Device fetch just small

Eric Iversen · ‎01-19-2016

When attempting a remote firmware upgrade from 1.3.5(004p) to 1.4.1 I noticed the following in the syslog output:

2016-01-19T15:37:33.019424-05:00 XXXXXXXXX >>>> fprv_eval_upgrade_rule -- serv=XX.XX.XX.XX path=/SPA122.bin port=XXXXXX

2016-01-19T15:37:33.020394-05:00 FPRV >>>> about to try upgrade

2016-01-19T15:37:33.024477-05:00 XXXXXXXXX fs: 069856:078001:262144:076407967999

2016-01-19T15:37:33.025197-05:00 XXXXXXXXX [_fprv_download_file]test download url

2016-01-19T15:37:33.025197-05:00 XXXXXXXXX [_fprv_download_file] get dn_schema 1 path=/SPA122.bin ip XX,XX,XX,XX

2016-01-19T15:37:33.033721-05:00 stream read buflen=2048, ret=2048

2016-01-19T15:37:33.033910-05:00 download_data ret=2048

2016-01-19T15:37:33.034179-05:00 content len (pld) =2048

2016-01-19T15:37:33.035584-05:00 SPA122 54: 7c:69:3e:b1:a0 -- Requesting upgrade tftp://XX.XX.XX.XX/SPA122.bin

2016-01-19T15:37:33.035859-05:00 FMM >>>> Requesting upgrade

2016-01-01T00:01:30-05:00 SPA122 [17179667.680000] cordless: deinit failed

2016-01-19T15:37:44.572669-05:00 SPA122 54: 7c:69:3e:b1:a0 -- Requesting upgrade tftp://XX.XX.XX.XX/SPA122.bin

2016-01-19T15:37:44.572913-05:00 SPA122 54: 7c:69:3e:b1:a0 -- Requesting upgrade tftp://XX.XX.XX.XX/SPA122.bin

2016-01-19T15:37:44.573000-05:00 FMM >>>> Requesting upgrade

2016-01-19T15:37:44.576011-05:00 XXXXXXXXX sysstatus_set_led_status_payton(), led_id: 0, statusCode:21, systemEvent: 0xffff

2016-01-19T15:37:44.576339-05:00 XXXXXXXXX [_fprv_download_file] get dn_schema 1 path=/SPA122.bin ip XX,XX,XX,XX

2016-01-19T15:37:44.677926-05:00 download_data ret=32768

2016-01-19T15:37:44.678276-05:00 content len (pld) =32768

2016-01-19T15:37:44.678640-05:00 XXXXXXXXX sysstatus_set_led_status_payton(), led_id: 0, statusCode:0, systemEvent: 0xfffe

2016-01-19T15:37:44.683352-05:00 SPA122 54: 7c:69:3e:b1:a0 -- Upgrade failed: image write failed

2016-01-19T15:37:44.683436-05:00 SPA122 54: 7c:69:3e:b1:a0 -- Upgrade failed: image write failed

2016-01-19T15:37:44.683674-05:00 FMM >>>> Failed upgrade

2016-01-19T15:37:44.687683-05:00 XXXXXXXXX ** postupgrade handling (0, 1001)

2016-01-19T15:37:44.687873-05:00 XXXXXXXXX ** postupgrade handling (0, 1001)

2016-01-19T15:37:44.688301-05:00 FPRV >>>> failed upgrade . . . rebooting

2016-01-19T15:37:44.688507-05:00 system request reboot, type 8, reason 0x80, graceful 0

2016-01-19T15:39:11.229262-05:00 System started: ip@XXX.XXX.XXX.XXX, reboot reason:H0

I've tried using both HTTP and TFTP to get the SPA122 to download the firmware with the same result. I then tested logging into the admin interface and manually updating the firmware which also ended with a failed upgrade.

In the admin interface under the Memory Information I could see that the free memory was 9435 kB out of a total of 28416 kB. Since the firmware itself is 9962 kB I figured that the device didn't have enough free memory to fully download the firmware. I reset the voice and network settings to the factory default and cold rebooted the SPA122 after which the free memory showed 10208 kB. Sure enough, once there was enough free memory to cover the size of the firmware file it had no issues updating the firmware.

Should I not be able to update the firmware of the adapter after I've already provisioned it with user settings? If this is indeed a free memory issue causing the failed firmware update, can anything be done to avoid having to perform a factory reset just to free up enough memory to complete the update?

Dan Lukes · ‎01-19-2016

Did you verified the memory is used because of particular configuration ?

It may be just matter of uptime (I have memory leaks in the mind) so just reboot may be enough.

If we wish to upgrade phone, we do the power-cycle first (as we have bad experience with upgrade on phone with long uptime) but we never clear configuration (and I didn't heard it even from others). Well, it may be SPA122 specific problem, we are using SPA112.

Eric Iversen · ‎01-20-2016

I verified that the memory was not being used because of a particular configuration as there seems to be no way to effectively free up memory besides doing a cold reboot of the adapter.

I ran a capture of the traffic on my provisioning server during a TFTP firmware request from the SPA122 when the free memory was below that of the file size of the firmware file:

 0.000000 [SPA122] -> [PROVISIONING SERVER] TFTP Read Request, File: /SPA122.bin\000, Transfer type: octet\000
 0.001590 [PROVISIONING SERVER] -> [SPA122] TFTP Option Acknowledgement
 0.002830 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 0
 0.002930 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 1
 0.004000 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 1
 0.004088 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 2
 0.005095 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 2
 0.005166 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 3
 0.006364 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 3
 0.006445 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 4
 0.007465 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 4
 0.007542 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 5
 0.008007 [SPA122] -> [PROVISIONING SERVER] TFTP Error Code, Code: Disk full or allocation exceeded, Message: Buffer Full. \000
 0.016808 [SPA122] -> [PROVISIONING SERVER] ICMP Destination unreachable (Port unreachable)
12.542050 [SPA122] -> [PROVISIONING SERVER] TFTP Read Request, File: /SPA122.bin\000, Transfer type: octet\000
12.543493 [PROVISIONING SERVER] -> [SPA122] TFTP Option Acknowledgement
12.544560 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 0
12.544645 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 1
12.546056 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 1
12.546143 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 2
12.547365 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 2
12.547431 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 3
12.548678 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 3
12.548750 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 4
12.550194 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 4
12.550267 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 5
12.551563 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 5
12.551648 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 6
12.552894 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 6
12.552974 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 7
12.554309 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 7
12.554371 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 8
12.555664 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 8
12.555733 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 9
12.556980 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 9
12.557062 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 10
12.558310 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 10
12.558374 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 11
12.559620 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 11
12.559699 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 12
12.560940 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 12
12.561013 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 13
12.562280 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 13
12.562420 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 14
12.563674 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 14
12.563739 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 15
12.564990 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 15
12.565059 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 16
12.566341 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 16
12.566403 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 17
12.567957 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 17
12.568019 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 18
12.569547 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 18
12.569626 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 19
12.618067 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 19
12.618183 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 20
12.619689 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 20
12.619761 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 21
12.621270 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 21
12.621331 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 22
12.622834 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 22
12.622902 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 23
12.624446 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 23
12.624511 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 24
12.626129 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 24
12.626183 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 25
12.627733 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 25
12.627811 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 26
12.629347 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 26
12.629410 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 27
12.630929 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 27
12.630998 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 28
12.632519 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 28
12.632609 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 29
12.634334 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 29
12.634397 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 30
12.635934 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 30
12.636002 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 31
12.637564 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 31
12.637649 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 32
12.639178 [SPA122] -> [PROVISIONING SERVER] TFTP Acknowledgement, Block: 32
12.639241 [PROVISIONING SERVER] -> [SPA122] TFTP Data Packet, Block: 33
12.642960 [SPA122] -> [PROVISIONING SERVER] ICMP Destination unreachable (Port unreachable)

You can see that the SPA122 requests the firmware file, and a very short time later sends the TFTP server an error followed by an ICMP error:

TFTP Error Code, Code: Disk full or allocation exceeded, Message: Buffer Full. \000

ICMP Destination unreachable (Port unreachable)

The SPA122 then sends another request for the firmware file and after a short time again sends an ICMP error which causes the file transfer to be cut short. In order to make sure that this was not isolated to using TFTP to upgrade the firmware remotely I ran another capture while using HTTP as the file transfer protocol:

 0.000000 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=4294913530 TSER=0 WS=1
 0.000081 [PROVISIONING SERVER] -> [SPA122] TCP http > 39075 [SYN, ACK] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 TSV=1033040957 TSER=4294913530 WS=7
 0.001011 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=4294913530 TSER=1033040957
 0.002276 [SPA122] -> [PROVISIONING SERVER] HTTP GET /SPA122.bin HTTP/1.0 
 0.002328 [PROVISIONING SERVER] -> [SPA122] TCP http > 39075 [ACK] Seq=1 Ack=143 Win=15616 Len=0 TSV=1033040960 TSER=4294913531
 0.002863 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.002928 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.002960 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.003030 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.004291 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [ACK] Seq=143 Ack=1449 Win=8736 Len=0 TSV=4294913531 TSER=1033040960
 0.004320 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.004371 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.004506 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 0.005871 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [FIN, ACK] Seq=143 Ack=1449 Win=8736 Len=0 TSV=4294913532 TSER=1033040960
 0.014398 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 0.014602 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 0.014756 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 0.014896 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 0.015067 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 0.015201 [SPA122] -> [PROVISIONING SERVER] TCP 39075 > http [RST] Seq=143 Win=0 Len=0
 12.565819 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=4294916672 TSER=0 WS=1
 12.565894 [PROVISIONING SERVER] -> [SPA122] TCP http > 39076 [SYN, ACK] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 TSV=1033053523 TSER=4294916672 WS=7
 12.566985 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=4294916672 TSER=1033053523
 12.567876 [SPA122] -> [PROVISIONING SERVER] HTTP GET /SPA122.bin HTTP/1.0 
 12.567925 [PROVISIONING SERVER] -> [SPA122] TCP http > 39076 [ACK] Seq=1 Ack=143 Win=15616 Len=0 TSV=1033053525 TSER=4294916672
 12.568546 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.568652 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.568701 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.568751 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.569921 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=1449 Win=8736 Len=0 TSV=4294916673 TSER=1033053526
 12.569948 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.569999 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.570113 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571083 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=2897 Win=11632 Len=0 TSV=4294916673 TSER=1033053526
 12.571103 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571148 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571181 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571276 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=4345 Win=14528 Len=0 TSV=4294916673 TSER=1033053526
 12.571289 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571326 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571541 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=5793 Win=17424 Len=0 TSV=4294916673 TSER=1033053526
 12.571637 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571691 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571739 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.571806 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574585 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=7241 Win=20320 Len=0 TSV=4294916673 TSER=1033053527
 12.574601 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574641 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574673 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=8689 Win=23216 Len=0 TSV=4294916673 TSER=1033053527
 12.574682 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=10137 Win=26112 Len=0 TSV=4294916673 TSER=1033053527
 12.574693 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=11585 Win=29008 Len=0 TSV=4294916673 TSER=1033053528
 12.574702 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=13033 Win=31904 Len=0 TSV=4294916674 TSER=1033053528
 12.574706 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=14481 Win=34800 Len=0 TSV=4294916674 TSER=1033053528
 12.574709 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=15929 Win=37696 Len=0 TSV=4294916674 TSER=1033053528
 12.574712 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=17377 Win=40592 Len=0 TSV=4294916674 TSER=1033053528
 12.574715 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=18825 Win=43488 Len=0 TSV=4294916674 TSER=1033053529
 12.574765 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574825 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574856 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574880 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574915 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574966 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.574995 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.575029 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.575085 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.575115 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.575889 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=20273 Win=46384 Len=0 TSV=4294916674 TSER=1033053529
 12.575905 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.575935 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576118 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=21721 Win=49280 Len=0 TSV=4294916674 TSER=1033053529
 12.576305 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=23169 Win=52176 Len=0 TSV=4294916674 TSER=1033053529
 12.576535 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=24617 Win=55072 Len=0 TSV=4294916674 TSER=1033053532
 12.576598 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576661 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576763 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=26065 Win=57968 Len=0 TSV=4294916674 TSER=1033053532
 12.576801 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576838 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576872 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576920 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.576996 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=27513 Win=57688 Len=0 TSV=4294916674 TSER=1033053532
 12.577033 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.577216 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=28961 Win=56380 Len=0 TSV=4294916674 TSER=1033053532
 12.577237 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.578325 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=31857 Win=55072 Len=0 TSV=4294916675 TSER=1033053532
 12.578345 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.579227 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=33305 Win=60864 Len=0 TSV=4294916675 TSER=1033053532
 12.579433 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=34753 Win=62920 Len=0 TSV=4294916675 TSER=1033053532
 12.580198 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=40545 Win=58996 Len=0 TSV=4294916675 TSER=1033053532
 12.580270 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580346 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580389 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580419 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580472 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580516 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.580548 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.581391 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=41993 Win=64088 Len=0 TSV=4294916675 TSER=1033053533
 12.581412 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.582304 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=49233 Win=58996 Len=0 TSV=4294916676 TSER=1033053533
 12.582326 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583070 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=50878 Win=62920 Len=0 TSV=4294916676 TSER=1033053534
 12.583135 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583187 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583217 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583303 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583333 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.583381 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.584217 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=53774 Win=64088 Len=0 TSV=4294916676 TSER=1033053534
 12.584239 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.584281 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.584778 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=58118 Win=61612 Len=0 TSV=4294916676 TSER=1033053536
 12.585572 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=61014 Win=62920 Len=0 TSV=4294916677 TSER=1033053538
 12.585653 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.585706 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.585735 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.585819 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.585852 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.585877 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.586068 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=63910 Win=61612 Len=0 TSV=4294916677 TSER=1033053538
 12.586086 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.586127 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.586736 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=66806 Win=62920 Len=0 TSV=4294916677 TSER=1033053538
 12.587813 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=69702 Win=62920 Len=0 TSV=4294916677 TSER=1033053540
 12.588284 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=72598 Win=61612 Len=0 TSV=4294916677 TSER=1033053540
 12.588351 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.588421 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.588932 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=75494 Win=62920 Len=0 TSV=4294916677 TSER=1033053541
 12.589215 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589260 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589332 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589377 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589460 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589522 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589650 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=78390 Win=62920 Len=0 TSV=4294916678 TSER=1033053541
 12.589665 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.589695 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.590498 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=81286 Win=62920 Len=0 TSV=4294916678 TSER=1033053541
 12.591113 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=84182 Win=61612 Len=0 TSV=4294916678 TSER=1033053543
 12.640866 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [ACK] Seq=143 Ack=92870 Win=55072 Len=0 TSV=4294916690 TSER=1033053543
 12.641049 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641121 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641193 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641268 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641331 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641404 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641453 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641549 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641623 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.641669 [PROVISIONING SERVER] -> [SPA122] TCP [TCP segment of a reassembled PDU]
 12.652029 [SPA122] -> [PROVISIONING SERVER] TCP 39076 > http [RST, ACK] Seq=143 Ack=119102 Win=64088 Len=0 TSV=4294916693 TSER=1033053546

In this capture you can see the SYN, SYN, ACK followed by the start of the data transfer and a very short time later, the SPA122 sends a [SYN, ACK] followed by multiple RST (Reset) packets. The SPA122 then requests the firmware file again (SYN, SYN, ACK), the file transfer is started, and then a short time later the SPA122 sends a [RST, ACK] indicating that something has gone wrong and the file transfer should be stopped. The traffic behavior captured when using HTTP mirrors that of the TFTP capture.

Dan Lukes · ‎01-20-2016

Device fetch just small fragment of the file first. The fragment is used to identify of the firmware version.

If the firmware is different from the one already installed and suitable for device then full fetch follow.

It's common behavior, e.g. nothing suspicious.

SPA122 Firmware Upgrade Fails - Possible Memory Issue