Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SPA2102 out-of-memory (H737202d1) errors

I'm seeing intermittent out-of-memory (H737202d1)errors and reboots being reported in the system log from an SPA-2102:

Oct 20 03:39:19 phb4 System started: ip@192.168.1.6, reboot reason:H737202d1
Oct 20 03:39:19 phb4 System started: ip@192.168.1.6, reboot reason:H737202d1
Oct 20 03:39:25 phb4 YM:ERR:AuthServerNotConfig
Oct 20 03:39:25 DOGBERT syslog: last message repeated 3 times
Oct 20 03:39:25 phb4 [0]Reg Addr Change(0) 0:0->ae893fce:5060
Oct 20 03:39:25 phb4 [0]Reg Addr Change(0) 0:0->ae893fce:5060
Oct 20 03:39:25 phb4 [1]Reg Addr Change(0) 0:0->4df0305e:5060
Oct 20 03:39:25 phb4 [1]Reg Addr Change(0) 0:0->4df0305e:5060
Oct 20 03:39:43 phb4 System started: ip@192.168.1.6, reboot reason:H737202d1
Oct 20 03:39:43 phb4 System started: ip@192.168.1.6, reboot reason:H737202d1
Oct 20 03:39:48 phb4 YM:ERR:AuthServerNotConfig
Oct 20 03:39:49 DOGBERT syslog: last message repeated 3 times

SPA2102 S/W version is 5.2.10, H/W version is 1.3.5(a).

The events occur when the system is quiescent (no calls in progress or recently made), and more typically at 1 or 2 day intervals.

Has anybody else seen this?

I'm guessing a bug in SIP registration timeout handling as this is possibly occurring when the internet connection is congested.

So far it has been an annoyance rather than a major problem (the phones ring briefly when it happens).

I can switch on more detailed logging if more information is required.

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: SPA2102 out-of-memory (H737202d1) errors

Hi Michael,

Could be related to external sources.

Take a look at:

Regards,

Patrick

----------

2 REPLIES
Cisco Employee

Re: SPA2102 out-of-memory (H737202d1) errors

Hi Michael,

Could be related to external sources.

Take a look at:

Regards,

Patrick

----------

New Member

Re: SPA2102 out-of-memory (H737202d1) errors

Patrick,

Thanks for responding. I looked at your initial suggestions.

A DoS seems very unlikely as there's negligible traffic being reported by the firewall router.

(I will, however, enable the Restrict Source IP option on both lines to see if it makes any

difference).

The reboot reason chart was where I found out that H737202d1 was an out-of-memory error.

The SPA2102 is on a wireless connection to the internet which occasionally drops out due to

weather and/or congestion at the local tower - hence my suspicion of a bug in timeout handling

or the handling of lost packets being the cause.

Please let me know if there is any additional information / logging that I could provide.

-- Mike --

UPDATE -

Seem to have solved the problem. Thanks Patrick!

Note that enabling the Restrict Source IP option does cause problems if you make (or receive) calls using IP dialling.

Rather than a targeted DoS attack it looks like there are a number of attempts being made to break into

VoIP systems on port 5060 using a brute force userid/password guessing attack. Presumably

the SPA-2102 fails when this happens. (Better log messages in next release?)

SANS Internet Storm Center http://isc.sans.edu/port.html?port=5060 gives some idea of the

number of attempts.  This blog entry http://blog.tridgell.net/?p=28 describes a successful brute force

attack against an Asterisk server.

Looks like a bad idea to use the default 5060 port unless you have to.

Message was edited by: Michael Bell (added UPDATE)

1263
Views
0
Helpful
2
Replies
CreatePlease login to create content