Pipex RTP problem

I only use VoIP on an occasional experimental basis. I was getting
/very/ badly chopped audio reception, although the transmission was
OK. Eventually I put Wireshark and Wiresalmon on, and found that I
only receive an average of 1 in 10 RTP packets once the first 10
have been delivered.

This is with two UA/OS combinations (my own app on RISC OS, and
Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
and VoIPTalk).

The only common factors, AFAICS, are my Internet service provision
(Pipex) and my modem/router/LAN here. The modem/router is a Netgear
DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.

There is no other significant network traffic going on - no browsing,
no media playing, etc. and I saw the same results yesterday evening
and this morning, so I can't reasonably blame network or Internet
traffic.

Anyone ever seen a similar issue?

Dave

On 13/06/10 14:29, Dave Higton wrote:
> I only use VoIP on an occasional experimental basis. I was getting
> /very/ badly chopped audio reception, although the transmission was
> OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> only receive an average of 1 in 10 RTP packets once the first 10
> have been delivered.

Sounds a bit fishy to me.

> This is with two UA/OS combinations (my own app on RISC OS, and
> Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
> and VoIPTalk).
>
> The only common factors, AFAICS, are my Internet service provision
> (Pipex) and my modem/router/LAN here. The modem/router is a Netgear
> DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.

I'd never suspect a 'dumb' device like a plain old ethernet switch to be
the cause of this sort of issue, but might as well try eliminating what
you can. Try upgrading/downgrading/going sideways with the firmware on
the router as well in case it's some obscure NAT bug. Having said that,
DG834Gv4 is in widespread use, so if it frequently eats RTP I'm sure
this wouldn't be the first we'd hear of it.

Are you getting packet loss to anywhere else? ping and iperf in UDP mode
should help you spot this.

> There is no other significant network traffic going on - no browsing,
> no media playing, etc. and I saw the same results yesterday evening
> and this morning, so I can't reasonably blame network or Internet
> traffic.
>
> Anyone ever seen a similar issue?

Nope. In general when you see weird **** like this, it's either protocol
inspection in the router [not likely on a Netgear] or misconfigured
traffic throttling by the ISP.

--
<http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
21:43:32 up 46 days, 23:47, 1 user, load average: 0.54, 0.55, 0.55
It is better to have been wasted and then sober
than to never have been wasted at all

Dave Higton wrote:
> I only use VoIP on an occasional experimental basis. I was getting
> /very/ badly chopped audio reception, although the transmission was
> OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> only receive an average of 1 in 10 RTP packets once the first 10
> have been delivered.

Are you setting type of service parameters? Enhanced service has a
strict quota, so if you request it and go over budget, you could get hit
hard.

(13/06/10 14:29), Dave Higton:
> I only use VoIP on an occasional experimental basis. I was getting
> /very/ badly chopped audio reception, although the transmission was
> OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> only receive an average of 1 in 10 RTP packets once the first 10
> have been delivered.
>
> This is with two UA/OS combinations (my own app on RISC OS, and
> Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
> and VoIPTalk).
>
> The only common factors, AFAICS, are my Internet service provision
> (Pipex) and my modem/router/LAN here. The modem/router is a Netgear
> DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.
>
> There is no other significant network traffic going on - no browsing,
> no media playing, etc. and I saw the same results yesterday evening
> and this morning, so I can't reasonably blame network or Internet
> traffic.
>
> Anyone ever seen a similar issue?
>
> Dave
Beware of any anti-DDOS firewall setting.
Many firewalls see the UDP RTP traffic as a flood and stop the packets.
Either reconfigure the level where the DDOS triggers the dam, or disable
it altogether.

--
Bodincus - The Y2K Druid
************************
Law 42 on computing:
Anything that could fail, will break at the worst possible mom%*= ?@@
# Access Violation - Core dumped
# Kernel Panic

On 13/6/10 14:29, Dave Higton wrote:
> I only use VoIP on an occasional experimental basis. I was getting
> /very/ badly chopped audio reception, although the transmission was
> OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> only receive an average of 1 in 10 RTP packets once the first 10
> have been delivered.
>
As a curiousity, which pipex network are you on? I know this doesn't
happen with homecall (ex C&W/bulldog).

> This is with two UA/OS combinations (my own app on RISC OS, and
> Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
> and VoIPTalk).
>
I can certainly vouch for both voiptalk (use them at home and work) and
sipgate. Nice to know that there's some work on a Risc OS VoIP product,
the last one of these I heard about was around 12 years ago when someone
ported Speak Freely.

> The only common factors, AFAICS, are my Internet service provision
> (Pipex) and my modem/router/LAN here. The modem/router is a Netgear
> DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.
>
I can't really comment on the DG834Gv4, I stopped buying Netgear kit
years ago, If there are any QoS settings on it, have you tried turning
them off?

> There is no other significant network traffic going on - no browsing,
> no media playing, etc. and I saw the same results yesterday evening
> and this morning, so I can't reasonably blame network or Internet
> traffic.
>
It would be very unusual to see this sort of problem being the fault of
a switch that wasn't an expensive one :-)(

> Anyone ever seen a similar issue?
>
I have recently seen something quite similar, which turned out to be the
QoS on a router not working properly. (The router in question runs
linux, so I may fix this by writing my own QoS script).

> Dave

In message <rUkRn.58509$D81.18538@hurricane>
Thomas Kenyon <tom@art-it-services.co.uk> wrote:

> On 13/6/10 14:29, Dave Higton wrote:
> > I only use VoIP on an occasional experimental basis. I was getting
> > /very/ badly chopped audio reception, although the transmission was
> > OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> > only receive an average of 1 in 10 RTP packets once the first 10
> > have been delivered.
> >
> As a curiousity, which pipex network are you on? I know this doesn't
> happen with homecall (ex C&W/bulldog).

It was originally a Pipex Xtreme Solo account - is that what you
mean?

Anyway, it's not Pipex's fault as it turns out...

> Nice to know that there's some work on a Risc OS VoIP product, the
> last one of these I heard about was around 12 years ago when someone
> ported Speak Freely.

I can't remember why I started on it. It just interested me. My
app is written from scratch, not ported. As such, it will only
cope with the simplest of call scenarios, but it's been a very
interesting learning experience. Now I find myself one of the
leading VoIP experts where I work :-)

Dave

In message <I_cRn.55051$Ny7.53116@hurricane>
Bodincus <nobody@this.address> wrote:

> (13/06/10 14:29), Dave Higton:
> > I only use VoIP on an occasional experimental basis. I was getting
> > /very/ badly chopped audio reception, although the transmission was
> > OK. Eventually I put Wireshark and Wiresalmon on, and found that I
> > only receive an average of 1 in 10 RTP packets once the first 10
> > have been delivered.
> >
> > This is with two UA/OS combinations (my own app on RISC OS, and
> > Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
> > and VoIPTalk).
> >
> > The only common factors, AFAICS, are my Internet service provision
> > (Pipex) and my modem/router/LAN here. The modem/router is a Netgear
> > DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.
> >
> > There is no other significant network traffic going on - no browsing,
> > no media playing, etc. and I saw the same results yesterday evening
> > and this morning, so I can't reasonably blame network or Internet
> > traffic.
> >
> > Anyone ever seen a similar issue?
> >
> > Dave
> Beware of any anti-DDOS firewall setting.
> Many firewalls see the UDP RTP traffic as a flood and stop the packets.
> Either reconfigure the level where the DDOS triggers the dam, or disable
> it altogether.

Thanks, Bodincus, that was it. The DG834 has DOS detection, and
presumably mitigation, although I can't find anywhere to configure
it, other than turning it off altogether. The incoming RTP - and
even the incoming SIP - were seen as DOS attacks, despite my
having opened up and forwarded the ports (or else I wouldn't be
able to receive anything at all). Not the smartest programming,
methinks.

However, a firmware upgrade addressed the problem, and seems to
have solved it.

Dave

In message <hv3gsi$iqs$1@speranza.aioe.org>
alexd <troffasky@hotmail.com> wrote:

> I'd never suspect a 'dumb' device like a plain old ethernet switch to be
> the cause of this sort of issue, but might as well try eliminating what
> you can. Try upgrading/downgrading/going sideways with the firmware on
> the router as well in case it's some obscure NAT bug. Having said that,
> DG834Gv4 is in widespread use, so if it frequently eats RTP I'm sure
> this wouldn't be the first we'd hear of it.

Thanks, Alex, yes, it was the router's firmware, as I explained in
my reply to Bodincus.

Dave

(15/06/10 20:06), Dave Higton:
> In message<I_cRn.55051$Ny7.53116@hurricane>
> Bodincus<nobody@this.address> wrote:
>
>> (13/06/10 14:29), Dave Higton:
>>> I only use VoIP on an occasional experimental basis. I was getting
>>> /very/ badly chopped audio reception, although the transmission was
>>> OK. Eventually I put Wireshark and Wiresalmon on, and found that I
>>> only receive an average of 1 in 10 RTP packets once the first 10
>>> have been delivered.
>>>
>>> This is with two UA/OS combinations (my own app on RISC OS, and
>>> Ekiga 2.09 on SuSE 10), and two VoIP service providers (Sipgate
>>> and VoIPTalk).
>>>
>>> The only common factors, AFAICS, are my Internet service provision
>>> (Pipex) and my modem/router/LAN here. The modem/router is a Netgear
>>> DG834Gv4. The LAN is implemented on a cheap Edimax 16 port switch.
>>>
>>> There is no other significant network traffic going on - no browsing,
>>> no media playing, etc. and I saw the same results yesterday evening
>>> and this morning, so I can't reasonably blame network or Internet
>>> traffic.
>>>
>>> Anyone ever seen a similar issue?
>>>
>>> Dave
>> Beware of any anti-DDOS firewall setting.
>> Many firewalls see the UDP RTP traffic as a flood and stop the packets.
>> Either reconfigure the level where the DDOS triggers the dam, or disable
>> it altogether.
>
> Thanks, Bodincus, that was it. The DG834 has DOS detection, and
> presumably mitigation, although I can't find anywhere to configure
> it, other than turning it off altogether. The incoming RTP - and
> even the incoming SIP - were seen as DOS attacks, despite my
> having opened up and forwarded the ports (or else I wouldn't be
> able to receive anything at all). Not the smartest programming,
> methinks.
>
> However, a firmware upgrade addressed the problem, and seems to
> have solved it.
>
> Dave
Been there, seen that, got the t-shirt.
It's 5 years I'm sniffing around VoIP, and I'm now running my own
telephony business, so I've seen it (almost) all.

HTH
--
Bodincus - The Y2K Druid
************************
Law 42 on computing:
Anything that could fail, will break at the worst possible mom%*= ?@@
# Access Violation - Core dumped
# Kernel Panic