Excessive CME SCCP UDP Multicast traffic

[r.stockton]

I noted what seems to be excessive multicast traffic coming from a CME 2821 and was a-wonderin what would be considered normal.

I am seeing about 55 packets per second (3300 per minute) of the following:

Source: CME Router

Destination: 239.0.0.1

Protocol: UDP

Source Port: cisco-sccp

Destination Port: cisco-sccp

Data: no human readable :)

Is this normal or is something fishy going on here.

[paolo bevilacqua]

Not normal, possibly a bug, you can try upgrading.

[ilnman1234]

I am having the same exact problem.  Any more on this topic?

[ilnman1234]

I am having the same exact problem.  Any more on this topic?

[frlindse]

That is probably MOH

[ilnman1234]

I am having a problem with multicast UDP traffic causing slowness on the network.  it's broadcasting multicast cisco-sccp packets about 200 a second to every one in the place.  Below is the results of traffic monitoring on the network.

1121    21.200753    10.1.1.1    239.10.16.16    UDP    Source port: cisco-sccp  Destination port: cisco-sccp

So you think that the above indicates MOH traffic?

Wouldnt the ports be different if it were MOH?

[frlindse]

Could you capture a Wireashark trace for a few seconds?

[ilnman1234]

Sure gimme a minute.  And thanks for you help.

[ilnman1234]

Thanks for your help.  I have attached the file.

[frlindse]

Look under telephony-service in the router config, what are the two lines that start with

moh

multicast moh

[ilnman1234]

Bingo.....  so if I turn this off how will MoH work? 

moh flash:/media/music-on-hold.au

multicast moh 239.10.16.16 port 2000

[frlindse]

If you turn multicast MOH off you will not get MOH for ip phone to ip phone

calls(only TOH), you will still get MOH for PSTN calls that arew placed

on hold

[ilnman1234]

Is there anyway to do the IP Phone to IP Phone without using multicast?  Is there a such thing as unicast MoH?

[frlindse]

Yes unicast MOH is an option, however it has a maximum of only 10 phones because it places more load on the router

[ilnman1234]

Ok,  Well thank you very much for your help.  Much appreciated.