Ubuntu
linux package

kern.log full of nf_ct_sip complaints

Bug #960126 reported by LaMont Jones
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Confirmed
Medium
Stefan Bader

Bug Description

netfilter really hates cisco 7940 phones. Please let me know what I can do to help track down how to at least get this clutter out of the log.
(It's been doing it since at least lucid - that's when the phone was added, the below is with 3.2.0-19-generic-pae.)

thanks,
lamont

Mar 20 06:08:33 pbx kernel: [39405.263838] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28257 PROTO=UDP SPT=50461 DPT=5060 LEN=569
Mar 20 06:08:33 pbx kernel: [39405.443717] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28258 PROTO=UDP SPT=50462 DPT=5060 LEN=569
Mar 20 06:08:34 pbx kernel: [39406.443902] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28259 PROTO=UDP SPT=50463 DPT=5060 LEN=569
Mar 20 06:08:37 pbx kernel: [39409.263483] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28261 PROTO=UDP SPT=50465 DPT=5060 LEN=569
Mar 20 06:08:37 pbx kernel: [39409.765438] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28262 PROTO=UDP SPT=50466 DPT=5060 LEN=569
Mar 20 06:08:38 pbx kernel: [39410.263643] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28263 PROTO=UDP SPT=50467 DPT=5060 LEN=569
Mar 20 06:08:39 pbx kernel: [39411.263561] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28264 PROTO=UDP SPT=50468 DPT=5060 LEN=569
Mar 20 06:08:41 pbx kernel: [39413.263383] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28265 PROTO=UDP SPT=50469 DPT=5060 LEN=569
Mar 20 06:08:45 pbx kernel: [39417.263298] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28266 PROTO=UDP SPT=50470 DPT=5060 LEN=569
Mar 20 06:08:49 pbx kernel: [39421.262926] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=28267 PROTO=UDP SPT=50471 DPT=5060 LEN=569

Tags: lucid precise
Revision history for this message
Brad Figg (brad-figg) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 960126

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Joseph Salisbury (jsalisbury)
Changed in linux (Ubuntu):
importance: Undecided → Medium
tags: added: lucid precise
Stefan Bader (smb)
Changed in linux (Ubuntu):
assignee: nobody → Stefan Bader (stefan-bader-canonical)
status: Incomplete → In Progress
Revision history for this message
LaMont Jones (lamont) wrote :
Download full text (4.1 KiB)

As discussed in IRC:

Mar 20 12:09:17 pbx kernel: [61049.242218] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38679 PROTO=UDP SPT=51583 DPT=5060 LEN=569
Mar 20 12:09:17 pbx kernel: [61049.743167] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38680 PROTO=UDP SPT=51584 DPT=5060 LEN=569
Mar 20 12:09:18 pbx kernel: [61050.242127] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38681 PROTO=UDP SPT=51585 DPT=5060 LEN=569
Mar 20 12:09:19 pbx kernel: [61051.242281] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38682 PROTO=UDP SPT=51586 DPT=5060 LEN=569
Mar 20 12:09:19 pbx kernel: [61051.592073] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38683 PROTO=UDP SPT=51587 DPT=5060 LEN=569
Mar 20 12:09:21 pbx kernel: [61053.242097] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38684 PROTO=UDP SPT=51588 DPT=5060 LEN=569
Mar 20 12:09:23 pbx kernel: [61055.591966] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38685 PROTO=UDP SPT=51589 DPT=5060 LEN=569
Mar 20 12:09:25 pbx kernel: [61057.241733] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38686 PROTO=UDP SPT=51590 DPT=5060 LEN=569
Mar 20 12:09:27 pbx kernel: [61059.591598] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38687 PROTO=UDP SPT=51591 DPT=5060 LEN=569
Mar 20 12:09:29 pbx kernel: [61061.241626] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38688 PROTO=UDP SPT=51592 DPT=5060 LEN=569
Mar 20 12:09:31 pbx kernel: [61063.591483] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38689 PROTO=UDP SPT=51593 DPT=5060 LEN=569
Mar 20 12:09:33 pbx kernel: [61065.241515] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38690 PROTO=UDP SPT=51594 DPT=5060 LEN=569
Mar 20 12:09:35 pbx kernel: [61067.591373] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=38691 PROTO=UDP SPT=515...

Read more...

Revision history for this message
Stefan Bader (smb) wrote :

Looking at the package data itself, there was not something that immediately sprang the eye. So I hope the kernels at

http://people.canonical.com/~smb/lp960126/

will actually succeed in adding information. The kernel does not crash when loading the modified module but I have not been able to test whether my "clever" scheme of debug messages works...

Revision history for this message
LaMont Jones (lamont) wrote :

# dmesg
...
[ 199.980330] Dropped by process_register_request@1251
[ 199.980350] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=52627 PROTO=UDP SPT=50216 DPT=5060 LEN=569
[ 202.240245] Dropped by process_register_request@1251
[ 202.240265] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=52628 PROTO=UDP SPT=50217 DPT=5060 LEN=569
[ 203.980217] Dropped by process_register_request@1251
[ 203.980236] nf_ct_sip: dropping packetIN=eth0 OUT= MAC=00:0e:0c:5c:1c:78:00:0c:85:be:5a:85:08:00 SRC=192.168.133.192 DST=192.168.133.1 LEN=589 TOS=0x10 PREC=0x40 TTL=64 ID=52629 PROTO=UDP SPT=50218 DPT=5060 LEN=569

Revision history for this message
Stefan Bader (smb) wrote :

So the filter seems not to like some thing about the addresses and ports. Which is unfortunately not the simplest part to read. So I tried to read a bit into the SIP RFC to find out more about the various fields sent.

Adding what we were discussing on irc: so another phone without the issues has the same data setup in the headers. The only difference we found was that working also sends from port 5060 (as indicated in via and contact) while the other phone comes from an unprivileged port but still has 5060 in the headers... maybe that is what the filter complains about.

Stefan Bader (smb)
Changed in linux (Ubuntu):
status: In Progress → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.