flooding UDP with sip phone 8945 to provider SBC

[Gilles Dellaccio]

Hi,

I have problem with a UDP flooding from all sip phone 8945 (they are 90 phone) to the SIP SBC provider.

The sip provider is Orange with a trunk SIP « Business Talk IP ».

System version of CUCM (BE6000) is 9.1.2.11900-12

This flooding saturate bandwidth and we a very bad voice stream quality

I have upgrade the sip phone (8945) from SIP8941_8945.9-3-4-17 to SIP894x.9-4-2SR1-2.

After the phone reboot the UDP flooding have disappeared and the bandwith it’s ok and voice quality also.

But after for 1 business day this flooding is beginning to reappear

i have monitoring the traffic, and i can see RTP packet, the voice stream from ip phone to SBC and SBC to phone, but i can also see a lot of UDP paquet from ip phone to SBC, the udp packet is abnormal.

Why the ip phone send UDP packet to the SBC other than RTP paquet ?

Thanks

[Leo Salcie Tejeda · Accepted solution]

Hi Gilles,

There's not reason why a IP Phone will start sending UDP packet to a SBC without ay reason at all. Are you sure is not a established call? Maybe all calls are not disconnecting for any reason.

Could you please attach some diagram?

[Gilles Dellaccio]

If i seen the trunk sip utilization in the rtmt, there are no communication use.

and the night they are this problem with no body at the site (just on gardian).

[Aditya Gupta]

Hi Gilles

Can you explain the call flow here ? Is your CUCM with the provider or at the customer site ?

Also can you provide the ip address of few phones that can be traced in the packet capture.

First of all we need to find in the udp what kind of packets is the phone sending to your provider.

Then why is doing that and finally eliminate that reason to fix the issue.

Regards

Aditya Gupta

[Gilles Dellaccio]

The call flow CUCM with provider

In the CUCM cluster, publisher have ip address 10.10.7.11 and subscriber 10.10.7.21.

Th ip pool phone is 10.10.7.30 to 230

The ip address of the SBC’s provider is 10.32.61.2 (SBC backup 10.32.61.10).

[Aditya Gupta]

If your CUCM is with the provider then, you can expect some traffic as phones will exchange keepalives with CUCM every few minutes.

Although in the capture i didn't saw any keepalive traffic instead there was lot VRRP traffic.

Regards

Aditya Gupta

[Gilles Dellaccio]

for the vrrp, it's because they are 2 router for access to provider.

the keep alive with CUCM and phone don't appears in trace because i monitor the interconnect switch port to provider's access, see my attachment file "schema.png"

[Aditya Gupta]

Can you take simultaneous capture from back of a phone and your switch interface , so we can compare.

Regards

Aditya Gupta

[Aditya Gupta]

If capturing from back of phone is not possible, span the traffic from the switch interface where phone is connected.

[Gilles Dellaccio]

actualy i can't do this, because i have reset ip-phone and the problem have disappearred.

i wait the problem's reappearrance and do this.