Mailing List Archive: a strange flood of packets from ccm

a strange flood of packets from ccm

May 4, 2004, 8:14 AM

Post #1 of 10 (4023 views)

hi there,

in december '03, and today we have received a lot of packets by publisher
and subscriber, directed to all ports of cisco catalist switch. The
average is 2000 packets per second! It seems like a discovery probe made
on all ports via cdp. I have verified and no worm or virus is installed on
machines. Today I had ccm334, os 2.5.sr7, microsoft patches installed
including ms04-011, and mcafee antivirus up and running. What I have done
to solve is an upgrade to os version 2.6, but I think that this upgrade is
not the cure. I think that the reboot has solved, until the next flood.

Please anyone have an idea?

here a sample group of packets.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/10-19:18:14.402103 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24628 -> 10.89.23.240:18268 UDP TTL:127 TOS:0xB8 ID:56599
IpLen:20
DgmLen:200
Len: 172
80 08 4B E4 29 6B 5B 60 00 00 06 86 55 55 55 55 ..K.)k[`....UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
IpLen:20
DgmLen:200
Len: 172
80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/10-19:18:14.402116 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24650 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56601
IpLen:20
DgmLen:200
Len: 172
80 08 A9 E5 0B 06 12 A0 00 00 06 95 55 55 55 55 ............UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/10-19:18:14.402120 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24658 -> 10.89.23.240:16422 UDP TTL:127 TOS:0xB8 ID:56602
IpLen:20
DgmLen:200
Len: 172
80 08 88 56 0A F1 15 80 00 00 06 9B 55 55 55 55 ...V........UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

thanks in advance.
Leonardo

--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy

Re: a strange flood of packets from ccm [ In reply to ]

rratliff at cisco

May 4, 2004, 8:30 AM

Post #2 of 10 (3863 views)

Permalink

Are you sure that's not just moh? Those packets don't appear to be layer 2
or 3 broadcasts. Do you have a sniffer trace you could zip and send?

-Ryan
----- Original Message -----
From: "Leonardo D'Urso" <durso@alter.it>
To: <cisco-voip@puck.nether.net>
Sent: Tuesday, May 04, 2004 10:14 AM
Subject: [cisco-voip] a strange flood of packets from ccm

>
> hi there,
>
> in december '03, and today we have received a lot of packets by publisher
> and subscriber, directed to all ports of cisco catalist switch. The
> average is 2000 packets per second! It seems like a discovery probe made
> on all ports via cdp. I have verified and no worm or virus is installed on
> machines. Today I had ccm334, os 2.5.sr7, microsoft patches installed
> including ms04-011, and mcafee antivirus up and running. What I have done
> to solve is an upgrade to os version 2.6, but I think that this upgrade is
> not the cure. I think that the reboot has solved, until the next flood.
>
> Please anyone have an idea?
>
> here a sample group of packets.
>
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402103 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24628 -> 10.89.23.240:18268 UDP TTL:127 TOS:0xB8 ID:56599
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 4B E4 29 6B 5B 60 00 00 06 86 55 55 55 55 ..K.)k[`....UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402116 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24650 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56601
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 A9 E5 0B 06 12 A0 00 00 06 95 55 55 55 55 ............UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402120 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24658 -> 10.89.23.240:16422 UDP TTL:127 TOS:0xB8 ID:56602
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 88 56 0A F1 15 80 00 00 06 9B 55 55 55 55 ...V........UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> thanks in advance.
> Leonardo
>
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

RE: a strange flood of packets from ccm [ In reply to ]

wsisk at cisco

May 4, 2004, 8:33 AM

Post #3 of 10 (3869 views)

Permalink

This look almost like an extraneous RTP stream. We've seen similar issues a
few times now. You can confirm if this is the issue by doing a "stop" and
"start" of the

right click my computer, manage
device manager
view->show hidden devices
Non-Plug and Play Drivers
Cisco IP Voice Media Streaming Driver
right click, properties, "Driver" tab, stop, start.

Then, are you still getting the streams?

One such issue: CSCed02974

Do you have a capture in libpcap format or something I can load into
ethereal?

/Wes

> -----Original Message-----
> From: cisco-voip-bounces@puck.nether.net
> [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 11:14 AM
> To: cisco-voip@puck.nether.net
> Subject: [cisco-voip] a strange flood of packets from ccm
>
>
>
> hi there,
>
> in december '03, and today we have received a lot of packets by publisher
> and subscriber, directed to all ports of cisco catalist switch. The
> average is 2000 packets per second! It seems like a discovery probe made
> on all ports via cdp. I have verified and no worm or virus is installed on
> machines. Today I had ccm334, os 2.5.sr7, microsoft patches installed
> including ms04-011, and mcafee antivirus up and running. What I have done
> to solve is an upgrade to os version 2.6, but I think that this upgrade is
> not the cure. I think that the reboot has solved, until the next flood.
>
> Please anyone have an idea?
>
> here a sample group of packets.
>
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402103 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24628 -> 10.89.23.240:18268 UDP TTL:127 TOS:0xB8 ID:56599
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 4B E4 29 6B 5B 60 00 00 06 86 55 55 55 55 ..K.)k[`....UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402116 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24650 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56601
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 A9 E5 0B 06 12 A0 00 00 06 95 55 55 55 55 ............UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> 12/10-19:18:14.402120 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> len:0xD6
> 10.89.5.1:24658 -> 10.89.23.240:16422 UDP TTL:127 TOS:0xB8 ID:56602
> IpLen:20
> DgmLen:200
> Len: 172
> 80 08 88 56 0A F1 15 80 00 00 06 9B 55 55 55 55 ...V........UUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
>
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> thanks in advance.
> Leonardo
>
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

RE: a strange flood of packets from ccm [ In reply to ]

durso at alter

May 4, 2004, 8:38 AM

Post #4 of 10 (3869 views)

Permalink

I have just only that packets and all cisco logs if you want I may send it
to you but in ccm format and not in tcpdump or eterx format, today I have
done the rolling upgrade as fast as possible because the callmanager is
up and running and we have 11 branch office and 1 headquarter w/ 600
telephones and fax ecc... and so I have no dumps.

But before the upgrade to os2.6 I have stopped and started the Cisco IP
Voice Media Streaming Driver via microsoft service window, but nothing
changes. So I think it isn't the same case.

--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy

On Tue, 4 May 2004, Wes Sisk wrote:

> This look almost like an extraneous RTP stream. We've seen similar issues a
> few times now. You can confirm if this is the issue by doing a "stop" and
> "start" of the
>
> right click my computer, manage
> device manager
> view->show hidden devices
> Non-Plug and Play Drivers
> Cisco IP Voice Media Streaming Driver
> right click, properties, "Driver" tab, stop, start.
>
> Then, are you still getting the streams?
>
> One such issue: CSCed02974
>
> Do you have a capture in libpcap format or something I can load into
> ethereal?
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces@puck.nether.net
> > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 11:14 AM
> > To: cisco-voip@puck.nether.net
> > Subject: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > hi there,
> >
> > in december '03, and today we have received a lot of packets by publisher
> > and subscriber, directed to all ports of cisco catalist switch. The
> > average is 2000 packets per second! It seems like a discovery probe made
> > on all ports via cdp. I have verified and no worm or virus is installed on
> > machines. Today I had ccm334, os 2.5.sr7, microsoft patches installed
> > including ms04-011, and mcafee antivirus up and running. What I have done
> > to solve is an upgrade to os version 2.6, but I think that this upgrade is
> > not the cure. I think that the reboot has solved, until the next flood.
> >
> > Please anyone have an idea?
> >
> > here a sample group of packets.
> >
> >
> > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >
> > 12/10-19:18:14.402103 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> > len:0xD6
> > 10.89.5.1:24628 -> 10.89.23.240:18268 UDP TTL:127 TOS:0xB8 ID:56599
> > IpLen:20
> > DgmLen:200
> > Len: 172
> > 80 08 4B E4 29 6B 5B 60 00 00 06 86 55 55 55 55 ..K.)k[`....UUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
> >
> > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >
> > 12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> > len:0xD6
> > 10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
> > IpLen:20
> > DgmLen:200
> > Len: 172
> > 80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
> >
> > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >
> > 12/10-19:18:14.402116 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> > len:0xD6
> > 10.89.5.1:24650 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56601
> > IpLen:20
> > DgmLen:200
> > Len: 172
> > 80 08 A9 E5 0B 06 12 A0 00 00 06 95 55 55 55 55 ............UUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
> >
> > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >
> > 12/10-19:18:14.402120 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
> > len:0xD6
> > 10.89.5.1:24658 -> 10.89.23.240:16422 UDP TTL:127 TOS:0xB8 ID:56602
> > IpLen:20
> > DgmLen:200
> > Len: 172
> > 80 08 88 56 0A F1 15 80 00 00 06 9B 55 55 55 55 ...V........UUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
> > 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
> >
> > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
> >
> > thanks in advance.
> > Leonardo
> >
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>

RE: a strange flood of packets from ccm [ In reply to ]

durso at alter

May 4, 2004, 9:55 AM

Post #5 of 10 (3876 views)

Permalink

thanks Wes, for reply. In the trace I have seen a lot of this
packets:

<trace><Date>05/04/2004 15:10:56.514
</Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
Controller=[0,0,0]</info></trace>

I think this could be related to the flood.

--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy

Re: a strange flood of packets from ccm [ In reply to ]

rratliff at cisco

May 4, 2004, 10:12 AM

Post #6 of 10 (3871 views)

Permalink

An IP phone will maintain a TCP session, and send skinny keepalives, to
every CM that it could potentially be registered with (ie in its CM group).
Only the CM that it is currently registered with will respond to the
keepalive though. The message below means that CM was a backup CM for that
particular phone, so there was no need to respond to the keepalive. It is
not related to your problem and is completely normal.

-Ryan
----- Original Message -----
From: "Leonardo D'Urso" <durso@alter.it>
To: <cisco-voip@puck.nether.net>
Sent: Tuesday, May 04, 2004 11:55 AM
Subject: RE: [cisco-voip] a strange flood of packets from ccm

>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
>
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></S
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

RE: a strange flood of packets from ccm [ In reply to ]

wsisk at cisco

May 4, 2004, 10:14 AM

Post #7 of 10 (3870 views)

Permalink

Leo,

This is normal. This just means that the CM process on this node received a
SCCP KeepAlive from the device with TCPHandle=000003290. This device is
actively registered to another CM node in the cluster so this CM node will
basically ignore the message.

/Wes

> -----Original Message-----
> From: cisco-voip-bounces@puck.nether.net
> [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 12:56 PM
> To: cisco-voip@puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

RE: a strange flood of packets from ccm [ In reply to ]

durso at alter

May 4, 2004, 1:07 PM

Post #8 of 10 (3878 views)

Permalink

hi there,

log start at: 05/04/2004 15:12:26.079
log ends at: 05/04/2004 15:12:50.111
number of keepalives: 915

so I think that this is the flood. I know that CCM and phones use
keepalives but this seems I have a paranoic firmware on phones ;-)

--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy

On Tue, 4 May 2004, Wes Sisk wrote:

> Leo,
>
> This is normal. This just means that the CM process on this node received a
> SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> actively registered to another CM node in the cluster so this CM node will
> basically ignore the message.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces@puck.nether.net
> > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 12:56 PM
> > To: cisco-voip@puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > thanks Wes, for reply. In the trace I have seen a lot of this
> > packets:
> >
> > <trace><Date>05/04/2004 15:10:56.514
> > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> > Controller=[0,0,0]</info></trace>
> >
> > I think this could be related to the flood.
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>

RE: a strange flood of packets from ccm [ In reply to ]

wsisk at cisco

May 4, 2004, 1:56 PM

Post #9 of 10 (3873 views)

Permalink

Default is:
phone KA to active CM: every 30 seconds
phone KA to backup CM: every 60 seconds.

This is the active server for how many phones?
This is the backup server for how many phones?

A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
calculator will help you find your answer.

/Wes

> -----Original Message-----
> From: cisco-voip-bounces@puck.nether.net
> [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 4:08 PM
> To: cisco-voip@puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> hi there,
>
> log start at: 05/04/2004 15:12:26.079
> log ends at: 05/04/2004 15:12:50.111
> number of keepalives: 915
>
> so I think that this is the flood. I know that CCM and phones use
> keepalives but this seems I have a paranoic firmware on phones ;-)
>
>
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> On Tue, 4 May 2004, Wes Sisk wrote:
>
> > Leo,
> >
> > This is normal. This just means that the CM process on this
> node received a
> > SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> > actively registered to another CM node in the cluster so this
> CM node will
> > basically ignore the message.
> >
> > /Wes
> >
> > > -----Original Message-----
> > > From: cisco-voip-bounces@puck.nether.net
> > > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of
> Leonardo D'Urso
> > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > To: cisco-voip@puck.nether.net
> > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > >
> > >
> > >
> > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > packets:
> > >
> > > <trace><Date>05/04/2004 15:10:56.514
> > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> Port=6994, Device
> > > Controller=[0,0,0]</info></trace>
> > >
> > > I think this could be related to the flood.
> > >
> > > --
> > > Leonardo D'Urso alter.net Srl
> > > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > > VOICE: +39-06-5405740 I-00147 Roma
> > > FAX: +39-06-5405883 Italy
> > >
> > > _______________________________________________
> > > cisco-voip mailing list
> > > cisco-voip@puck.nether.net
> > > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip

RE: a strange flood of packets from ccm [ In reply to ]

durso at alter

May 4, 2004, 3:02 PM

Post #10 of 10 (3882 views)

Permalink

I have received 88236 keepalive package in 190 min, separated by few
milliseconds of gap. That means I have received an average of 232 packets
for every 30 seconds or 464 per minute. This on publisher that is the
secondary server. The primary is the subscriber.
I have 600 phones but up and running around 500. So this seems compliant
to your indication.

So this means that is not a keepalive flood. I'm tring to understand what
a kind of service starts packets like this:

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
IpLen:20
DgmLen:200
Len: 172
80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

consider that the source address is the publisher (secondary server in ccm
cluster) the destination is a cisco ios voice gateway mod. 3745 connected
via wan (MPLS network).

nb. I have used awk,vi and bc for doing calc. My casio calc doesn't
support embedded linux! ;-)

--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy

On Tue, 4 May 2004, Wes Sisk wrote:

> Default is:
> phone KA to active CM: every 30 seconds
> phone KA to backup CM: every 60 seconds.
>
> This is the active server for how many phones?
> This is the backup server for how many phones?
>
> A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
> calculator will help you find your answer.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces@puck.nether.net
> > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 4:08 PM
> > To: cisco-voip@puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > hi there,
> >
> > log start at: 05/04/2004 15:12:26.079
> > log ends at: 05/04/2004 15:12:50.111
> > number of keepalives: 915
> >
> > so I think that this is the flood. I know that CCM and phones use
> > keepalives but this seems I have a paranoic firmware on phones ;-)
> >
> >
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > On Tue, 4 May 2004, Wes Sisk wrote:
> >
> > > Leo,
> > >
> > > This is normal. This just means that the CM process on this
> > node received a
> > > SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> > > actively registered to another CM node in the cluster so this
> > CM node will
> > > basically ignore the message.
> > >
> > > /Wes
> > >
> > > > -----Original Message-----
> > > > From: cisco-voip-bounces@puck.nether.net
> > > > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of
> > Leonardo D'Urso
> > > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > > To: cisco-voip@puck.nether.net
> > > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > > >
> > > >
> > > >
> > > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > > packets:
> > > >
> > > > <trace><Date>05/04/2004 15:10:56.514
> > > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> > Port=6994, Device
> > > > Controller=[0,0,0]</info></trace>
> > > >
> > > > I think this could be related to the flood.
> > > >
> > > > --
> > > > Leonardo D'Urso alter.net Srl
> > > > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > > > VOICE: +39-06-5405740 I-00147 Roma
> > > > FAX: +39-06-5405883 Italy
> > > >
> > > > _______________________________________________
> > > > cisco-voip mailing list
> > > > cisco-voip@puck.nether.net
> > > > https://puck.nether.net/mailman/listinfo/cisco-voip
> > >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>