missing RTP packets in cppcap

[eliadcourt]

Hi.

We have an issue in our network with both faxes and voip calls (both based on SIP and RTP).
Faxes both received or sent arrive sometimes with text lines cut in the middle.
Calls also have intermittent disruptions.

Our FW is Maestro (currently with 1 out of 2 members active) and 2 VSs (all SIP and RTP traffic goes only through the first VS).

After testing all the networking infrastructure, we placed the faxes server so that he can communicate with the SIP provider without the fw in the middle, and currently it seems that it helps.

We have captured traffic of faulty faxes both on the server and the fw (using cppcap).
I've used the following parameters for cppcap:
cppcap -v 1 -c 0 -p 2000000 -o /var/log/faxes.pcap -f "((src net 10.1.1.0/24 and dst net 200.100.100.0/24) or (dst net 10.1.1.0/24 and src net 200.100.100.0/24))"

Since I didn't specified the DIR parameter, it captured both incoming and outgoing packets.

I noticed a couple of  weird things:

1. Some packets come in but doesn't go out.
It not a FW rule, as I can clearly see other packets flow with no problems.

2. Some packets appear in the pcap we took on the server itself, but no in the pcap from cppcap.

Any ideas?

Thanks.

[PhoneBoy]

I imagine this is something relating to the Correction Layer where another gateway is receiving the traffic and it should be getting forwarded to this one.
TAC will probably need to be involved.

[eliadcourt]

Hi PhoneBoy.

Thanks for the reply.

As I mentioned above, currently there's only a single member active.
Does the Correction Layer might still interfere?

[PhoneBoy]

May not be the correction layer, but clearly something is dropping the traffic.
Some "drop" debugs might be helpful, starting with something like fw ctl zdebug +drop | grep x.y.z.w (while reproducing the issue).
A TAC case will likely be required here.