Buy or Renew
Buy or Renew
Cisco + Splunk: It’s a new day for your data. Learn more.
 
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
3186
Views
6
Helpful
4
Replies

VoIP phone only working in one direction (VPN, Routing)

Go to solution
FabianDruschke90945
Level 1
Level 1

‎03-16-2020 06:39 AM

Ahoy friends.
Currently i got 2 networks connected via routing.

I got a Cisco SPA502G phone connected, and i want to make calls using my phone number in the home network.
It works almost fine, but no one is able to hear me.
The VoIP device connected (Cisco SPA502G) to one of the networks, to be routed to the other one.
Everything else is working on this configuration of the network, only the phone is having trouble.
Only i can hear persons speaking on the phone, but they can't hear me.


One, the remote network, having 192.168.1.0 subnet, the other, the home network 192.168.2.0.
They are connected using a wireguard VPN connection, 10.0.0.1 and 10.0.0.2 interface which is running fine.

 

dzZE7

 

 

Traceroute as well as Ping works in both directions, so the routes are running fine.

Even though, according to

tcpdump -i wg0 udp port 5060 or udp portrange 7078-7110 -s 0

there is a traffic in both directions, RTP traffic.
Also according to the Cisco Phone Web Interface there is a bi-directional traffic.
Here some part of the log, logged from the VPN peer in the target network.

 

 

21:56:13.398558 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.416811 IP 192.168.1.184.7092 > fritz.box.7094: UDP, length 162
21:56:13.418592 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.438534 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.443806 IP 192.168.1.184.7092 > fritz.box.7094: UDP, length 162
21:56:13.458529 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.469531 IP 192.168.1.184.7092 > fritz.box.7094: UDP, length 162
21:56:13.478549 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.498550 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112

 

 

I thought it might be a common NAT issue or routing issue, but it's none of them
So what can i try? Maybe another codec? Or something else?

Currently i'm trying out some things like NAT Mapping enable, other codes, but still the same problem.

0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Dan Lukes
VIP Alumni
VIP Alumni
In response to FabianDruschke90945

‎03-16-2020 12:10 PM - edited ‎03-16-2020 09:58 PM

Is it maybe helpful to create a specific NAT rule for the Cisco VoIP device?

I don't know the FritzBox, so I don't know what the "specific NAT rule" is.

 

All pairs of SUBSCRIBE/Bad Event and NOTIFY/Bad event are not relevant to the issue, so I removed them.

 

I grouped dialogs by the color, the red color is the exception - it's used on packets I see no response to them at all. And magenta is used on RTP. But because I see no content of packets, I'm guessing a lot.

 

Listening to the wg0 vpn tunnel interface.

 

13:22:22.400375 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.872843 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:22:22.894124 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.906735 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:22.910532 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.914438 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.229565 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:23.234085 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.414484 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.847622 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 100 Trying
13:22:23.887537 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 183 Session Progress
13:22:23.900008 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.919544 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.960314 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.981283 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.988293 IP SEPECE1A9CD116D.lan.7086 > 192.168.2.1.7094: UDP, length 252

I see lost INVITE and NOTIFY with no response. Also, I see two INVITE/Unauthorized pairs while only one should be seen.  It may mean the line is heavily overloaded and packets get lost. It's not good for SIP, but it seems to be unrelated to the issue.

The more important - SIP responses seems to be originated from 192.168.2.1 while related direction RTP packets seems to arrive from 10.0.0.1.  I'm almost (almost because I know no content of SIP packets) sure it's symptom of (NAT) bug. Those addresses should me same most of time.

 

Remote network's side, VPN peer. Listening to the Ethernet interface.

 

listening on enp1s0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:31:30.412506 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:30.416489 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 401 Unauthorized
12:31:30.753225 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.255353 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.272556 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 100 Trying
12:31:31.314519 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 183 Session Progress
12:31:31.316588 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.336671 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
...
12:31:31.456514 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172

Phone side uses wireguard.fritz.box for SIP, but RTP sent to phone are using 192.168.1.184. Suspicious and probably NAT bug. Also, I see RTP from proxy to phone only, not opposite side, but it can be correct if caller keeps silence. as connection is not fully established yet. Or dump argument has been wrong (thus RTP packet in this direction has not been captured).

 

Listening to wg0 interface on target network's side (192.168.2.0)

 

listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
12:34:01.311905 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.316094 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:01.810434 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.810711 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.813842 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:02.104388 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.349997 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.371778 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 100 Trying
12:34:05.411385 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 183 Session Progress
12:34:05.424992 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.445296 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172...
12:34:06.044995 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.063042 IP 192.168.1.184.7092 > fritz.box.7078: UDP, length 252
12:34:06.064976 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172

Same conclusion. Phone is sending packets to fritz.box (both SIP and RTP), SIP responses are received from fritz.box but RTP packets are arriving from 10.0.0.1. E.g. NAT bug.

 

Logging SIP only, and performing a simple call, and hanging up afterwards.

Little value. To debug NAT issues, you need to log SIP with content, simultaneously on both sides (e.g. as sent/received by phone and as received/send by SIP proxy) - and RTP packets, no content necesarry, just IP and port - also simultaneously on both sides.

X-RTP-Stat: CS=0;PS=124;ES=255;OS=19840;SP=0/0;SO=0;QS=-;PR=0;ER=255;OR=0;CR=0;SR=0;QR=-;PL=0,0;BL=0;LS=0;RB=0/0;SB=0/0;EN=PCMA;DE=;JI=0,0;DL=0,0,0;IP=192.168.2.1:7086,192.168.1.184:7094

X-RTP-Stat/PR=0 mean no RTP packet has been received. At least no packet considered valid.

 

Well. The final conclusion is - NAT issue. It seems the NAT is not SIP aware and doesn't translate RTP stream correctly. It can't be solved by tuning of configuration of phone, it needs to be tweaked on NAT device. While I know nothing about the box doing NAT, I can't advise.

 

OK. Now something different. It seems you have two LAN, both under your control, interconnected by VPN tunnel. Both LANs are using non overlapping IP network range, so they are routable. So why you are using NAT on the path at all ? It should not be necessary. No NAT mean no NAT issues ...

 

View solution in original post

4 Replies 4

Go to solution
Dan Lukes
VIP Alumni
VIP Alumni

‎03-16-2020 08:21 AM

Only i can hear persons speaking on the phone, but they can't hear me.

Unidirectional audio issue => firewall or NAT issue

according to

tcpdump -i wg0 udp port 5060 or udp portrange 7078-7110 -s 0

there is a traffic in both directions, RTP traffic.

Then it's no firewall - so it's NAT.

Packets may not arrive from IP addresses the phone expect them from (according SIP negotiation).

As you disclosed no dump of SIP, we can't judge. Moreover, we don't know where you captured even the packets disclosed.

 

21:56:13.398558 IP 10.0.0.1.7094 > 192.168.1.184.7092: UDP, length 112
21:56:13.416811 IP 192.168.1.184.7092 > fritz.box.7094: UDP, length 162

Well, despite the uncertainty of the source I mentioned above, it looks suspicious. While packets to 192.168.1.184:7092 are arriving from 10.0.0.1:7094 (and 10.0.0.1 can't be reverse-resolved to name), packets from 192.168.1.184:7092 are sent to an unknown IP that can be reverse resolved to name (fritz.box). So I assume the addresses are not the same. While it's plausible, it's rather uncommon. It's all I can tell with no content of SIP packets disclosed.

 

I thought it might be a common NAT issue or routing issue, but it's none of them

I have no enough information to either confirm nor reject such conclusion. You disclosed no evidence supporting it while my experience (and even your dump, despite I don't know where it has been captured) seems to support "it's NAT issue" hypothesis.

 

Maybe another codec?

No, codec is not the answer.

 

i'm trying out some things like NAT Mapping enable

I'm pretty sure it's NAT issue. Just to be sure - do you know that SIP can't pass a SIP-unaware NAT. So - does your NAT support SIP traffic ?

 

 

0 Helpful

Go to solution
FabianDruschke90945
Level 1
Level 1
In response to Dan Lukes

‎03-16-2020 09:44 AM

Thanks for your helpful message now, i think you are right because of the NAT issue.

Is it maybe helpful to create a specific NAT rule for the Cisco VoIP device?

 

I got some loggings now. fritz.box in the log before is the SIP proxy (192.168.2.1).

Here i got a log, made from the 2. router, the remote network, where the Cisco device is connected to. (192.168.1.1).

Listening to the wg0 vpn tunnel interface.

 

13:21:48.912507 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
13:21:49.304171 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 489 Bad Event
13:21:52.242579 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:21:52.544510 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 489 Bad Event
13:22:07.552661 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:22:07.864520 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 489 Bad Event
13:22:19.312670 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
13:22:19.605473 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 489 Bad Event
13:22:22.400375 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.872843 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:22:22.894124 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.906735 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:22.910532 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.914438 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.229565 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:23.234085 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.372427 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:22:23.414484 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.667652 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 489 Bad Event
13:22:23.847622 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 100 Trying
13:22:23.887537 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 183 Session Progress
13:22:23.900008 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.919544 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.960314 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.981283 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.988293 IP SEPECE1A9CD116D.lan.7086 > 192.168.2.1.7094: UDP, length 252

Remote network's side, VPN peer. Listening to the ethernet interface.

 

listening on enp1s0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:31:23.533327 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
12:31:23.537642 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 489 Bad Event
12:31:26.514293 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
12:31:26.517862 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 489 Bad Event
12:31:30.412506 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:30.416489 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 401 Unauthorized
12:31:30.753225 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.255353 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.272556 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 100 Trying
12:31:31.314519 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 183 Session Progress
12:31:31.316588 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.336671 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.356585 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.376506 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.396486 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.416494 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.436497 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.456514 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172

Listening to wg0 interface on target network's side (192.168.2.0)

 

listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
12:34:00.052143 IP 192.168.1.184.sip > fritz.box.sip: SIP: SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
12:34:00.056883 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 489 Bad Event
12:34:01.311905 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.316094 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:01.810434 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.810711 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.813842 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:02.104388 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.349997 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.371778 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 100 Trying
12:34:05.411385 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 183 Session Progress
12:34:05.424992 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.445296 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.464987 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.485025 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.504982 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.524979 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.545009 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.564976 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.585009 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.604997 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.625008 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.645009 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.664984 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.684991 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.704982 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.724980 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.745002 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.764986 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.785005 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.804985 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.824983 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.844988 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.864985 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.884993 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.904971 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.924984 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.944947 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.964970 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.984977 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.004938 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.024965 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.044995 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.063042 IP 192.168.1.184.7092 > fritz.box.7078: UDP, length 252
12:34:06.064976 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172

 

Logging SIP only, and performing a simple call, and hanging up afterwards.

tcpdump -vveni wg0 udp port 5060 -s 0

wg0 interface, target network's side.

tcpdump: listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
12:40:05.503626 ip: (tos 0x68, ttl 63, id 6609, offset 0, flags [none], proto UDP (17), length 525)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 497
	SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d901e9e3
	From: "Privat" <sip:chairman@192.168.2.1>;tag=9e1dcb3e391a2cc0
	To: "Privat" <sip:chairman@192.168.2.1>
	Call-ID: 371d109e-7c7fda06@192.168.1.184
	CSeq: 1001 SUBSCRIBE
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Accept: application/x-broadworks-callpark-info+xml
	Expires: 1800
	Event: x-broadworks-callpark
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
12:40:05.507054 ip: (tos 0x0, ttl 63, id 899, offset 0, flags [none], proto UDP (17), length 367)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 339
	SIP/2.0 489 Bad Event
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d901e9e3;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=9e1dcb3e391a2cc0
	To: "Privat" <sip:chairman@192.168.2.1>;tag=4126C0DEF090E7D2
	Call-ID: 371d109e-7c7fda06@192.168.1.184
	CSeq: 1001 SUBSCRIBE
	User-Agent: FRITZ!OS
	Content-Length: 0
	
12:40:07.523859 ip: (tos 0x68, ttl 63, id 6610, offset 0, flags [none], proto UDP (17), length 415)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 387
	NOTIFY sip:192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-2bba80a3
	From: "Privat" <sip:chairman@192.168.2.1>;tag=979b89a721e8bdffo0
	To: <sip:192.168.2.1>
	Call-ID: f1d95588-901dfb93@192.168.1.184
	CSeq: 481 NOTIFY
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Event: keep-alive
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
12:40:07.527148 ip: (tos 0x0, ttl 63, id 925, offset 0, flags [none], proto UDP (17), length 347)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 319
	SIP/2.0 489 Bad Event
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-2bba80a3;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=979b89a721e8bdffo0
	To: <sip:192.168.2.1>;tag=7BF9E6782933F544
	Call-ID: f1d95588-901dfb93@192.168.1.184
	CSeq: 481 NOTIFY
	User-Agent: FRITZ!OS
	Content-Length: 0
	
12:40:07.644696 ip: (tos 0x68, ttl 63, id 6611, offset 0, flags [none], proto UDP (17), length 877)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 849
	INVITE sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 INVITE
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Expires: 240
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 316
	Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
	Supported: replaces
	Content-Type: application/sdp
	
	v=0
	o=- 834586 834586 IN IP4 192.168.1.184
	s=-
	c=IN IP4 192.168.1.184
	t=0 0
	m=audio 7094 RTP/AVP 8 0 2 18 96 97 98
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:18 G729a/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=rtpmap:98 G726-16/8000
	a=ptime:30
	a=sendrecv
12:40:07.648716 ip: (tos 0x0, ttl 63, id 937, offset 0, flags [none], proto UDP (17), length 433)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 405
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=8D5D761DB3CA9DFA
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 INVITE
	WWW-Authenticate: Digest realm="fritz.box", nonce="5D44F4442C1D1A66"
	User-Agent: FRITZ!OS
	Content-Length: 0
	
12:40:07.962330 ip: (tos 0x68, ttl 63, id 6612, offset 0, flags [none], proto UDP (17), length 437)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 409
	ACK sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=8D5D761DB3CA9DFA
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 ACK
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
12:40:07.965529 ip: (tos 0x68, ttl 63, id 6613, offset 0, flags [none], proto UDP (17), length 1055)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 1027
	INVITE sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:017645991086@192.168.2.1",algorithm=MD5,response="6e5e212c7be0f68a7721acd38deaf61c"
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Expires: 240
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 316
	Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
	Supported: replaces
	Content-Type: application/sdp
	
	v=0
	o=- 834586 834586 IN IP4 192.168.1.184
	s=-
	c=IN IP4 192.168.1.184
	t=0 0
	m=audio 7094 RTP/AVP 8 0 2 18 96 97 98
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:18 G729a/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=rtpmap:98 G726-16/8000
	a=ptime:30
	a=sendrecv
12:40:07.984419 ip: (tos 0x0, ttl 63, id 943, offset 0, flags [none], proto UDP (17), length 373)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 345
	SIP/2.0 100 Trying
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Content-Length: 0
	
12:40:08.018649 ip: (tos 0x0, ttl 63, id 944, offset 0, flags [none], proto UDP (17), length 761)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 733
	SIP/2.0 183 Session Progress
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Contact: <sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1>
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Content-Type: application/sdp
	Content-Length:   264
	
	v=0
	o=user 13826494 13826494 IN IP4 192.168.2.1
	s=-
	c=IN IP4 192.168.2.1
	t=0 0
	m=audio 7086 RTP/AVP 8 0 2 96 97
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=sendrecv
	a=rtcp:7087
12:40:08.786629 ip: (tos 0x0, ttl 63, id 980, offset 0, flags [none], proto UDP (17), length 982)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 954
	SIP/2.0 200 OK
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Contact: <sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1>
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Supported: 100rel,replaces,timer
	Allow-Events: telephone-event,refer
	Allow: INVITE,ACK,OPTIONS,CANCEL,BYE,UPDATE,PRACK,INFO,SUBSCRIBE,NOTIFY,REFER,MESSAGE,PUBLISH
	Content-Type: application/sdp
	Accept: application/sdp, multipart/mixed
	Accept-Encoding: identity
	Content-Length:   264
	
	v=0
	o=user 13826494 13826494 IN IP4 192.168.2.1
	s=-
	c=IN IP4 192.168.2.1
	t=0 0
	m=audio 7086 RTP/AVP 8 0 2 96 97
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=sendrecv
	a=rtcp:7087
12:40:09.124456 ip: (tos 0x68, ttl 63, id 6641, offset 0, flags [none], proto UDP (17), length 633)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 605
	ACK sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-6f336dcd
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 ACK
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:017645991086@192.168.2.1",algorithm=MD5,response="6e5e212c7be0f68a7721acd38deaf61c"
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
12:40:13.094922 ip: (tos 0x68, ttl 63, id 6773, offset 0, flags [none], proto UDP (17), length 597)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 569
	BYE sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-3616154e
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 103 BYE
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1",algorithm=MD5,response="b90a5a04a96c1ca8d6055be58fd43020"
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
12:40:13.103956 ip: (tos 0x0, ttl 63, id 1077, offset 0, flags [none], proto UDP (17), length 716)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 688
	SIP/2.0 200 OK
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-3616154e;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 103 BYE
	X-RTP-Stat: CS=0;PS=124;ES=255;OS=19840;SP=0/0;SO=0;QS=-;PR=0;ER=255;OR=0;CR=0;SR=0;QR=-;PL=0,0;BL=0;LS=0;RB=0/0;SB=0/0;EN=PCMA;DE=;JI=0,0;DL=0,0,0;IP=192.168.2.1:7086,192.168.1.184:7094
	X-RTP-Stat-Add: DQ=0;DSS=0;DS=0;PLCS=0;JS=0
	X-SIP-Stat: DRT=0;IR=0
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Supported: 100rel,replaces,timer
	Allow-Events: telephone-event,refer
	Content-Length: 0

 

wg0 interface, remote network's side

 

tcpdump: listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
13:40:05.509917 ip: (tos 0x68, ttl 63, id 6609, offset 0, flags [none], proto UDP (17), length 525)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 497
	SUBSCRIBE sip:chairman@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d901e9e3
	From: "Privat" <sip:chairman@192.168.2.1>;tag=9e1dcb3e391a2cc0
	To: "Privat" <sip:chairman@192.168.2.1>
	Call-ID: 371d109e-7c7fda06@192.168.1.184
	CSeq: 1001 SUBSCRIBE
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Accept: application/x-broadworks-callpark-info+xml
	Expires: 1800
	Event: x-broadworks-callpark
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
13:40:05.897447 ip: (tos 0x0, ttl 63, id 899, offset 0, flags [none], proto UDP (17), length 367)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 339
	SIP/2.0 489 Bad Event
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d901e9e3;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=9e1dcb3e391a2cc0
	To: "Privat" <sip:chairman@192.168.2.1>;tag=4126C0DEF090E7D2
	Call-ID: 371d109e-7c7fda06@192.168.1.184
	CSeq: 1001 SUBSCRIBE
	User-Agent: FRITZ!OS
	Content-Length: 0
	
13:40:07.529941 ip: (tos 0x68, ttl 63, id 6610, offset 0, flags [none], proto UDP (17), length 415)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 387
	NOTIFY sip:192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-2bba80a3
	From: "Privat" <sip:chairman@192.168.2.1>;tag=979b89a721e8bdffo0
	To: <sip:192.168.2.1>
	Call-ID: f1d95588-901dfb93@192.168.1.184
	CSeq: 481 NOTIFY
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Event: keep-alive
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
13:40:07.650437 ip: (tos 0x68, ttl 63, id 6611, offset 0, flags [none], proto UDP (17), length 877)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 849
	INVITE sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 INVITE
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Expires: 240
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 316
	Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
	Supported: replaces
	Content-Type: application/sdp
	
	v=0
	o=- 834586 834586 IN IP4 192.168.1.184
	s=-
	c=IN IP4 192.168.1.184
	t=0 0
	m=audio 7094 RTP/AVP 8 0 2 18 96 97 98
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:18 G729a/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=rtpmap:98 G726-16/8000
	a=ptime:30
	a=sendrecv
13:40:07.823808 ip: (tos 0x0, ttl 63, id 925, offset 0, flags [none], proto UDP (17), length 347)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 319
	SIP/2.0 489 Bad Event
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-2bba80a3;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=979b89a721e8bdffo0
	To: <sip:192.168.2.1>;tag=7BF9E6782933F544
	Call-ID: f1d95588-901dfb93@192.168.1.184
	CSeq: 481 NOTIFY
	User-Agent: FRITZ!OS
	Content-Length: 0
	
13:40:07.965431 ip: (tos 0x0, ttl 63, id 937, offset 0, flags [none], proto UDP (17), length 433)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 405
	SIP/2.0 401 Unauthorized
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=8D5D761DB3CA9DFA
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 INVITE
	WWW-Authenticate: Digest realm="fritz.box", nonce="5D44F4442C1D1A66"
	User-Agent: FRITZ!OS
	Content-Length: 0
	
13:40:07.971491 ip: (tos 0x68, ttl 63, id 6612, offset 0, flags [none], proto UDP (17), length 437)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 409
	ACK sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-e8e54f1b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=8D5D761DB3CA9DFA
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 101 ACK
	Max-Forwards: 70
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
13:40:07.976456 ip: (tos 0x68, ttl 63, id 6613, offset 0, flags [none], proto UDP (17), length 1055)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 1027
	INVITE sip:017645991086@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:017645991086@192.168.2.1",algorithm=MD5,response="6e5e212c7be0f68a7721acd38deaf61c"
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	Expires: 240
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 316
	Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
	Supported: replaces
	Content-Type: application/sdp
	
	v=0
	o=- 834586 834586 IN IP4 192.168.1.184
	s=-
	c=IN IP4 192.168.1.184
	t=0 0
	m=audio 7094 RTP/AVP 8 0 2 18 96 97 98
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:18 G729a/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=rtpmap:98 G726-16/8000
	a=ptime:30
	a=sendrecv
13:40:08.297609 ip: (tos 0x0, ttl 63, id 943, offset 0, flags [none], proto UDP (17), length 373)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 345
	SIP/2.0 100 Trying
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Content-Length: 0
	
13:40:08.321161 ip: (tos 0x0, ttl 63, id 944, offset 0, flags [none], proto UDP (17), length 761)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 733
	SIP/2.0 183 Session Progress
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Contact: <sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1>
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Content-Type: application/sdp
	Content-Length:   264
	
	v=0
	o=user 13826494 13826494 IN IP4 192.168.2.1
	s=-
	c=IN IP4 192.168.2.1
	t=0 0
	m=audio 7086 RTP/AVP 8 0 2 96 97
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=sendrecv
	a=rtcp:7087
13:40:09.103398 ip: (tos 0x0, ttl 63, id 980, offset 0, flags [none], proto UDP (17), length 982)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 954
	SIP/2.0 200 OK
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-d2ba81b;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 INVITE
	Contact: <sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1>
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Supported: 100rel,replaces,timer
	Allow-Events: telephone-event,refer
	Allow: INVITE,ACK,OPTIONS,CANCEL,BYE,UPDATE,PRACK,INFO,SUBSCRIBE,NOTIFY,REFER,MESSAGE,PUBLISH
	Content-Type: application/sdp
	Accept: application/sdp, multipart/mixed
	Accept-Encoding: identity
	Content-Length:   264
	
	v=0
	o=user 13826494 13826494 IN IP4 192.168.2.1
	s=-
	c=IN IP4 192.168.2.1
	t=0 0
	m=audio 7086 RTP/AVP 8 0 2 96 97
	a=rtpmap:8 PCMA/8000
	a=rtpmap:0 PCMU/8000
	a=rtpmap:2 G726-32/8000
	a=rtpmap:96 G726-40/8000
	a=rtpmap:97 G726-24/8000
	a=sendrecv
	a=rtcp:7087
13:40:09.136096 ip: (tos 0x68, ttl 63, id 6641, offset 0, flags [none], proto UDP (17), length 633)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 605
	ACK sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-6f336dcd
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 102 ACK
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:017645991086@192.168.2.1",algorithm=MD5,response="6e5e212c7be0f68a7721acd38deaf61c"
	Contact: "Privat" <sip:chairman@192.168.1.184:5060>
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
13:40:13.061585 ip: (tos 0x68, ttl 63, id 6773, offset 0, flags [none], proto UDP (17), length 597)
    192.168.1.184.5060 > 192.168.2.1.5060: [udp sum ok] SIP, length: 569
	BYE sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1 SIP/2.0
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-3616154e
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 103 BYE
	Max-Forwards: 70
	Authorization: Digest username="chairman",realm="fritz.box",nonce="5D44F4442C1D1A66",uri="sip:E9AF4CACEE245A34F0E8576442CD5@192.168.2.1",algorithm=MD5,response="b90a5a04a96c1ca8d6055be58fd43020"
	User-Agent: Cisco/SPA502G-7.6.2f
	Content-Length: 0
	
13:40:13.405413 ip: (tos 0x0, ttl 63, id 1077, offset 0, flags [none], proto UDP (17), length 716)
    192.168.2.1.5060 > 192.168.1.184.5060: [udp sum ok] SIP, length: 688
	SIP/2.0 200 OK
	Via: SIP/2.0/UDP 192.168.1.184:5060;branch=z9hG4bK-3616154e;received=192.168.2.57
	From: "Privat" <sip:chairman@192.168.2.1>;tag=948a5cf6aa0f461bo0
	To: <sip:017645991086@192.168.2.1>;tag=CE95DDF28461E7BD
	Call-ID: ed5b2e52-1037446f@192.168.1.184
	CSeq: 103 BYE
	X-RTP-Stat: CS=0;PS=124;ES=255;OS=19840;SP=0/0;SO=0;QS=-;PR=0;ER=255;OR=0;CR=0;SR=0;QR=-;PL=0,0;BL=0;LS=0;RB=0/0;SB=0/0;EN=PCMA;DE=;JI=0,0;DL=0,0,0;IP=192.168.2.1:7086,192.168.1.184:7094
	X-RTP-Stat-Add: DQ=0;DSS=0;DS=0;PLCS=0;JS=0
	X-SIP-Stat: DRT=0;IR=0
	User-Agent: AVM FRITZ!Box 7490 113.07.12 TAL (Jul  3 2019)
	Supported: 100rel,replaces,timer
	Allow-Events: telephone-event,refer
	Content-Length: 0

If you need more information, please notfiy.

0 Helpful

Go to solution
Dan Lukes
VIP Alumni
VIP Alumni
In response to FabianDruschke90945

‎03-16-2020 12:10 PM - edited ‎03-16-2020 09:58 PM

Is it maybe helpful to create a specific NAT rule for the Cisco VoIP device?

I don't know the FritzBox, so I don't know what the "specific NAT rule" is.

 

All pairs of SUBSCRIBE/Bad Event and NOTIFY/Bad event are not relevant to the issue, so I removed them.

 

I grouped dialogs by the color, the red color is the exception - it's used on packets I see no response to them at all. And magenta is used on RTP. But because I see no content of packets, I'm guessing a lot.

 

Listening to the wg0 vpn tunnel interface.

 

13:22:22.400375 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.872843 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: NOTIFY sip:192.168.2.1 SIP/2.0
13:22:22.894124 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.906735 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:22.910532 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:22.914438 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.229565 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 401 Unauthorized
13:22:23.234085 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: ACK sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.414484 IP SEPECE1A9CD116D.lan.5060 > 192.168.2.1.5060: SIP: INVITE sip:01742937537@192.168.2.1 SIP/2.0
13:22:23.847622 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 100 Trying
13:22:23.887537 IP 192.168.2.1.5060 > SEPECE1A9CD116D.lan.5060: SIP: SIP/2.0 183 Session Progress
13:22:23.900008 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.919544 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.960314 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.981283 IP 10.0.0.1.7094 > SEPECE1A9CD116D.lan.7086: UDP, length 172
13:22:23.988293 IP SEPECE1A9CD116D.lan.7086 > 192.168.2.1.7094: UDP, length 252

I see lost INVITE and NOTIFY with no response. Also, I see two INVITE/Unauthorized pairs while only one should be seen.  It may mean the line is heavily overloaded and packets get lost. It's not good for SIP, but it seems to be unrelated to the issue.

The more important - SIP responses seems to be originated from 192.168.2.1 while related direction RTP packets seems to arrive from 10.0.0.1.  I'm almost (almost because I know no content of SIP packets) sure it's symptom of (NAT) bug. Those addresses should me same most of time.

 

Remote network's side, VPN peer. Listening to the Ethernet interface.

 

listening on enp1s0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:31:30.412506 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:30.416489 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 401 Unauthorized
12:31:30.753225 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.255353 IP wireguard.fritz.box.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:31:31.272556 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 100 Trying
12:31:31.314519 IP fritz.box.sip > wireguard.fritz.box.sip: SIP: SIP/2.0 183 Session Progress
12:31:31.316588 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
12:31:31.336671 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172
...
12:31:31.456514 IP fritz.box.7090 > 192.168.1.184.7088: UDP, length 172

Phone side uses wireguard.fritz.box for SIP, but RTP sent to phone are using 192.168.1.184. Suspicious and probably NAT bug. Also, I see RTP from proxy to phone only, not opposite side, but it can be correct if caller keeps silence. as connection is not fully established yet. Or dump argument has been wrong (thus RTP packet in this direction has not been captured).

 

Listening to wg0 interface on target network's side (192.168.2.0)

 

listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
12:34:01.311905 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.316094 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:01.810434 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.810711 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:01.813842 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 401 Unauthorized
12:34:02.104388 IP 192.168.1.184.sip > fritz.box.sip: SIP: ACK sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.349997 IP 192.168.1.184.sip > fritz.box.sip: SIP: INVITE sip:017645991086@192.168.2.1 SIP/2.0
12:34:05.371778 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 100 Trying
12:34:05.411385 IP fritz.box.sip > 192.168.1.184.sip: SIP: SIP/2.0 183 Session Progress
12:34:05.424992 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:05.445296 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172...
12:34:06.044995 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172
12:34:06.063042 IP 192.168.1.184.7092 > fritz.box.7078: UDP, length 252
12:34:06.064976 IP 10.0.0.1.7078 > 192.168.1.184.7092: UDP, length 172

Same conclusion. Phone is sending packets to fritz.box (both SIP and RTP), SIP responses are received from fritz.box but RTP packets are arriving from 10.0.0.1. E.g. NAT bug.

 

Logging SIP only, and performing a simple call, and hanging up afterwards.

Little value. To debug NAT issues, you need to log SIP with content, simultaneously on both sides (e.g. as sent/received by phone and as received/send by SIP proxy) - and RTP packets, no content necesarry, just IP and port - also simultaneously on both sides.

X-RTP-Stat: CS=0;PS=124;ES=255;OS=19840;SP=0/0;SO=0;QS=-;PR=0;ER=255;OR=0;CR=0;SR=0;QR=-;PL=0,0;BL=0;LS=0;RB=0/0;SB=0/0;EN=PCMA;DE=;JI=0,0;DL=0,0,0;IP=192.168.2.1:7086,192.168.1.184:7094

X-RTP-Stat/PR=0 mean no RTP packet has been received. At least no packet considered valid.

 

Well. The final conclusion is - NAT issue. It seems the NAT is not SIP aware and doesn't translate RTP stream correctly. It can't be solved by tuning of configuration of phone, it needs to be tweaked on NAT device. While I know nothing about the box doing NAT, I can't advise.

 

OK. Now something different. It seems you have two LAN, both under your control, interconnected by VPN tunnel. Both LANs are using non overlapping IP network range, so they are routable. So why you are using NAT on the path at all ? It should not be necessary. No NAT mean no NAT issues ...

 

Go to solution
FabianDruschke90945
Level 1
Level 1
In response to Dan Lukes

‎03-16-2020 12:23 PM

Thanks for your advice in order to get a clue!
I'll work on this issue , now knowing what it is.
0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents