-----Original Message-----
From: cisco-voip-bounces@puck.nether.net
[mailto:cisco-voip-bounces@puck.nether.net] On Behalf Of
cisco-voip-request@puck.nether.net
Sent: Wednesday, May 05, 2004 9:22 AM
To: cisco-voip@puck.nether.net
Subject: cisco-voip Digest, Vol 15, Issue 4
Send cisco-voip mailing list submissions to
cisco-voip@puck.nether.net
To subscribe or unsubscribe via the World Wide Web, visit
https://puck.nether.net/mailman/listinfo/cisco-voip or, via email, send a message with subject or body 'help' to
cisco-voip-request@puck.nether.net
You can reach the person managing the list at
cisco-voip-owner@puck.nether.net
When replying, please edit your Subject line so it is more specific than
"Re: Contents of cisco-voip digest..."
Today's Topics:
1. RE: CiscoWorks ITM (Tim Medley)
2. RE: a strange flood of packets from ccm (Leonardo D'Urso)
3. Re: a strange flood of packets from ccm (Ryan Ratliff)
4. RE: a strange flood of packets from ccm (Wes Sisk)
5. Cisco router as SIP gateway (Eric Pylko)
6. RE: a strange flood of packets from ccm (Leonardo D'Urso)
7. RE: a strange flood of packets from ccm (Wes Sisk)
8. RE: a strange flood of packets from ccm (Leonardo D'Urso)
9. debug isdn q931 --> FXO port (Voll, Scott)
----------------------------------------------------------------------
Message: 1
Date: Tue, 4 May 2004 11:37:48 -0500
From: "Tim Medley" <medley@mac.com>
Subject: RE: [cisco-voip] CiscoWorks ITM
To: <cisco-voip@puck.nether.net>
Message-ID: <200405041638.i44GcSTL009951@mac.com>
Content-Type: text/plain; charset="US-ASCII"
I evaluated it a few months ago and unfortunately it did not fit my needs.
It is very powerful and has some interesting features.
The issues I ran into were that it could only use port 80 to communicate
with CallManager, we are using an alternate port for http access to the
CCM's. Also it didn't seem to be able to monitor/manage Unity servers. I
have 3 CCM Cluster (6 servers) but I have 30+ Unity servers.
The gateway statistics utility is nice, but requires a third party reporting
tool or you have to write your own. Also it only allows you to run a single
gateway study at a time; I'd like to study at least one gateway in each of
my PoP's.
Tim Medley
-----Original Message-----
From: cisco-voip-bounces@puck.nether.net
[mailto:cisco-voip-bounces@puck.nether.net] On Behalf Of Voll, Scott
Sent: Tuesday, May 04, 2004 9:35 AM
To: cisco-voip@puck.nether.net
Subject: [cisco-voip] CiscoWorks ITM
Anyone using CiscoWorks ITM?
http://www.cisco.com/en/US/customer/products/sw/cscowork/ps5431/index.ht ml
Thoughts? Problems? Pro's and Con's?
Thanks
Scott
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip ------------------------------
Message: 2
Date: Tue, 4 May 2004 18:55:57 +0200 (CEST)
From: "Leonardo D'Urso" <durso@alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: cisco-voip@puck.nether.net
Message-ID: <Pine.LNX.4.58.0405041845220.2156@puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
thanks Wes, for reply. In the trace I have seen a lot of this
packets:
<trace><Date>05/04/2004 15:10:56.514
</Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></S
KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
Controller=[0,0,0]</info></trace>
I think this could be related to the flood.
--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
------------------------------
Message: 3
Date: Tue, 4 May 2004 12:12:20 -0500
From: "Ryan Ratliff" <rratliff@cisco.com>
Subject: Re: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso@alter.it>, <cisco-voip@puck.nether.net>
Message-ID: <00ec01c431fa$f594a100$b89a6540@amer.cisco.com>
Content-Type: text/plain; charset="iso-8859-1"
An IP phone will maintain a TCP session, and send skinny keepalives, to
every CM that it could potentially be registered with (ie in its CM group).
Only the CM that it is currently registered with will respond to the
keepalive though. The message below means that CM was a backup CM for that
particular phone, so there was no need to respond to the keepalive. It is
not related to your problem and is completely normal.
-Ryan
----- Original Message -----
From: "Leonardo D'Urso" <durso@alter.it>
To: <cisco-voip@puck.nether.net>
Sent: Tuesday, May 04, 2004 11:55 AM
Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
>
/CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><SrcDev></S
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 4
Date: Tue, 4 May 2004 13:14:47 -0400
From: "Wes Sisk" <wsisk@cisco.com>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso@alter.it>, <cisco-voip@puck.nether.net>
Message-ID: <ELEMLGDGDBLINAJEIOCLCEPPOEAA.wsisk@cisco.com>
Content-Type: text/plain; charset="us-ascii"
Leo,
This is normal. This just means that the CM process on this node received a
SCCP KeepAlive from the device with TCPHandle=000003290. This device is
actively registered to another CM node in the cluster so this CM node will
basically ignore the message.
/Wes
> -----Original Message-----
> From: cisco-voip-bounces@puck.nether.net
> [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 12:56 PM
> To: cisco-voip@puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> thanks Wes, for reply. In the trace I have seen a lot of this
> packets:
>
> <trace><Date>05/04/2004 15:10:56.514
> </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> Controller=[0,0,0]</info></trace>
>
> I think this could be related to the flood.
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 5
Date: Tue, 4 May 2004 12:43:27 -0700
From: Eric Pylko <eric@infinitenetworks.us>
Subject: [cisco-voip] Cisco router as SIP gateway
To: cisco-voip@puck.nether.net
Message-ID:
<20040504194327.28423.qmail@webmail03.mesa1.secureserver.net>
Content-Type: text/plain; charset="us-ascii"
An HTML attachment was scrubbed...
URL:
https://puck.nether.net/pipermail/cisco-voip/attachments/20040504/5fd867c9/a ttachment-0001.html
------------------------------
Message: 6
Date: Tue, 4 May 2004 22:07:44 +0200 (CEST)
From: "Leonardo D'Urso" <durso@alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: cisco-voip@puck.nether.net
Message-ID: <Pine.LNX.4.58.0405042202440.2215@puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
hi there,
log start at: 05/04/2004 15:12:26.079
log ends at: 05/04/2004 15:12:50.111
number of keepalives: 915
so I think that this is the flood. I know that CCM and phones use
keepalives but this seems I have a paranoic firmware on phones ;-)
--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
On Tue, 4 May 2004, Wes Sisk wrote:
> Leo,
>
> This is normal. This just means that the CM process on this node received
a
> SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> actively registered to another CM node in the cluster so this CM node will
> basically ignore the message.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces@puck.nether.net
> > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 12:56 PM
> > To: cisco-voip@puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > thanks Wes, for reply. In the trace I have seen a lot of this
> > packets:
> >
> > <trace><Date>05/04/2004 15:10:56.514
> > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17, Port=6994, Device
> > Controller=[0,0,0]</info></trace>
> >
> > I think this could be related to the flood.
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
------------------------------
Message: 7
Date: Tue, 4 May 2004 16:56:33 -0400
From: "Wes Sisk" <wsisk@cisco.com>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: "Leonardo D'Urso" <durso@alter.it>, <cisco-voip@puck.nether.net>
Message-ID: <ELEMLGDGDBLINAJEIOCLOEBCOFAA.wsisk@cisco.com>
Content-Type: text/plain; charset="us-ascii"
Default is:
phone KA to active CM: every 30 seconds
phone KA to backup CM: every 60 seconds.
This is the active server for how many phones?
This is the backup server for how many phones?
A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
calculator will help you find your answer.
/Wes
> -----Original Message-----
> From: cisco-voip-bounces@puck.nether.net
> [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> Sent: Tuesday, May 04, 2004 4:08 PM
> To: cisco-voip@puck.nether.net
> Subject: RE: [cisco-voip] a strange flood of packets from ccm
>
>
>
> hi there,
>
> log start at: 05/04/2004 15:12:26.079
> log ends at: 05/04/2004 15:12:50.111
> number of keepalives: 915
>
> so I think that this is the flood. I know that CCM and phones use
> keepalives but this seems I have a paranoic firmware on phones ;-)
>
>
>
> --
> Leonardo D'Urso alter.net Srl
> e-mail: durso@alter.it Via Attilio Ambrosini, 177
> VOICE: +39-06-5405740 I-00147 Roma
> FAX: +39-06-5405883 Italy
>
> On Tue, 4 May 2004, Wes Sisk wrote:
>
> > Leo,
> >
> > This is normal. This just means that the CM process on this
> node received a
> > SCCP KeepAlive from the device with TCPHandle=000003290. This device is
> > actively registered to another CM node in the cluster so this
> CM node will
> > basically ignore the message.
> >
> > /Wes
> >
> > > -----Original Message-----
> > > From: cisco-voip-bounces@puck.nether.net
> > > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of
> Leonardo D'Urso
> > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > To: cisco-voip@puck.nether.net
> > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > >
> > >
> > >
> > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > packets:
> > >
> > > <trace><Date>05/04/2004 15:10:56.514
> > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive Timer.
> > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> Port=6994, Device
> > > Controller=[0,0,0]</info></trace>
> > >
> > > I think this could be related to the flood.
> > >
> > > --
> > > Leonardo D'Urso alter.net Srl
> > > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > > VOICE: +39-06-5405740 I-00147 Roma
> > > FAX: +39-06-5405883 Italy
> > >
> > > _______________________________________________
> > > cisco-voip mailing list
> > > cisco-voip@puck.nether.net
> > > https://puck.nether.net/mailman/listinfo/cisco-voip
> >
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
------------------------------
Message: 8
Date: Wed, 5 May 2004 00:02:20 +0200 (CEST)
From: "Leonardo D'Urso" <durso@alter.it>
Subject: RE: [cisco-voip] a strange flood of packets from ccm
To: Wes Sisk <wsisk@cisco.com>
Cc: cisco-voip@puck.nether.net
Message-ID: <Pine.LNX.4.58.0405042340120.18645@puccettona.alter.it>
Content-Type: TEXT/PLAIN; charset=US-ASCII
I have received 88236 keepalive package in 190 min, separated by few
milliseconds of gap. That means I have received an average of 232 packets
for every 30 seconds or 464 per minute. This on publisher that is the
secondary server. The primary is the subscriber.
I have 600 phones but up and running around 500. So this seems compliant
to your indication.
So this means that is not a keepalive flood. I'm tring to understand what
a kind of service starts packets like this:
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
12/10-19:18:14.402112 0:B:5F:EB:FB:FF -> 0:50:73:3F:7E:A1 type:0x800
len:0xD6
10.89.5.1:24646 -> 10.89.23.240:17004 UDP TTL:127 TOS:0xB8 ID:56600
IpLen:20
DgmLen:200
Len: 172
80 08 AF 9D 0B 09 A7 80 00 00 06 92 55 55 55 55 ............UUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUUUUUU
55 55 55 55 55 55 55 55 55 55 55 55 UUUUUUUUUUUU
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
consider that the source address is the publisher (secondary server in ccm
cluster) the destination is a cisco ios voice gateway mod. 3745 connected
via wan (MPLS network).
nb. I have used awk,vi and bc for doing calc. My casio calc doesn't
support embedded linux! ;-)
--
Leonardo D'Urso alter.net Srl
e-mail: durso@alter.it Via Attilio Ambrosini, 177
VOICE: +39-06-5405740 I-00147 Roma
FAX: +39-06-5405883 Italy
On Tue, 4 May 2004, Wes Sisk wrote:
> Default is:
> phone KA to active CM: every 30 seconds
> phone KA to backup CM: every 60 seconds.
>
> This is the active server for how many phones?
> This is the backup server for how many phones?
>
> A good awk script, SQL SELECT, Excel Spreadsheet, or even just a Casio
> calculator will help you find your answer.
>
> /Wes
>
> > -----Original Message-----
> > From: cisco-voip-bounces@puck.nether.net
> > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of Leonardo D'Urso
> > Sent: Tuesday, May 04, 2004 4:08 PM
> > To: cisco-voip@puck.nether.net
> > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> >
> >
> >
> > hi there,
> >
> > log start at: 05/04/2004 15:12:26.079
> > log ends at: 05/04/2004 15:12:50.111
> > number of keepalives: 915
> >
> > so I think that this is the flood. I know that CCM and phones use
> > keepalives but this seems I have a paranoic firmware on phones ;-)
> >
> >
> >
> > --
> > Leonardo D'Urso alter.net Srl
> > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > VOICE: +39-06-5405740 I-00147 Roma
> > FAX: +39-06-5405883 Italy
> >
> > On Tue, 4 May 2004, Wes Sisk wrote:
> >
> > > Leo,
> > >
> > > This is normal. This just means that the CM process on this
> > node received a
> > > SCCP KeepAlive from the device with TCPHandle=000003290. This device
is
> > > actively registered to another CM node in the cluster so this
> > CM node will
> > > basically ignore the message.
> > >
> > > /Wes
> > >
> > > > -----Original Message-----
> > > > From: cisco-voip-bounces@puck.nether.net
> > > > [mailto:cisco-voip-bounces@puck.nether.net]On Behalf Of
> > Leonardo D'Urso
> > > > Sent: Tuesday, May 04, 2004 12:56 PM
> > > > To: cisco-voip@puck.nether.net
> > > > Subject: RE: [cisco-voip] a strange flood of packets from ccm
> > > >
> > > >
> > > >
> > > > thanks Wes, for reply. In the trace I have seen a lot of this
> > > > packets:
> > > >
> > > > <trace><Date>05/04/2004 15:10:56.514
> > > > </Date><Cluster>CCMPUB1-Cluster</Cluster><CMHost>10.89.5.1<
> > > > /CMHost><TraceType>Trace</TraceType><CTag>1,100,93,1.81286</CTag><
> > > > SrcDev></SrcDev><SrcIp>10.89.52.17</Sr
> > > > cIp><CTMapKey/><CTMapVal/><info>Cisco CallManagerStationInit -
> > > > KeepAliveMessage received on backup CM li nk. Setting KeepAlive
Timer.
> > > > DeviceName=, TCPHandle=000003290, IPAddr=10.89.52.17,
> > Port=6994, Device
> > > > Controller=[0,0,0]</info></trace>
> > > >
> > > > I think this could be related to the flood.
> > > >
> > > > --
> > > > Leonardo D'Urso alter.net Srl
> > > > e-mail: durso@alter.it Via Attilio Ambrosini, 177
> > > > VOICE: +39-06-5405740 I-00147 Roma
> > > > FAX: +39-06-5405883 Italy
> > > >
> > > > _______________________________________________
> > > > cisco-voip mailing list
> > > > cisco-voip@puck.nether.net
> > > > https://puck.nether.net/mailman/listinfo/cisco-voip
> > >
> > _______________________________________________
> > cisco-voip mailing list
> > cisco-voip@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-voip
>
debug vpm signal works pretty well
-Mike
------------------------------
Message: 9
Date: Wed, 5 May 2004 06:18:50 -0700
From: "Voll, Scott" <Scott.Voll@wesd.org>
Subject: [cisco-voip] debug isdn q931 --> FXO port
To: <cisco-voip@puck.nether.net>
Message-ID: <407055A92CECCB499C922A2D35FC19A6D9A3ED@apollo.wesd.org>
Content-Type: text/plain; charset="us-ascii"
What command on a FXO V-GW gives me basically the same info as Debug
isdn Q931? I just want to see the call coming into the GW's FXO.
TIA
Scott
------------------------------
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip End of cisco-voip Digest, Vol 15, Issue 4
*****************************************