H.245 Socket Error

Pollux9575 · ‎05-14-2013

Hello

Im often get the following error in the CDR_log:

Participant "No" (<<IP>>) left the conference

Disconnect reason "H.245 socket error"; Time in conference <Time> ; Participant called in; Protocol "H.323"; Media encryption status "encrypted"

Any Ideas how i can handle this Problem?

Are there any Options/ tools to check where the Problem occurs?

Is this a Problem of an endpoint, or network, system- MCU etc.?

Somtimes i got this error from external endpoints which are connecting to our mcu

Thanks in advance

BR

Alex

ahmashar · ‎05-14-2013

Most commonly this disconnection reason comes in the event log if there is unexpected
H.225/H.245 connection drops during the call (and MCU can't send conference control 
message to Endpoint over such connection). check all endpoints and MCU registered to
same VCS.

Pollux9575 · ‎05-15-2013

Hello

Thanks for your reply. I ve checked the Connection and the Settings, but these 3 Endpoints where i m getting the Error have the correct Settings, same MCU, same Registration to the same VCS.

Endpoint SX20 Versions: TC5.1.3.292001 , TC5.1.4.295090

VCS: X7.1

MCU: 4.3

Any other ideas?

Thank you in advance

BG

Alex

sagsheth · ‎05-15-2013

Hi Alex,

H245 is sub set of h323 protocol and is used in call siganlling (exchanging capsets, master slave, opening logical channel etc), when there is call drop and you see this message in event logs, it ,means that H245 sockets are closed.

We have seen such issue where any intermiate device closes the TCP connection or you get TCP_RST for this connection from router or firewall.

I would suggest to check following

1. Does this happens to all endpoints

2. Does this happens after a specific time period like 15 mins or 20 mins

3. If you can reproduce issue, do packet capture on endpoint, look for TCP reset for this H245 connection or upload it here and i will look into it.

Regards,
Sagar

Pollux9575 · ‎05-15-2013

Hello Sagar

Thanks for your answer.

1) It happens only on a few endpoints at the moment.

2) Sorry but there is no specific Time Period where the error occures. It can happen between 2 Minutes up to 2 hours.

3) How you ll doing the packet Capture on TC 5.1.4 Endpoint? or MCU?

Thank you

Best Regards

Alex

sagsheth · ‎05-16-2013

Hi Alex,

I am attaching a handbook. You can refer to this handbook which describes best way to capture logs and packets.

To capture packets from MCU you need serial connection, you cannot telnet/ssh to MCU

Regards,

Sagar

ahmashar · ‎05-16-2013

An alternative way of collecting tcpdump/logs for devices that do not provide ssh connection such as MCU is to have your pc on the same subnet as the MCU or whatever else you are interested to collect logs for and run wireshark on the line.

natroxby · ‎06-03-2013

Hi Ahmad,

Just as an FYI for the MCU, there is an alternative to having a PC connected on the same subnet as the MCU to run a wireshark "on the line" if you want to gather the specific packets coming in & out of the MCU.

You will however need to have a serial/console connection to the MCU.

It is a very similar process to capturing a wireshark from the VCS. The MCU is capable of performing a wireshark from it's own command line.

Sniffer the packet on TelePresence MCU or IP/ISDN Gateway

Note: Require 2.4 or newer released software on MCU.
Important: This works on both H.323 and SIP call, however it must disable encryption. For SIP, make sure not to use TLS for signaling.
Important: Make sure to have compact flash card in the TelePresence MCU or ISDN/IP Gateway Products external slot.

 Open the console session
 nettap –s bge0 for Port A sniffer (nettap vfx0 for 8510 MCU Blade)
or
 nettap –s bge1 for Port B sniffer

Cheers.

Nathan

Pollux9575 · ‎05-29-2013

Hello

I set the VCSE on log level 3, now im getting a H.225 Error. I ll post the last Logentires from the VCSE.

May 29 13:35:35

tvcs: Event="Call Disconnected" Service="H323" Src-ip="Endpoint A IP" Src-port="11010" Src-alias-type="H323" Src-alias="Endpoint A" Src-alias-type="E164" Src-alias="114312" Dst-alias-type="H323" Dst-alias="

DST-Alias" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="1" UTCTime="2013-05-29 11:35:35,755"

May 29 13:35:30

tvcs: Event="Message Received" Service="H.225" Message-type="DRQ" Src-ip="Endpoint A IP" Src-port="1719" Dst-ip="VCSE_IP_A" Dst-port="1719" Call-serial-number="SN" Tag="TAG" Protocol="UDP" Level="2" UTCTime="2013-05-29 11:35:30,767"

May 29 13:35:28

tvcs: Event="Message Sent" Service="H.245" Message-type="EndSessionCommand" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,770"

May 29 13:35:28

tvcs: Event="Message Received" Service="H.245" Message-type="EndSessionCommand" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,770"

May 29 13:35:28

tvcs: Event="Message Sent" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Detail="LCN:3" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,486"

May 29 13:35:28

tvcs: Event="Message Received" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Detail="LCN:3" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,486"

May 29 13:35:28

tvcs: Event="Message Sent" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Detail="LCN:2" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,485"

May 29 13:35:28

tvcs: Event="Message Received" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Detail="LCN:2" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,485"

May 29 13:35:28

tvcs: Event="Message Sent" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Detail="LCN:1" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,479"

May 29 13:35:28

tvcs: Event="Message Received" Service="H.245" Message-type="CloseLogicalChannelRequest" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Detail="LCN:1" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:28,479"

May 29 13:35:23

tvcs: Event="Message Sent" Service="H.245" Message-type="KeepAlive" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:23,125"

May 29 13:35:03

tvcs: Event="Message Sent" Service="H.245" Message-type="RoundTripDelayRequest" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:03,475"

May 29 13:35:03

tvcs: Event="Message Received" Service="H.245" Message-type="RoundTripDelayRequest" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:03,475"

May 29 13:35:03

tvcs: Event="Message Sent" Service="H.245" Message-type="KeepAlive" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:35:03,124"

May 29 13:34:43

tvcs: Event="Message Sent" Service="H.245" Message-type="KeepAlive" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:34:43,124"

May 29 13:34:37

tvcs: Event="Message Sent" Service="H.245" Message-type="MiscellaneousCommand" Src-ip="VCSE_IP_A" Src-port="15341" Dst-ip="VCSE_IP_B" Dst-port="2776" Call-serial-number="SN" Tag="TAG" Detail="VIDEO_FAST_UPDATE_PICTURE" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:34:37,275"

May 29 13:34:37

tvcs: Event="Message Received" Service="H.245" Message-type="MiscellaneousCommand" Src-ip="Endpoint A IP" Src-port="11011" Dst-ip="VCSE_IP_A" Dst-port="15340" Call-serial-number="SN" Tag="TAG" Detail="VIDEO_FAST_UPDATE_PICTURE" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:34:37,275"

May 29 13:34:33

tvcs: Event="Message Sent" Service="H.245" Message-type="RoundTripDelayResponse" Src-ip="VCSE_IP_A" Src-port="15340" Dst-ip="Endpoint A IP" Dst-port="11011" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:34:33,480"

May 29 13:34:33

tvcs: Event="Message Received" Service="H.245" Message-type="RoundTripDelayResponse" Src-ip="VCSE_IP_B" Src-port="2776" Dst-ip="VCSE_IP_A" Dst-port="15341" Call-serial-number="SN" Tag="TAG" Protocol="TCP" Level="3" UTCTime="2013-05-29 11:34:33,480"

The Log says that the Codec sent an "End Session Command" but the MCU says H.225 Socket Error.

Are there any Timeouts for Keep alive or something?

Thanks for Your Answer.

mubakhta · ‎05-29-2013

Hi Alex,

We normally see the following messages where the connection is experiencing packetloss issues:

Detail="VIDEO_FAST_UPDATE_PICTURE"

Yes, there are keepalives during the session once the call has been established. Those are referred to Round Trip Delays. These act as keepalives to make sure that the connection is active. I would recommend you to check if the connection is experiencing packetloss.

This could be more or less related to issues caused due to the network congestion.

Thanks

Mubashshir Akhtar
TelePresence Solution Group

Thanks Mubashshir Akhtar

mubakhta · ‎05-29-2013

Just to add, I can see the Round Trip Delay requests as well in the logs:

tvcs: Event="Message Received" Service="H.245" Message-type="RoundTripDelayResponse"

So I believe the keepalives are working, it's just that we're having connection issues which might be the reason for call drops.

Thanks

Mubashshir Akhtar
TelePresence Solution Group

Thanks Mubashshir Akhtar

Pollux9575 · ‎05-31-2013

Hello

Thanks for your answer.

I made 2 Testconferences between 2 different Networks. From an Endpoint to an MCU-Test-Room:

First:

VCSE-Log from the Endpoint Network:

May 22 16:16:17 cisco tvcs: Event="Call Disconnected" Service="H323" Src-ip="1.2.3.4" Src-port="11001" Src-alias-type="H323" Src-alias="Test-Endpoint" Src-alias-type="E164" Src-alias="1234" Dst-alias-type="H323" Dst-alias="

Dst-Adress" Call-serial-number="abcd" Tag="efgh" Protocol="TCP" Level="1" UTCTime="2013-05-22 14:16:17,295"

MCU-CDR-Log Different Network:

45056

16:31:13

1234

Participant "185" (4.3.2.1) left the conference <<
Disconnect reason "H.245 socket error"; Time in conference 1 hrs 15 mins 28 sec; Participant called in; Protocol "H.323"; Media encryption status "encrypted"
Endpoint: IP address "1.2.3.4"; DN "114312"; H.323 alias "Test-Endpoint"
Media from endpoint:Bandwidth 1.92 Mbit/s; Audio codec "AAC"; Video codec "H.264"; Video resolution "1280 x 768"
Media to endpoint:Bandwidth 1.92 Mbit/s; Audio codec "AAC"; Video codec "H.264"; Video resolution "1280 x 1632"

Second:

VCSE-Log from the Endpoint Network.

May 29 16:06:38 tvcs: Event="Call Disconnected" Service="H323" Src-ip="1.2.3.4" Src-port="15354" Src-alias-type="H323" Src-alias="Test-Endpoint" Src-alias-type="E164" Src-alias="1234" Dst-alias-type="H323" Dst-alias="Dst-adress" Call-serial-number="abcde" Tag="efgh" Protocol="TCP" Level="1" UTCTime="2013-05-29 14:06:38,212"

MCU CDR-Log Different Network.

46420

16:21:34

1234

Participant "218" (4.3.2.1) left the conference <<
Disconnect reason "H.245 socket error"; Time in conference 1 hrs 15 mins 29 sec; Participant called in; Protocol "H.323"; Media encryption status "encrypted"
Endpoint: IP address "1.2.3.4"; DN "114312"; H.323 alias "Test-Endpoint"
Media from endpoint:Bandwidth 1.92 Mbit/s; Audio codec "AAC"; Video codec "H.264"; Video resolution "1280 x 768"
Media to endpoint:Bandwidth 1.92 Mbit/s; Audio codec "AAC"; Video codec "H.264"; Video resolution "1280 x 1632"

Very interessting is the 15 Minutes Timedelay between both Entries. Is there an fixed Timeout for H.245 Error?

Also very interessting is the same Time when both conferences were disconnected.

When the Error appear within one network, the disconnect Time is different, not 1.15 h.

Thanks for your answer.

BR

Alex

Martin Koch · ‎06-04-2013

In general if I see error messages like that I would check if there is any kind of

layer-3 device (router, firewall, l3-switch, alg, nat, ....) which is messing something up.

There are MCU4.4, VCS X7.2.x, TC6.1.x out.

Did you check if other software versions work fine?For example other TC?

If you know that a specific version works try again with that one on the problematical known systems.

If calls still get disconnected check the firewalls again ;-)

Please remember to rate helpful responses and identify

Yan Simkin · ‎11-07-2014

Hi Martin,

I'm using MCU 4.4, VCS X7.2, TC7. This is not SW version related, we get a few cases daily with this error. Could happen to any endpoint, at any time. The most funny part is that point-to-point calls don't get dropped, only multipoint.

Thanks