This is not a question. I just thought I'd post this here in case somebody else runs into this problem. We are in the process of rolling out an SD-WAN product. A small number of branches have reported strange network issues and in the case of two sites, they noticed that SIP phones (8851s) were repeatedly re-registering. When looking at the SD-WAN analytics/monitoring data we didn't see any obvious signs that would suggest that packet loss, latency or jitter were a problem. Certainly not enough of a problem to explain 2-3 re-registers per hour 24x7. The console logs showed messages like "Socket Error", "No route to host" and "reportSockFailure : Socket Error=[113]". Ultimately, the root cause of this was that the SD-WAN router was connected to the Internet behind a modem in bridged mode and it was on a very large IP network (/19) and was receiving > 35,000 ARP message per minute (>600/sec). This was triggering CoPP on the SD-WAN router and causing it to drop legitimate ARP queries coming from the SIP phone on the LAN interface. This caused the SIP phone to momentarily lose its ability to route off-net (thus the "No route to host") and eventually cause it to close out the socket. Increasing the arp rate-limit configuration on the SD-WAN router stabilized the SIP phone.
