Firewalling brute force attacks

Hi all!

Starting with SVN Rev. 4453 (2011-06-10) a new PHP script 
scripts/banbrutes.php has been added.

Based on user.auth and user.authfail messages this script detects brute force 
attackers (like sipvicious but not limited to it) and runs an user defined 
command in an attempt to firewall off the source of the attack.

The way of installing the script is described at the start of the file and it 
can be customized by editing the variables at the start of script.

You may edit the $cmd_ban and $cmd_unban variables to specify a custom 
command. The default assumes iptables is available and Yate runs as root. 
Depending on your setup you may need to run the command through sudo and place 
the user Yate runs as in the sudoers file.

Even if the default 10 of $ban_failures seems large please refrain from 
reducing it if possible. In SIP it's possible to have many normal 
authentication failures, especially if a single phone registers multiple lines 
and eventually voicemail and/or line status subscriptions. You may experiment 
by adjusting the threshold at runtime (see below).

The current status of the blacklist is available through a rmanager command. 
It is also possible to manually unban an address (TAB completion is 
available).

From Rev. 4467 (2011-06-29) the script works with the Jabber (XMPP) server 
too.

Jabber Server setup

Marian,

Thanks - Spark is now working fine. 

PSI in general also works - unfortunelly I realized that yate properly process vcard update but ignore 'get':

------
<c2s/stream/6:INFO> Receiving from 'acheck@.../pcvideo'
<iq xmlns="jabber:client" type="get" to="acheck@..." id="aac0a">
                                                                                                                                          <vCard xmlns="vcard-temp" version="2.0" prodid="-//HandGen//NONSGML vGen v1.0//EN"/>
                                          </iq> [0x82d4328]
<jabber:ALL> JBPendingWorker(0) processing (0x82d5cf8,iq) type=get
from=acheck@.../pcvideo
to=acheck@... child=(vCard,vcard-temp) stream=c2s [0x8220e68]
<jbserverengine:ALL> Processing jabber.iq
from=acheck@.../pcvideo to=acheck@...
<c2s/stream/6:INFO> Sending to 'acheck@.../pcvideo' <iq
type="error" id="aac0a" from="acheck@..."><error
type="modify"><service-unavailable
xmlns="urn:ietf:params:xml:ns:xmpp-stanzas"/></error></iq> [0x82d4328]
-----

I even don't see register query for this event - this module is properly configured and does process
vcard.set event.

Meantime I still has problems - as I realized yate w/o any routing application can perform only basic
operation - registration, roster maintenance etc...

I have made external app which can route chat messages - intercept msg.execute and dispatch new
msg.execute with 'line' and 'called_instance' obtained from users.location - chat is properly routed

client not registering to Gatekeeper

Yate coredumps

Re: Yate coredumps

Re: Yate coredumps

Hi, Brian!

Are these crashes happening only at shutdown? If this is the case the 
information below may apply to you.

Do you have a log of the shutdown process of Yate? Do you get errors like 
this:

<GOON> Unloading 'ysipchan' removed 0 out of 1 plugins

The Linux shared object loader has a bug that causes improper unloading and 
cleanup of plugins. Sometimes a plugin that should have been cleaned up and 
unloaded earlier would persist until later when its cleanup is no longer safe 
since it involves another plugin that was already unloaded.

This bug doesn't happen on *BSD based systems or on Windows.

Note that recompiling individual plugins or reinstalling Yate may cause the 
order of loading / unloading the plugins to change and the crash to disappear.

As a workaround you can add -Du to the command line that starts Yate. This 
will cause the plugins code to remain in memory until the entire process 
terminates.

Paul

On Thursday 07 July 2011 02:21:04 am Brian wrote:
> Hi List,
>
>
>
> Quite often I see Yate coredumps with this kind of backtrace. Does someone
> experience the same thing?
>
> Regards,
>
> Brian
>
>
>
> Program terminated with signal 11, Segmentation fault.
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> Missing separate debuginfos, use: debuginfo-install
> glibc-2.12-1.7.el6.x86_64 libgcc-4.4.4-13.el6.x86_64
> libstdc++-4.4.4-13.el6.x86_64
>
> (gdb) bt
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> #1  0x00007f5b523bc789 in TelEngine::CallEndpoint::setPeer
> (this=0x7f5b40161400, peer=<value optimized out>, reason=0x0, notify=<value
> optimized out>, params=<value optimized out>)
>
>     at Channel.cpp:195
>
> #2  0x00007f5b523c0d57 in TelEngine::CallEndpoint::disconnect
> (this=0x7f5af40094e0, final=true, reason=0x0, notify=true, params=0x0) at
> Channel.cpp:179
>
> #3  0x00007f5b523c1048 in TelEngine::CallEndpoint::destroyed
> (this=0x7f5af40094e0) at Channel.cpp:85
>
> #4  0x00007f5b5239972a in TelEngine::RefObject::zeroRefs
> (this=0x7f5af40094e0) at TelEngine.cpp:676
>
> #5  0x00007f5b5239a96e in TelEngine::RefObject::deref (this=0x7f5af40094e0)
> at TelEngine.cpp:668
>
> #6  0x00007f5b5239b22b in TelEngine::ObjList::remove (this=<value optimized
> out>, delobj=true) at ObjList.cpp:238
>
> #7  0x00007f5b5239b2bc in TelEngine::ObjList::clear (this=0x7f5b51d327d0)
> at ObjList.cpp:262
>
> #8  0x00007f5b5239b307 in TelEngine::ObjList::~ObjList
> (this=0x7f5b51d327d0, __in_chrg=<value optimized out>) at ObjList.cpp:45
>
> #9  0x00007f5b51b31161 in ~Driver (this=0x7f5b51d326c0, __in_chrg=<value
> optimized out>) at ../yatephone.h:2108
>
> #10 (anonymous namespace)::DumbDriver::~DumbDriver (this=0x7f5b51d326c0,
> __in_chrg=<value optimized out>) at dumbchan.cpp:153
>
> #11 0x0000003d5703636d in __cxa_finalize () from /lib64/libc.so.6
>
> #12 0x00007f5b51b30ea6 in __do_global_dtors_aux () from
> /home/sip/lib/yate/dumbchan.yate
>
> #13 0x000000000000000a in ?? ()
>
> #14 0x00007fff9862a150 in ?? ()
>
> #15 0x00007f5b51b31961 in _fini () from /home/sip/lib/yate/dumbchan.yate
>
> #16 0x000000000184c900 in ?? ()
>
> #17 0x0000003d56813d6e in _dl_close_worker () from
> /lib64/ld-linux-x86-64.so.2
>
> Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Re: Yate coredumps

Hi Paul,

I did some tests of shutting down Yate and haven't seen coredump anymore. Thanks alot.
May I ask you another question about Yate's memory consumption? In fact, when I test Yate by making incoming
SIP calls to it at the rate of ~10 calls/second, Yate starts to use alot of virtual memory. With the 'top'
command, I see Yate used up to 10Gibabyte of memory. No special module is loaded. There is one external
module in Python connect to Yate (using yaypm). For each incoming call, the external module ask Yate to
play a .mulaw sound file and wait for some dtmf input.

Thank you for your help,
Best regards,

Brian

---------------------------------------
Hi, Brian!

Are these crashes happening only at shutdown? If this is the case the 
information below may apply to you.

Do you have a log of the shutdown process of Yate? Do you get errors like 
this:

<GOON> Unloading 'ysipchan' removed 0 out of 1 plugins

The Linux shared object loader has a bug that causes improper unloading and 
cleanup of plugins. Sometimes a plugin that should have been cleaned up and 
unloaded earlier would persist until later when its cleanup is no longer safe 
since it involves another plugin that was already unloaded.

This bug doesn't happen on *BSD based systems or on Windows.

Note that recompiling individual plugins or reinstalling Yate may cause the 
order of loading / unloading the plugins to change and the crash to disappear.

As a workaround you can add -Du to the command line that starts Yate. This 
will cause the plugins code to remain in memory until the entire process 
terminates.

Paul

On Thursday 07 July 2011 02:21:04 am Brian wrote:
> Hi List,
>
>
>
> Quite often I see Yate coredumps with this kind of backtrace. Does someone
> experience the same thing?
>
> Regards,
>
> Brian
>
>
>
> Program terminated with signal 11, Segmentation fault.
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> Missing separate debuginfos, use: debuginfo-install
> glibc-2.12-1.7.el6.x86_64 libgcc-4.4.4-13.el6.x86_64
> libstdc++-4.4.4-13.el6.x86_64
>
> (gdb) bt
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> #1  0x00007f5b523bc789 in TelEngine::CallEndpoint::setPeer
> (this=0x7f5b40161400, peer=<value optimized out>, reason=0x0, notify=<value
> optimized out>, params=<value optimized out>)
>
>     at Channel.cpp:195
>
> #2  0x00007f5b523c0d57 in TelEngine::CallEndpoint::disconnect
> (this=0x7f5af40094e0, final=true, reason=0x0, notify=true, params=0x0) at
> Channel.cpp:179
>
> #3  0x00007f5b523c1048 in TelEngine::CallEndpoint::destroyed
> (this=0x7f5af40094e0) at Channel.cpp:85
>
> #4  0x00007f5b5239972a in TelEngine::RefObject::zeroRefs
> (this=0x7f5af40094e0) at TelEngine.cpp:676
>
> #5  0x00007f5b5239a96e in TelEngine::RefObject::deref (this=0x7f5af40094e0)
> at TelEngine.cpp:668
>
> #6  0x00007f5b5239b22b in TelEngine::ObjList::remove (this=<value optimized
> out>, delobj=true) at ObjList.cpp:238
>
> #7  0x00007f5b5239b2bc in TelEngine::ObjList::clear (this=0x7f5b51d327d0)
> at ObjList.cpp:262
>
> #8  0x00007f5b5239b307 in TelEngine::ObjList::~ObjList
> (this=0x7f5b51d327d0, __in_chrg=<value optimized out>) at ObjList.cpp:45
>
> #9  0x00007f5b51b31161 in ~Driver (this=0x7f5b51d326c0, __in_chrg=<value
> optimized out>) at ../yatephone.h:2108
>
> #10 (anonymous namespace)::DumbDriver::~DumbDriver (this=0x7f5b51d326c0,
> __in_chrg=<value optimized out>) at dumbchan.cpp:153
>
> #11 0x0000003d5703636d in __cxa_finalize () from /lib64/libc.so.6
>
> #12 0x00007f5b51b30ea6 in __do_global_dtors_aux () from
> /home/sip/lib/yate/dumbchan.yate
>
> #13 0x000000000000000a in ?? ()
>
> #14 0x00007fff9862a150 in ?? ()
>
> #15 0x00007f5b51b31961 in _fini () from /home/sip/lib/yate/dumbchan.yate
>
> #16 0x000000000184c900 in ?? ()
>
> #17 0x0000003d56813d6e in _dl_close_worker () from
> /lib64/ld-linux-x86-64.so.2
>
> Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Re: Yate coredumps

Sorry, I sent it out to quickly. My question was: "Is is normal that Yate consume that much of virtual memory
in such case ? While only RTP and SIP traffic is involved"

Regards,

Brian

Hi Paul,

I did some tests of shutting down Yate and haven't seen coredump anymore. 
Thanks alot.
May I ask you another question about Yate's memory consumption? In fact, when I 
test Yate by making incoming SIP calls to it at the rate of ~10 calls/second, 
Yate starts to use alot of virtual memory. With the 'top' command, I see Yate 
used up to 10Gibabyte of memory. No special module is loaded. There is one 
external module in Python connect to Yate (using yaypm). For each incoming 
call, the external module ask Yate to play a .mulaw sound file and wait for 
some dtmf input.

Thank you for your help,
Best regards,

Brian

---------------------------------------
Hi, Brian!

Are these crashes happening only at shutdown? If this is the case the 
information below may apply to you.

Do you have a log of the shutdown process of Yate? Do you get errors like 
this:

<GOON> Unloading 'ysipchan' removed 0 out of 1 plugins

The Linux shared object loader has a bug that causes improper unloading and 
cleanup of plugins. Sometimes a plugin that should have been cleaned up and 
unloaded earlier would persist until later when its cleanup is no longer safe 
since it involves another plugin that was already unloaded.

This bug doesn't happen on *BSD based systems or on Windows.

Note that recompiling individual plugins or reinstalling Yate may cause the 
order of loading / unloading the plugins to change and the crash to disappear.

As a workaround you can add -Du to the command line that starts Yate. This 
will cause the plugins code to remain in memory until the entire process 
terminates.

Paul

On Thursday 07 July 2011 02:21:04 am Brian wrote:
> Hi List,
>
>
>
> Quite often I see Yate coredumps with this kind of backtrace. Does someone
> experience the same thing?
>
> Regards,
>
> Brian
>
>
>
> Program terminated with signal 11, Segmentation fault.
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> Missing separate debuginfos, use: debuginfo-install
> glibc-2.12-1.7.el6.x86_64 libgcc-4.4.4-13.el6.x86_64
> libstdc++-4.4.4-13.el6.x86_64
>
> (gdb) bt
>
> #0  0x00007f5b52407f10 in typeinfo name for TelEngine::GenObject () from
> /home/sip/lib/libyate.so.3.3.2
>
> #1  0x00007f5b523bc789 in TelEngine::CallEndpoint::setPeer
> (this=0x7f5b40161400, peer=<value optimized out>, reason=0x0, notify=<value
> optimized out>, params=<value optimized out>)
>
>     at Channel.cpp:195
>
> #2  0x00007f5b523c0d57 in TelEngine::CallEndpoint::disconnect
> (this=0x7f5af40094e0, final=true, reason=0x0, notify=true, params=0x0) at
> Channel.cpp:179
>
> #3  0x00007f5b523c1048 in TelEngine::CallEndpoint::destroyed
> (this=0x7f5af40094e0) at Channel.cpp:85
>
> #4  0x00007f5b5239972a in TelEngine::RefObject::zeroRefs
> (this=0x7f5af40094e0) at TelEngine.cpp:676
>
> #5  0x00007f5b5239a96e in TelEngine::RefObject::deref (this=0x7f5af40094e0)
> at TelEngine.cpp:668
>
> #6  0x00007f5b5239b22b in TelEngine::ObjList::remove (this=<value optimized
> out>, delobj=true) at ObjList.cpp:238
>
> #7  0x00007f5b5239b2bc in TelEngine::ObjList::clear (this=0x7f5b51d327d0)
> at ObjList.cpp:262
>
> #8  0x00007f5b5239b307 in TelEngine::ObjList::~ObjList
> (this=0x7f5b51d327d0, __in_chrg=<value optimized out>) at ObjList.cpp:45
>
> #9  0x00007f5b51b31161 in ~Driver (this=0x7f5b51d326c0, __in_chrg=<value
> optimized out>) at ../yatephone.h:2108
>
> #10 (anonymous namespace)::DumbDriver::~DumbDriver (this=0x7f5b51d326c0,
> __in_chrg=<value optimized out>) at dumbchan.cpp:153
>
> #11 0x0000003d5703636d in __cxa_finalize () from /lib64/libc.so.6
>
> #12 0x00007f5b51b30ea6 in __do_global_dtors_aux () from
> /home/sip/lib/yate/dumbchan.yate
>
> #13 0x000000000000000a in ?? ()
>
> #14 0x00007fff9862a150 in ?? ()
>
> #15 0x00007f5b51b31961 in _fini () from /home/sip/lib/yate/dumbchan.yate
>
> #16 0x000000000184c900 in ?? ()
>
> #17 0x0000003d56813d6e in _dl_close_worker () from
> /lib64/ld-linux-x86-64.so.2
>
> Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Yate + Nortel CS2000

Hi all,

I'm trying to run a Nortel CS2000 with yate, the call setup it's ok, but when the call is answered I don't have
any audio… I saw   param['oformats'] = '' and this must be g729, mulaw

below the call details and logs

YATE 3.3.3-alpha1 (http://YATE.null.ro) ready on server.
debug on
Debug level: 8 local: on
Sniffed 'user.auth' time=1310035789.300609
  thread=0xb4dc12a8 'YSIP EndPoint'
  data=(nil)
  retval='(null)'
  param['protocol'] = 'sip'
  param['method'] = 'INVITE'
  param['uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['address'] = '200.26.169.16:5060'
  param['newcall'] = 'true'
  param['domain'] = '200.26.169.16'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['billid'] = '1309095987-6329'
Sniffed 'database' time=1310035789.300816
  thread=0xb4dc12a8 'YSIP EndPoint'
  data=(nil)
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'SELECT DID_PASSWORD FROM DIDS WHERE DID='' AND DID_PASSWORD IS NOT NULL AND DID_PASSWORD<>'''
  param['results'] = 'true'
Returned true 'database' delay=0.000249
  thread=0xb4dc12a8 'YSIP EndPoint'
  data=0xb460bd40
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'SELECT DID_PASSWORD FROM DIDS WHERE DID='' AND DID_PASSWORD IS NOT NULL AND DID_PASSWORD<>'''
  param['results'] = 'true'
  param['columns'] = '1'
  param['rows'] = '0'
  param['affected'] = '0'
  param['dbtype'] = 'mysqldb'
Returned false 'user.auth' delay=0.000546
  thread=0xb4dc12a8 'YSIP EndPoint'
  data=(nil)
  retval='(null)'
  param['protocol'] = 'sip'
  param['method'] = 'INVITE'
  param['uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['address'] = '200.26.169.16:5060'
  param['newcall'] = 'true'
  param['domain'] = '200.26.169.16'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['billid'] = '1309095987-6329'
Sniffed 'call.preroute' time=1310035789.300585
  thread=0xb3713a78 'Call Router'
  data=(nil)
  retval='(null)'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['antiloop'] = '19'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['sip_uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['sip_from'] = 'sip:50422332972@...:5060;user=phone'
  param['sip_to'] = '<sip:8299569674@...:5060;user=phone>'
  param['sip_callid'] = 'aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727'
  param['device'] = 'CS2000_NGSS/9.0'
  param['sip_user-agent'] = 'CS2000_NGSS/9.0'
  param['sip_x-nortel-profile'] = 'DEFAULT'
  param['sip_allow'] = 'ACK,BYE,CANCEL,INVITE,OPTIONS,INFO,SUBSCRIBE,REFER,NOTIFY,PRACK'
  param['sip_mime-version'] = '1.0'
  param['sip_contact'] = '<sip:200.26.169.16:5060;transport=UDP>'
  param['sip_supported'] = '100rel'
  param['sip_content-type'] = 'multipart/mixed;boundary=unique-boundary-1'
Sniffed 'chan.startup' time=1310035789.301302
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
Returned false 'chan.startup' delay=0.000645
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
Sniffed 'call.cdr' time=1310035789.301902 (broadcast)
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['time'] = '1310035789.301'
  param['chan'] = 'sip/11408'
  param['cdrid'] = '11409'
  param['runid'] = '1309095987'
  param['operation'] = 'initialize'
  param['direction'] = 'incoming'
  param['duration'] = '0.001'
  param['billtime'] = '0.000'
  param['ringtime'] = '0.001'
  param['status'] = 'incoming'
  param['external'] = '50422332972'
  param['cdrwrite'] = 'true'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
Returned false 'call.preroute' delay=0.001335
  thread=0xb3713a78 'Call Router'
  data=(nil)
  retval='(null)'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['antiloop'] = '19'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['sip_uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['sip_from'] = 'sip:50422332972@...:5060;user=phone'
  param['sip_to'] = '<sip:8299569674@...:5060;user=phone>'
  param['sip_callid'] = 'aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727'
  param['device'] = 'CS2000_NGSS/9.0'
  param['sip_user-agent'] = 'CS2000_NGSS/9.0'
  param['sip_x-nortel-profile'] = 'DEFAULT'
  param['sip_allow'] = 'ACK,BYE,CANCEL,INVITE,OPTIONS,INFO,SUBSCRIBE,REFER,NOTIFY,PRACK'
  param['sip_mime-version'] = '1.0'
  param['sip_contact'] = '<sip:200.26.169.16:5060;transport=UDP>'
  param['sip_supported'] = '100rel'
  param['sip_content-type'] = 'multipart/mixed;boundary=unique-boundary-1'
  param['oformats'] = ''
Sniffed 'database' time=1310035789.302300
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'INSERT INTO CDRS VALUES(NULL, '1310035789.301', '1309095987-6329', 'sip/11408',
'200.26.169.16:5060', '50422332972', '8299569674', '0.000', '0.001', '0.001', 'incoming',
'incoming', '', 0)'
  param['results'] = 'true'
Sniffed 'call.route' time=1310035789.300585
  thread=0xb3713a78 'Call Router'
  data=(nil)
  retval='(null)'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['antiloop'] = '19'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['sip_uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['sip_from'] = 'sip:50422332972@...:5060;user=phone'
  param['sip_to'] = '<sip:8299569674@...:5060;user=phone>'
  param['sip_callid'] = 'aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727'
  param['device'] = 'CS2000_NGSS/9.0'
  param['sip_user-agent'] = 'CS2000_NGSS/9.0'
  param['sip_x-nortel-profile'] = 'DEFAULT'
  param['sip_allow'] = 'ACK,BYE,CANCEL,INVITE,OPTIONS,INFO,SUBSCRIBE,REFER,NOTIFY,PRACK'
  param['sip_mime-version'] = '1.0'
  param['sip_contact'] = '<sip:200.26.169.16:5060;transport=UDP>'
  param['sip_supported'] = '100rel'
  param['sip_content-type'] = 'multipart/mixed;boundary=unique-boundary-1'
  param['oformats'] = ''
Sniffed 'database' time=1310035789.303323
  thread=0xb3713a78 'Call Router'
  data=(nil)
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'CALL SP_GET_ROUTE('8299569674','50422332972','200.26.169.16:5060');'
  param['results'] = 'true'
Returned true 'database' delay=0.001102
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'INSERT INTO CDRS VALUES(NULL, '1310035789.301', '1309095987-6329', 'sip/11408',
'200.26.169.16:5060', '50422332972', '8299569674', '0.000', '0.001', '0.001', 'incoming',
'incoming', '', 0)'
  param['results'] = 'true'
  param['affected'] = '1'
  param['dbtype'] = 'mysqldb'
Returned false 'call.cdr' delay=0.001608 (broadcast)
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['time'] = '1310035789.301'
  param['chan'] = 'sip/11408'
  param['cdrid'] = '11409'
  param['runid'] = '1309095987'
  param['operation'] = 'initialize'
  param['direction'] = 'incoming'
  param['duration'] = '0.001'
  param['billtime'] = '0.000'
  param['ringtime'] = '0.001'
  param['status'] = 'incoming'
  param['external'] = '50422332972'
  param['cdrwrite'] = 'true'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
Sniffed 'call.cdr' time=1310035789.302705 (broadcast)
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['time'] = '1310035789.301'
  param['chan'] = 'sip/11408'
  param['cdrid'] = '11409'
  param['runid'] = '1309095987'
  param['operation'] = 'update'
  param['direction'] = 'incoming'
  param['duration'] = '0.001'
  param['billtime'] = '0.000'
  param['ringtime'] = '0.001'
  param['status'] = 'incoming'
  param['external'] = '50422332972'
  param['cdrwrite'] = 'true'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
Sniffed 'database' time=1310035789.303957
  thread=0xb46206f0 'Engine Worker'
  data=(nil)
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'UPDATE CDRS SET ADDRESS = '200.26.169.16:5060', DIRECTION = 'incoming', BILLID =
'1309095987-6329', CALLER = '50422332972', CALLED = '8299569674', DURATION = '0.001', BILLTIME =
'0.000', RINGTIME = '0.001', STATUS = 'incoming', REASON = '' WHERE CHAN = 'sip/11408' AND TIME =
CAST(1310035789.301 AS UNSIGNED)'
  param['results'] = 'true'
Returned true 'database' delay=0.002228
  thread=0xb3713a78 'Call Router'
  data=0xb41fc7c8
  retval='(null)'
  param['account'] = 'default'
  param['query'] = 'CALL SP_GET_ROUTE('8299569674','50422332972','200.26.169.16:5060');'
  param['results'] = 'true'
  param['columns'] = '5'
  param['rows'] = '1'
  param['affected'] = '1'
  param['dbtype'] = 'mysqldb'
Returned true 'call.route' delay=0.005055
  thread=0xb3713a78 'Call Router'
  data=(nil)
  retval='sip/9990017042888436@...'
  param['id'] = 'sip/11408'
  param['module'] = 'sip'
  param['status'] = 'incoming'
  param['address'] = '200.26.169.16:5060'
  param['billid'] = '1309095987-6329'
  param['answered'] = 'false'
  param['callid'] = 'sip/aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727/-45026-571aa87-7056f565-571aa87/'
  param['caller'] = '50422332972'
  param['called'] = '8299569674'
  param['antiloop'] = '19'
  param['ip_host'] = '200.26.169.16'
  param['ip_port'] = '5060'
  param['ip_transport'] = 'UDP'
  param['sip_uri'] = 'sip:8299569674@...:5060;transport=UDP;user=phone'
  param['sip_from'] = 'sip:50422332972@...:5060;user=phone'
  param['sip_to'] = '<sip:8299569674@...:5060;user=phone>'
  param['sip_callid'] = 'aefcae8010a91ac813c4571aa8744021f7a369bbd3014c036f0-0008-5727'
  param['device'] = 'CS2000_NGSS/9.0'
  param['sip_user-agent'] = 'CS2000_NGSS/9.0'
  param['sip_x-nortel-profile'] = 'DEFAULT'
  param['sip_allow'] = 'ACK,BYE,CANCEL,INVITE,OPTIONS,INFO,SUBSCRIBE,REFER,NOTIFY,PRACK'
  param['sip_mime-version'] = '1.0'
  param['sip_contact'] = '<sip:200.26.169.16:5060;transport=UDP>'
  param['sip_supported'] = '100rel'
  param['sip_content-type'] = 'multipart/mixed;boundary=unique-boundary-1'
  param['oformats'] = 'g729,mulaw,alaw'
  param['rtp_forward'] = 'no'
  param['formats'] = 'g729,mulaw,alaw'

Re: Yate + Nortel CS2000