisk putnopvut (putnopvut@asterisk/master-of-queues/mmichelson) |
| 14:22.58 | *** mode/#asterisk [+o putnopvut] by ChanServ |
| 14:25.04 | *** join/#asterisk topro (~prousa@p578af414.dip0.t-ipconnect.de) |
| 14:25.20 | jkroon | ICE? |
| 14:28.02 | *** join/#asterisk miralin (~Thunderbi@195.19.212.23) |
| 14:28.04 | igcewieling | defswork: sip.conf.sample talks about that. |
| 14:28.18 | igcewieling | (assuming chan_sip, not chan_pjsip) |
| 14:28.33 | *** join/#asterisk cmendes0101 (~cmendes01@47-144-223-7.lsan.ca.frontiernet.net) |
| 14:30.40 | defswork | shame - this is a server running 1.4 :) |
| 14:30.53 | defswork | not mine I hasten to add |
| 14:52.24 | *** join/#asterisk tuxian (~tuxian@igilmour.plus.com) |
| 15:03.47 | *** join/#asterisk dovid (~dovid@ool-3f8feefb.dyn.optonline.net) |
| 15:09.26 | *** join/#asterisk kharwell (kharwell@nat/digium/x-dzquehfgltcfamfq) |
| 15:09.26 | *** mode/#asterisk [+o kharwell] by ChanServ |
| 15:33.08 | *** join/#asterisk sh_smith (~sh_smith@cpe-76-174-26-91.socal.res.rr.com) |
| 15:58.40 | *** join/#asterisk newtonr (RustyNewto@nat/digium/x-nlrkeftwcbubypsg) |
| 15:58.40 | *** mode/#asterisk [+o newtonr] by ChanServ |
| 15:58.41 | *** join/#asterisk rmudgett (rmudgett@nat/digium/x-vsnbzgxdhteilyob) |
| 15:58.41 | *** mode/#asterisk [+o rmudgett] by ChanServ |
| 16:21.37 | *** join/#asterisk polysics (~polysics@88.147.12.181) |
| 16:22.06 | polysics | hello! |
| 16:29.37 | *** join/#asterisk cmendes0101 (~cmendes01@47-144-223-7.lsan.ca.frontiernet.net) |
| 16:36.38 | polysics | does RTCP have to be enabled somehow on Asterisk 1.8 so it sends data on media port + 1? |
| 16:38.55 | polysics | do I need to enable sIP debugging in the console? |
| 16:43.15 | *** join/#asterisk Oatmeal (~Suzeanne@2602:306:3676:c60:e178:c3dc:85e8:f2f0) |
| 16:47.59 | igcewieling | I doubt anyone is going to help with Asterisk 1.4 |
| 17:00.09 | Samot | Or 1.8. |
| 17:00.50 | *** join/#asterisk Oatmeal (~Suzeanne@2602:306:3676:c60:f5f4:be4c:e477:77f9) |
| 17:05.43 | *** join/#asterisk shootbird (~quassel@beepbeep.serverpit.com) |
| 17:07.10 | [TK]D-Fender | Almost tehre on 11 too |
| 17:07.17 | [TK]D-Fender | it's SFO |
| 17:11.23 | igcewieling | I can live with SFO until Asterisk 15 is stable. |
| 17:11.33 | igcewieling | Asterisk 11 being SFO |
| 17:13.35 | [TK]D-Fender | gave up completely on 13 have you? |
| 17:13.46 | [TK]D-Fender | Seems hasty |
| 17:25.51 | *** join/#asterisk TandyUK (~admin@2a02:13a0:a006:1:b4f8:8786:220b:5d0f) |
| 17:29.56 | *** join/#asterisk Aboba (~Bob@node-1w7jr9sqc1awywruc1obahkpp.ipv6.telus.net) |
| 17:30.54 | *** join/#asterisk miralin (~Thunderbi@194.8.128.48) |
| 17:32.39 | *** join/#asterisk defsdoor (~andy@cpc35-sutt4-2-0-cust184.19-1.cable.virginm.net) |
| 18:07.37 | *** join/#asterisk jeffspeff (~Jeff@12.49.160.131) |
| 18:10.54 | jeffspeff | having an odd issue with pjsip on a new setup. server receives register request from phone (this is seen in the debug log and tcpdump) then asterisk sends the auth challenge (this is only shown in the debug logs, but does not appear in packet capture on the server or client side). |
| 18:11.59 | igcewieling | [TK]D-Fender: I think I should skip the first LTS release with chan_pjsip. |
| 18:15.33 | [TK]D-Fender | 13 is getting feature enhancements, and 12 was the actual introduction version. You might as well say wait for the 3rd LTS |
| 18:23.12 | *** join/#asterisk Echo6 (~Echo6@64.136.247.50) |
| 18:24.12 | [TK]D-Fender | igcewieling, besides which ... 11 goes EOL in >1y and you don't HAVE to use PJSIP if you don't want to anyway |
| 18:24.20 | [TK]D-Fender | igcewieling, So holding back is kinda neurotic |
| 18:25.53 | igcewieling | maybe so, but that is what I plan on doing. |
| 18:27.00 | Echo6 | hey, does anyone know a command to upgrade asterisk or know a good guide for it? |
| 18:27.10 | [TK]D-Fender | Well you'll be on a version that will be EOL long before that happens, and for no good reason. By all means... |
| 18:27.15 | Echo6 | I'm interest in upgrading my screw around box. |
| 18:27.19 | [TK]D-Fender | Echo6, There is no "command" |
| 18:27.21 | jeffspeff | i'm updating from 13.12.1 to 14.1.1 in hopes that my issue is resolved |
| 18:27.25 | [TK]D-Fender | You install over it. |
| 18:27.41 | [TK]D-Fender | flush the modules folder if you're jumping branches |
| 18:27.42 | Echo6 | kk. So I download source again and recompile? |
| 18:27.47 | Echo6 | kk |
| 18:28.00 | Echo6 | Will do. I have a snapshot just in case it goes horribly wrong. |
| 18:28.13 | [TK]D-Fender | There wasn't a singular command when you did it the first time.. there isn't one to upgrade it after |
| 18:29.13 | Echo6 | I knew there wasn't when I installed it I just didn't know if there was for the upgrade. I have been at a higher level with asterisk for years and have been working on getting on a more directly level with it over the last year or so. |
| 18:29.56 | *** join/#asterisk jkroon (~jkroon@105.11.225.226) |
| 18:47.40 | *** join/#asterisk miralin (~Thunderbi@194.8.128.48) |
| 19:02.06 | jeffspeff | here is the debug log, packet capture and all of my configs. any assistance with the issue i posted above about pjsip would be greatly appreciated. https://gist.github.com/jeffclay/b87831824d225db01ebe73c8b38ac3e8 |
| 19:18.15 | *** join/#asterisk tirej (~tirej@unaffiliated/tirej) |
| 19:22.29 | *** join/#asterisk noir_dev (91f9ba2c@gateway/web/freenode/ip.145.249.186.44) |
| 19:23.33 | Samot | There's no reply to the auth challenge? |
| 19:23.38 | *** part/#asterisk noir_dev (91f9ba2c@gateway/web/freenode/ip.145.249.186.44) |
| 19:24.23 | *** join/#asterisk tuxian_ (~tuxian@194.12.3.78) |
| 19:29.49 | jeffspeff | Samot if you look at the sngrep capture, the auth challenge is never seen on the network. that capture was running on the server and capturing any interface. same results with tcpdump |
| 19:30.13 | Samot | On Asterisk? |
| 19:30.28 | Samot | The 401 Unauthorized reply to the REGISTER is the auth challenge. |
| 19:30.35 | jeffspeff | right |
| 19:30.46 | Samot | The endpoint should be sending back another REGISTER with auth-digest as a response. |
| 19:30.51 | Samot | I do not see that response. |
| 19:30.56 | jeffspeff | that challenge packet should be seen in a packet capture running on the asterisk server shouldn't it? |
| 19:31.06 | Samot | It is. |
| 19:31.08 | Samot | It's the 401 |
| 19:31.22 | jeffspeff | that's seen in the pjsip debug log, but not in any packet captures |
| 19:31.30 | Samot | <--- Transmitting SIP response (531 bytes) to UDP:PHONE.PUB.IP:51176 ---> |
| 19:31.31 | Samot | SIP/2.0 401 Unauthorized |
| 19:31.41 | Samot | ^ That is the challenge. |
| 19:31.46 | Samot | From Asterisk to the endpoint. |
| 19:31.57 | Samot | Your endpoint should respond to it. |
| 19:32.12 | jeffspeff | should that challenge be seen in a packet capture on the server? |
| 19:32.25 | Samot | If the it receives a reply from the endpoint. |
| 19:32.31 | Samot | If it doesn't receive a reply, why would it be there? |
| 19:32.47 | Samot | Asterisk is waiting for a reply. |
| 19:33.05 | Samot | If that's all there is to the debug, then no reply was received. |
| 19:34.35 | jeffspeff | asterisk logs shows that it sends the challenge. packet captures on the same machine don't show that outbound packet leaving the server |
| 19:34.44 | jeffspeff | packet captures don't show that packet existing at all |
| 19:35.37 | Samot | sip set debug on is a packet capture.. |
| 19:35.46 | [TK]D-Fender | So is tcpdump |
| 19:35.51 | Samot | Its showing the packets entering and leaving the system. |
| 19:35.58 | Samot | So show a tcpdump then. |
| 19:36.02 | jeffspeff | then why is it that tcpdump and pjsip debug show different things? |
| 19:36.04 | [TK]D-Fender | And since you're wondering about packets ... where's the FIREWALL DUMP? |
| 19:36.15 | jeffspeff | firewall is iptables and it is off |
| 19:36.21 | [TK]D-Fender | <jeffspeff> then why is it that tcpdump and pjsip debug show different things? <- where do we see that in parallel? |
| 19:36.32 | *** join/#asterisk tuxian_ (~tuxian@igilmour.plus.com) |
| 19:36.36 | [TK]D-Fender | <jeffspeff> firewall is iptables and it is off <- I like proof I can see |
| 19:36.54 | [TK]D-Fender | and where IP's aren't masked and can be trace dto see if something isn't sane |
| 19:37.34 | jeffspeff | ok, just a sec. i'll show tcpdump and unsanitized info |
| 19:40.22 | *** join/#asterisk tzafrir (~tzafrir@bzq-82-81-175-197.red.bezeqint.net) |
| 19:43.43 | jeffspeff | Samot [TK]D-Fender https://gist.github.com/jeffclay/ea74426d3f3cb9ec30204c3f0111f2ed |
| 19:44.42 | Samot | You're not responding to the auth challenges correctly. |
| 19:45.09 | Samot | Actually... |
| 19:46.00 | jeffspeff | 10.200.101.116 is the endpoint private IP. 12.49.160.131 is the endpoint public ip. 104.197.69.7 the servers public ip. |
| 19:49.48 | *** join/#asterisk cmendes0101 (~cmendes01@47-144-223-7.lsan.ca.frontiernet.net) |
| 19:53.58 | jeffspeff | any ideas why tcpdump and pjsip debug don't agree on what is being sent? |
| 19:57.13 | [TK]D-Fender | Where do I see the tcpdump? |
| 19:57.39 | Samot | It's in there. |
| 19:57.41 | Samot | At the bottom |
| 19:59.40 | *** join/#asterisk shootbird (~quassel@beepbeep.serverpit.com) |
| 19:59.43 | *** join/#asterisk friedrich (~friedrich@aextron.de) |
| 20:00.07 | [TK]D-Fender | iptables --list |
| 20:00.21 | [TK]D-Fender | Regardless of what some service seems to say I want proof of empty |
| 20:00.51 | Echo6 | is Asterisk 14 a no no? |
| 20:01.04 | Echo6 | Everything I'm finding is focused on 13 |
| 20:01.21 | Samot | Asterisk 14 was just released last month |
| 20:02.00 | jeffspeff | [TK]D-Fender gist has been updated to show iptables --list |
| 20:02.27 | Echo6 | Ahhhh... So probably best to stay away for a while. |
| 20:06.04 | Samot | Or there could be some DNS issues.. |
| 20:06.05 | Samot | devast.c.cnp1-143601.internal.58278 > metadata.google.internal.domain: [bad udp cksum 0x5ec3 -> 0x10a5!] 8152+ A? metadata.google.internal. (42) |
| 20:06.14 | *** join/#asterisk kfife (~Miranda@home.chicagoventure.com) |
| 20:07.54 | *** join/#asterisk miralin (~Thunderbi@194.8.128.48) |
| 20:07.55 | Samot | 12.49.160.131.50572 > devast.c.cnp1-143601.internal.sip: [udp sum ok] SIP, length: 525 |
| 20:07.57 | jeffspeff | Samot that's just some backend stuff from using google cloud to host the server. the packets after that show the udp chksum ok. also, none of my asterisk configs use fqdn's, it's all ip addresses |
| 20:08.19 | Samot | Well your tcpdump is not using IPs. |
| 20:08.46 | jeffspeff | i left off the -n flag |
| 20:12.57 | kfife | If I want to an ordinary call to be converted to a ConfBridge instance, is there a better way to do it than to use the G() option in the Dial() application? |
| 20:16.27 | robmal | ChannelRedirect? |
| 20:17.12 | kfife | hmmm.... |
| 20:17.54 | robmal | same => n,ChannelRedirect(${BRIDGEPEER},conference-user,${ConfNo},1) |
| 20:17.57 | robmal | Like this. |
| 20:19.01 | kfife | Good suggestion. |
| 20:20.34 | kfife | me: tips hat |
| 20:20.38 | kfife | tips hat |
| 20:20.41 | kfife | :-) |
| 20:25.38 | *** join/#asterisk Cory (~Cory@unaffiliated/cory) |
| 20:34.25 | Akari | jeffspeff: It looks to me like you're sending your responses out of a different interface. |
| 20:34.42 | jeffspeff | Akari what makes you think that? |
| 20:34.55 | Akari | tcpdump doesn't capture on all interfaces. It selects the interface with the lowest number by default. |
| 20:35.04 | Akari | And you're receiving packets but not sending them. |
| 20:35.36 | Akari | Try -i any |
| 20:35.53 | jeffspeff | k |
| 20:37.16 | jeffspeff | Akari that shows the same results |
| 20:37.34 | jeffspeff | only register packets |
| 20:40.39 | Akari | Do you have fail2ban or something similar installed? |
| 20:44.10 | jeffspeff | no |
| 20:45.22 | kfife | what about Fail2Capture? :-) |
| 20:47.15 | *** topic/#asterisk by gtjoseph -> #asterisk The Open Source PBX and Telephony Platform (asterisk.org) -=- LTS: 13.12.2 (2016/11/10), 11.24.1 (2016/10/27), Standard: 14.1.2 (2016/11/10); DAHDI: DAHDI-linux 2.11.1 (2016/03/01), DAHDI-tools 2.11.1 (2016/03/01); libpri 1.5.0 (2016/03/28) -=- Wiki: wiki.asterisk.org -=- Code of Conduct: bit.ly/1hH6P22 -=- Logs: bit.ly/1s4AKKu |
| 20:47.26 | *** join/#asterisk dovid (~dovid@ool-3f8fece0.dyn.optonline.net) |
| 20:49.10 | jeffspeff | kfife what is that? |
| 20:51.25 | Akari | No as in "you just checked" or no as in "not to your knowledge" |
| 20:52.05 | jeffspeff | i just checked to confirm that i never installed fail2ban |
| 20:52.21 | jeffspeff | yum shows it as an available package |
| 20:52.31 | igcewieling | why not capture from an external host? |
| 20:52.54 | igcewieling | (using a mirror port on a switch, of course) |
| 20:52.56 | Akari | okie |
| 20:53.21 | jeffspeff | it's a remote vm |
| 20:53.47 | Akari | It's likely some kind of firewall on the box, would be my guess. |
| 20:54.20 | Akari | Especially if you can ping the remote phone's IP address? |
| 20:54.35 | jeffspeff | firewalld is not installed. iptables is disabled |
| 20:55.15 | jeffspeff | i can ping the endpoint from the server |
| 20:55.44 | jeffspeff | if it were a firewall i would still the packets in a packet capture running on the server |
| 20:58.12 | igcewieling | sounds like a nat'ish issue |
| 20:58.53 | jeffspeff | igcewieling do you see any nat issues in my config or pjsip debug info? |
| 20:59.19 | Samot | jeffspeff: tcpdump -nqt -s 0 -A -i eth0 port 5060 and host 104.197.69.7 |
| 20:59.23 | Samot | Clean up the output a bit with that |
| 20:59.35 | Samot | if you're using PJSIP on other port, change 5060 to that. |
| 20:59.35 | igcewieling | I'm not going to dig through your debug. I'm just saying that when you start saying things like "that is really weird" in VoIP, it usually means a NAT issue. |
| 21:00.20 | jeffspeff | igcewieling even if were a nat issue and asterisk was sending the packet to some random address, i should still see that traffic in a tcpdump shouldn't i? |
| 21:00.24 | igcewieling | the same system with two IPs on the SAME subnet could also cause that. |
| 21:00.53 | Akari | He's having send issues |
| 21:00.55 | Akari | Not receive issues |
| 21:01.06 | igcewieling | like sending out the wrong interface? |
| 21:01.33 | Akari | We tried running a capture on all interfaces at once and he said the output was the same. |
| 21:01.43 | igcewieling | I am so glad I almost never have NAT isues. |
| 21:01.58 | jeffspeff | Samot that tcpdump didn't show any packets, not even the register packets |
| 21:02.36 | Samot | So using the IP of the Asterisk in a tcpdump on the Asterisk server doesn't show anything?! |
| 21:04.12 | Samot | Are using listening on 5060? If you're not, change it to the right port. |
| 21:04.19 | Samot | Whatever port you're listening on. |
| 21:04.37 | Akari | And no |
| 21:04.50 | Akari | If the port is blocked in iptables it shouldn't hit the pcap driver |
| 21:05.23 | Akari | (or similar firewalls) |
| 21:06.28 | *** join/#asterisk defsdoor (~andy@cpc35-sutt4-2-0-cust184.19-1.cable.virginm.net) |
| 21:06.30 | Akari | I just confirmed it. |
| 21:09.25 | *** join/#asterisk clopez (~tau@neutrino.es) |
| 21:09.32 | jeffspeff | Samot, the local ip of the server is 10.128.0.3 |
| 21:11.42 | *** join/#asterisk defsdoor (~andy@cpc35-sutt4-2-0-cust184.19-1.cable.virginm.net) |
| 21:12.35 | Samot | jeffspeff: So what is the other IP? |
| 21:12.55 | jeffspeff | the public ip |
| 21:13.04 | Samot | Because nothing in your gists show the network settings of Asterisk, and nothing in the debug suggests that Asterisk is listening on that IP. |
| 21:14.04 | Samot | Show your network settings for Asterisk. |
| 21:14.49 | *** join/#asterisk dovid (~dovid@ool-3f8fece0.dyn.optonline.net) |
| 21:16.37 | jeffspeff | the gist shows the ps_transports which has the public set in external media and signaling. ps_transports is binding to 0.0.0.0. when ast starts, i saw it say that pjsip determined to bind to 10.128.0.3 |
| 21:17.23 | jeffspeff | https://gist.github.com/jeffclay/ea74426d3f3cb9ec30204c3f0111f2ed |
| 21:18.03 | jeffspeff | should i have it binding to the external ip or internal ip? |
| 21:21.32 | igcewieling | why would you want to bind it to any specific interface. |
| 21:21.54 | jeffspeff | i didn't have it binding to any specific interface |
| 21:23.28 | Akari | Can you do ping -I {internal interface} {far end ip}? |
| 21:24.19 | jeffspeff | the endpoint is a softphone running on my pc. i am ssh'd into the server from my pc. there is bi-directional traffic between the endpoint ip and the server |
| 21:25.35 | Akari | I understand ping works out of *some* interface. |
| 21:25.43 | Akari | I want to know if ping works out of *that* interface. |
| 21:26.23 | jeffspeff | what are you talking about? |
| 21:26.37 | jeffspeff | the server has 2 interfaces eth0 and loop back |
| 21:26.46 | Akari | I want to know if you can ping your remote host from the interface asterisk bound to. |
| 21:26.56 | Akari | Wait what |
| 21:27.39 | jeffspeff | yes, i can ping |
| 21:27.41 | Akari | Hold on I need to reread |
| 21:28.15 | Akari | Okay I see |
| 21:29.21 | Akari | I thought you had an internal and an external interface. |
| 21:30.03 | Akari | idk it seems firewally to me still though I can't say exactly what could be invoking it. |
| 21:37.23 | Akari | Maybe enable debugging in asterisk. It should tell you if it fails before a firewall issue. |
| 21:38.00 | jeffspeff | i tried that, it just shows all of the sql queries in the background |
| 21:38.30 | mmlj4 | I need to put iax on an alternate port, but bindaddr=192.168.1.1:12345 (or separate bindport and bindaddr lines) doesn't work. Ideas? |
| 21:39.07 | jeffspeff | mmlj4 use bindport |
| 21:39.19 | jeffspeff | bindaddr is just the ip |
| 21:40.32 | mmlj4 | jeffspeff: I did that too, didn't work |
| 21:41.07 | jeffspeff | you set bindaddr=192.168.1.1 and bindport=12345 then reloaded the iax module? |
| 21:41.33 | mmlj4 | I stopped and started * |
| 21:41.42 | *** join/#asterisk dovid (~dovid@ool-3f8fece0.dyn.optonline.net) |
| 21:41.53 | mmlj4 | it still listens on the default port |
| 21:43.53 | mmlj4 | sockstat tells me it's on the IP I specify instead of a glob, but the port remains unchanged |
| 21:47.01 | Akari | Are you specifying bindport before bindaddr? |
| 21:49.05 | *** join/#asterisk catphish (~J@unaffiliated/catphish) |
| 21:49.26 | catphish | is there any way in chan_sip i can see which peer an incoming packet is matching? |
| 22:03.11 | *** join/#asterisk dym (~patrick@unaffiliated/dym) |
| 22:03.25 | dym | Hey! Is anyone using fail2ban against bruteforce attacks to SIP accounts? |
| 22:04.12 | Mango45 | It's certainly possible to do that, but better to place your PBX behind a firewall unless the requirements for your project specifically state otherwise. |
| 22:10.11 | dym | Well, i have a SIP client on a dynamic IP Address |
| 22:12.28 | catphish | this is very odd, my realtime seems to suddenly trying to match INVITE packets by `name` rather than by IP :( |
| 22:13.18 | catphish | oh it's supposed to match on the from name first, then by IP |
| 22:20.11 | *** join/#asterisk [TK]D-Fender (~joe@64.235.216.2) |
| 22:20.49 | *** join/#asterisk dovid (~dovid@ool-4573a525.dyn.optonline.net) |
| 22:28.53 | igcewieling | dym: I use a...unique...way of dealing with brute force attacks. Allow them in. Point all guests to a dedicated context, maybe make the call ring forever. |
| 22:30.24 | dym | Well |
| 22:30.32 | dym | igcewieling: it's mostly register attempts |
| 22:30.50 | jeffspeff | dym i found it easier to use iptable filters |
| 22:31.08 | dym | jeffspeff: in which way? how triggered? |
| 22:32.11 | jeffspeff | it counts the number packets that match certain string. after a set number of matches within timeframe it drops the packets from that src ip |
| 22:33.50 | igcewieling | dym: same applies to register. |
| 22:34.09 | igcewieling | allowguest and autocreatepeer and context options are what I use. |
| 22:37.02 | dym | igcewieling: may i see that piece of your config/dialplan? |
| 22:37.24 | igcewieling | not easily, but I'll see what I can do. |
| 22:44.09 | *** join/#asterisk defsdoor (~andy@cpc35-sutt4-2-0-cust184.19-1.cable.virginm.net) |
| 22:44.25 | igcewieling | dym: something like this: |
| 22:44.26 | igcewieling | http://pastebin.com/gXU9vLq3 |
| 22:44.55 | igcewieling | you will have to set a context for every user/friend/peer so they don't go to the jail context. |
| 22:45.44 | WIMPy | Why do you use autocreatepeer? |
| 22:46.16 | igcewieling | WIMPy: so registers work, otherwise they will just keep trying to register. |
| 22:46.44 | WIMPy | And why do you want them to register? |
| 22:47.10 | igcewieling | WIMPy: so I can send them to the [jail] context so they will stop attacking. |
| 22:47.46 | WIMPy | When they try to call that's not related to them trying to register. |
| 22:47.49 | igcewieling | rejecting or dropping the packets don't make them stop, but if they manage to register or to make a call and it appears to work then things quiet down. |
| 22:48.56 | WIMPy | Hmm. can you set earlymedia per peer? |
| 22:50.10 | WIMPy | I tried that a long time ago and they maxed out my line with RTP. |
| 22:51.09 | catphish | i've got a problem where an invite coming into chan_sip isn't matching the realtime peer i want it to, is there any way to debug which peer an incomng invite it matching? or a detailed explanation of the matching algorithm somewhere? |
| 22:51.35 | igcewieling | catphish: does the peer show up in "sip show peers" ? |
| 22:52.05 | catphish | igcewieling: i can load it manually, then it does |
| 22:52.20 | igcewieling | catphish: correct, that is how realtime works. |
| 22:52.43 | igcewieling | change the database, do a sip reload. I think that only applies if you use realtime caching. |
| 22:52.44 | catphish | indeed |
| 22:53.18 | catphish | the problem is that my invite is matching the wrong peer (or possibly no peer, i'm not sure which) |
| 22:53.30 | catphish | but im not sure how to debug why |
| 22:53.42 | igcewieling | maybe it is mathing the wrong peer because the right peer is not in "sip show peers"? |
| 22:54.13 | WIMPy | Or another peer matches as well. |
| 22:54.16 | catphish | if i load the right peer it shows up in sip show peers, but that doesnt resolve the problem |
| 22:54.28 | catphish | i think it might be matching another peer |
| 22:54.39 | catphish | but i'm not sure of the algorithm, or how to confirm this |
| 22:55.05 | WIMPy | If you have multiple matches it will simply take the first. |
| 22:55.41 | catphish | well i have lots of dynamic peers with this ip cached, and one static peer with it |
| 22:56.20 | catphish | it was my understanding it should only match the static one, but im not sure how this interacts with the realtime cache |
| 22:56.48 | WIMPy | So if you try to match bu user and the ip already matches, you need to make sure they are in the right order. Not sure if you can when using realtime. |
| 22:57.51 | catphish | so to clarify, i want it to match the peer by ip, not any of the "dynamic" ones |
| 22:58.02 | igcewieling | on my sip debug I see [Nov 10 17:57:06] VERBOSE[11664][C-0004c9bc] chan_sip.c: [Nov 10 17:57:06] Found peer 'mha-60-fullerton' for '1xxxxxx3777' from xxx.xxx.118.246:5060 |
| 22:58.11 | catphish | even if the saved ip of the dynamic peers match |
| 22:58.37 | igcewieling | catphish: define EXACTLY what you mean by "load the right peer" |
| 22:59.32 | catphish | a sip INVITE comes in from 185.110.248.8:5060, i want this to match my peer that has host = 185.110.248.8 and port = 5060 |
| 22:59.47 | catphish | i do NOT want it to match anything where host = dynamic |
| 23:01.02 | catphish | rather, i do NOT want it to match anything where host = dynamic and ipaddr = 185.110.248.8 and port = 5060 |
| 23:01.23 | catphish | which is what i suspect may be happening, but i have no way to confirm |
| 23:01.34 | igcewieling | something like this? "Disallow all dynamic hosts from registering |
| 23:01.34 | igcewieling | hosts. This helps avoid the configuration |
| 23:01.34 | igcewieling | error of allowing your users to register at |
| 23:01.34 | igcewieling | <PROTECTED> |
| 23:01.44 | igcewieling | sorry, I meant to format that better |
| 23:02.39 | catphish | that seems sensible, but i actually want my dynamic hosts to be able to register |
| 23:03.19 | catphish | this config has worked for me for weeks, until today, when suddenly all my incoming invites are getting 401 responses |
| 23:03.33 | catphish | i assume because they're not being matched to the right peer |
| 23:04.33 | igcewieling | you can see from the message I pasted, asterisk 11 will tell you the matched peer. |
| 23:05.12 | catphish | igcewieling: interesting, i'll see if my 1.8 shows this |
| 23:08.11 | catphish | i dont think it does |
| 23:08.22 | dym | igcewieling: cheers |
| 23:08.34 | dym | igcewieling: btw - this fail2ban filter seems to work like a charm: http://pastebin.com/6Yn4gc5Y |
| 23:09.12 | dym | WIMPy: go to bed! it's late. |
| 23:09.16 | igcewieling | dym, not spamming the logs with iptables blocked packet messages? |
| 23:09.35 | dym | igcewieling: im using shorewall |
| 23:09.40 | dym | but no |
| 23:09.57 | igcewieling | it would depend on your iptables setup |
| 23:09.59 | dym | igcewieling: suspicioulsly quiet |
| 23:13.02 | catphish | disabling realtime friend caching fixed the problem |
| 23:13.10 | catphish | it looks up the peer correctly from the database |
| 23:20.37 | catphish | i'm thinking the realtime ip / port lookup doesn't respect the difference between static and dynamic hosts |
| 23:24.23 | catphish | loading the correct realtime peer first also works |
| 23:26.24 | catphish | this is obviously unacceptably hacky, but will get me throught my right-now-downtime |
| 23:26.30 | *** join/#asterisk shootbird (~quassel@205.185.122.214) |
| 23:43.27 | *** join/#asterisk timotheus1 (~roost@unaffiliated/roost) |
| 23:55.53 | *** join/#asterisk newtonr (~newtonr@173-17-133-211.client.mchsi.com) |
| 23:55.53 | *** mode/#asterisk [+o newtonr] by ChanServ |