[SOLVED] Odd SIP Issue - "182 Queued"

[danplacek]

We had a customer yesterday who stopped recevinging incoming calls.

The issue was fixed by a reboot, and unfortunately I did not keep a copy of the logs.

However, what seemed to be happening is that incoming SIP INVITE's were getting a "182 Queued" message back instead of "180 Ringing" as expected, so when you called you did not hear any ringback, and the call never went through... even this it was "connected".

Anyone have any insight into how this could happen or what that particular status code means?

Thanks.

Message was edited by: Daniel Placek

[danplacek]

Update:

We have found an interesting CDR record that shows up right before the system locks up and stops accepting calls.

Below are 2 screenshots from the last 2 times it happened.

An incoming call with unknown CLID/CNAM comes in... following that the system accepts no further calls.

-------------------------

[danplacek]

Mystery solved.

It appears to be a security problem on our SIP providers end. We did a long running packet capture in between the UC320 and the provider IAD.

Immediately preceding this issue we found:

INVITE sip:9011441212790843@64.179.x.x, with session description

INVITE sip:8011441212790841@64.179.x.x, with session description

INVITE sip:1#011441212790840@64.179.x.x, with session description

There were many calls in a row like this -- it appears to be attempted toll fraud.

The UC320 appears to accept the first 12 calls, then spits back "182 Queued" to all the rest that come in.

Because we had the AA setup to "Return to Main Menu" on timeout (instead of endcall) and the person sending these bogus requests was not sending "BYE"'s, the calls got hung, and any further calls got "Queued".

We are going to work with the provider on this... but it sure would be really nice if you could setup a UC320 to reject any calls to DIDs not defined in the incoming dial plan.

Thanks for all of your assistance.

[rbordner]

Daniel,

Thank you for the update on this outstanding item. 

One question, was the source IP address of the inbound calls from your SIP provider? The UC320W does block inbound calls from IP addresses that are not registered via the configured SIP trunk.  (There are some corner cases where we generated some PMF's to allow inbound calls on multiple IP's).

Thanks again for your update.

Randy

[danplacek]

Yes they were sourced from the provider -- that's why I identified it as a provider security problem.

It is SIP delivered over a T1 with QOS; they have a AdTran IAD on site as an SBC... it clearly has some access list problems.

Dan