Linksys WRP400: Voice line registered but number not working (not in service) (no SIP response)

[mauriziotroilo]

Good morning everybody,

i'm experiencing a weird and frustrating problems with some Linksys WRP400 and i hope you can give me any advices.

Long story short: the Voice line on the WRP400 keeps stop working, even if it's registered on my SIP PBX. Only a reboot of the router or a shutdown no-shutdown of the line temporarily fix the issue.

Let's add some details: i've got a lot of WRP400 installed and running and not all of them have this problem. They all have the same configuration.

I've tried to workaround the issue, reducing Register Expires from 3600 to 1200, setting on Make Call Without Reg and Ans Call Without Reg, setting on Restrict Source IP and enabling a daily reboot at 05 AM. It doesn't seem to help.

When the problem occurs, if i call the voice line number i get an error "The number you have dialed is not in service" or similar. Sometimes my customers says they can make an outgoing call, while the problem is still on, but more often the line is totally mute even on the outgoing way.

On my SIP PBX i can see the number is regularly registered, with the right timing.

If i make a Wireshark sniffing on my SIP PBX, i can see some regular "Request: INVITE sip:059907377@86.110.152.60:5060;transport=udp, with session description" from the PBX to the router, but the router never answers.

If i reboot, the voice line re-register itself and start working again.

I attach a screenshot and the Wireshark sniffing.

I'm using the latest 2.00.32 firmware.

Have you got any advice? It's becoming an annoying problem and i'm groping in the dark.

Best regards,

Maurizio

P.S: Should i've been asking to Belkin or is this still the right place?

---

http://about.me/mauriziotroilo       

[Daniele Giordano · Accepted solution]

Hi, we use the WRP400 from years and the voice module has always been problematic.

I've a theory for this problem: I think that the "Restrict Source IP" security function crashes after some hours of regular working and it filters every incoming SIP message.

You can confirm this idea activating the sip trace. In my case the trace doesn't show any incoming SIP request until reboot.

Can I ask you how many CPE do you have?

What is the frequency of this issue?

In our network we have about 2000 WRPs installed and we must reboot about 2 - 3 unit per day.

Regards.

[mauriziotroilo]

Ciao!

I've a theory for this problem: I think that the "Restrict Source IP" security function crashes after some hours of regular working and it filters every incoming SIP message.

That's an interesting idea.

I'm not sure that all the WRP400 with the problem have the "Restrict Source IP" set to On. I'm checking this out later this night.

You can confirm this idea activating the sip trace. In my case the trace doesn't show any incoming SIP request until reboot.

Are you talkin about a particular version of SIP trace, inside the WRP400 settings, or a general SIP trace? Because, as you may see, i've already attached a small sip trace, done with Wireshark.

When the problem is on, my SIP PBX send a regular SIP invite to the router, that never answers. And this could match with your hypothesis, if Restrict Source IP is activated.

I have almost 1500 WRP400, this issue has become more frequent recently (don't know why) and, in this period, i have 1 or 2 frozen voice line every day.

[mauriziotroilo]

UPDATE: I've checked and i can't say that the Restrict Source IP is related to the problem.

I mean, i've taken a sample of 7 CPE with the problem and 3 of them have Restrict Source IP set to Off, the other 4 have it set to On.

The other parameters are totally identical.

[Daniele Giordano]

OK, interesting result. So the problem is not related to the "Restrict source IP" feature.

I've another question.

Can you check the SIP statistics in the voice menu?

If you have an abnormal SIP messages received number, the problem could be caused from a SIP attack.

Is your CPE directly reachable from public Internet?

A common SIP attack is generated from SipVicious tool and we can see this fraud activity every day in our network.

Regards.

[mauriziotroilo]

This is a nice tip, i didn't think about it before.

Anyway, most of the routers of my sample haven't strange SIP statistics, but i'm not calling those customers in these days, so i don't know if they're still experiencing the problem.

The only 2 strange are those:

Those are the ones with the higher uptime and, as you may see, SIP Messages Recv is double than SIP Messages Sent. But even in the other routers of my sample, the ratio is like that.

I must add one thing: we had problems with SIP attacks so we blocked ports 5060 and 5061, at core gateway level, for everyone outside our network. The attacker should be a customer of ours, so i tend to exclude this idea.

What about your devices? Is there something strange you've seen on the one that have this problem? What firmware are you running?
I don't remember having this problem with firmware older than 2.00.32.

Thank you.

Regards

[Daniele Giordano]

During years we tested all firmware version from 1.00.06 to 2.00.32. In my opinion the latest is the most stable version. Probably all our issues are caused by a not optimized SIP stack. You can try to open a case to STAC but I don't know if WRP400 is still supported.

Regards.

[mauriziotroilo]

Thank you. I'm considering to open a case to STAC.

About your devices: so, you just gave up trying to find a solution and you go on rebooting a couple of WRP400 a day?

[Daniele Giordano]

Well, during years I've personally opened dozen of cases to the STAC for different bugs and stability issues.

Actually we have a couple of WRP400 freezed in a day with a 2000 pieces  installed. Acceptable.

Now we use a different CPE for our customer but with similar features of  WRP400: wifi, 2 fxs, 4 lan switch, etc.

Regards.

[mauriziotroilo]

Can i ask you what CPE are you using, right now?

We too are looking for an alternative for the new customers...

[Daniele Giordano]

Hi, actually we use CPE of a german vendor but unfortunately we have encountered problems also with these devices.

The router is much stable but the config is less flexible of WRP.

To conclude, during last 2 week we received a report of a serious security vulnerability.

So I prefer not to suggest this vendor or router model.

Probably in next months we will test audiocedes mediapack 252 routers as alternative.

Regards.

[mauriziotroilo]

The AudioCodes MP-252-BW seems a pretty good alternative to the WRP400. I didn't know the producer but the price is the same of WRP400, it has a lot of interesting features and promises to be able to do the same things the WRP400 does.

Is it capable to have a Ethernet WAN connection?

Is should, because it says "Ethernet WAN          10/100Mbps Ethernet port, configurable for optional connection to Cable/xPON modems" but i'm not sure.

Would you be so kind to let me know what will be the result of your tests, when you will have finished them? In the meanwhile, i'm showing the MP-252 to my bosses.

Are you considering any other brand or models?

Thank you!

[Daniele Giordano]

Hi.

"Is it capable to have a Ethernet WAN connection? "

Yes, one LAN port can be transformed to WAN.

"Are you considering any other brand or models?"

Yes, AVM but I'm not a "fritz" enthusiastic.

Regards.

[mauriziotroilo]

Great! Thank you!

[Daniele Giordano]

I've also used Cisco SRP520 and SRP520U router.

In my opinion it's a good device but the price is not comparable with WRP400.

Also SRP is in end of sale.

BR