Ulrich Weber <ulrich.weber@xxxxxxxxx> wrote: > we had a customer with a Cisco Phone using SIP over TCP > which subscribed to 15 Phone numbers. > > Since 15 subscribe calls dont fit in one packet, these > requests were fragmented in multiple TCP packets. > > One of these fragments gets rejected then by nf_conntrack_sip with: > nf_ct_sip: dropping packet: cannot parse cseq > > The Cisco phone will send retransmits, which got dropped too, > times out after some time, reconnects and same games > starts again... > > I know the proper solution would be TCP defragmentation > in the nf_conntrack_sip kernel module. However I'm not > sure if this is worth the effort. I think an even better solution would be a SIP proxy that can inject expectations to keep datapath in kernel and only deals with the signalling traffic. > What about just accepting unparsable TCP SIP packets? I wonder why this patch did not fix your problem: 3a7b21eaf4fb3c971bdb47a98f570550ddfe4471 Author: Patrick McHardy <kaber@xxxxxxxxx> netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet It specifically deals with this problem (l7 size larger than packet size). -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
