Okay all you sip experts...help!!

So we just set up a new MBX with IP phones. Customer elected to go with SIP as a money saving option due to its a small office. Everything appears to work normally internall, but 1 out of every 10-15 calls is getting dropped. Its random.

The SIP provider is a small local company and we have been having issues with support. I did a packet capture using wireshark and sent the results to Vertical. The only real discrepancy they could find was that the provider seemed to be trying to change the RTP port number in mid call. This didn't seem right to them.

So my understanding when it comes to SIP, in a nutshell, is that the connection for the call is established using UDP 5060, and that the actual voice audio is transmitted using RTP over one of the higher ports in the router? Did I get this right? Its not too far off of the same principle of a PRI and B-channels and D-Channel. They seemed to have a large number of ports opened up for RTP.


So anyway my questions are..

If the call is established and the audio is given port 50555 to transmit on, that port should never change, right? Why would the provider be sending a request to our PBX to change the port in mid-call?

Is the SIP connection on 5060 only from the MBX system to providers router?

Does the packet capture only concern itself with data flowing from the MBX to the SIP providers router, or does it capture all the data that is being sent from point A, the caller, to point B, the person being called?

Thanks in advance for the help.

Is the port changing, or is it the whole IP? If the PBX isn't correctly setup for NAT it may be telling the SIP provider to contact it on the local IP (192.168.xxx.xxx, etc.). I've seen this exact issue many times with asterisk PBX's.

it seems to be just the port changing as far as I can tell.

It depends, the RTP information is communicated via SDP in the SIP setup process. If you are using a NAT between the provider and your IP PBX, and that router/firewall is providing a SIP ALG, there will be some translations going on there at layer 3 and 4. Some IP PBXs will try to overcome this issue by modifiying the SDP portion assuming that there is no SIP ALG in place and you are using port forwarding for the RTP ports in question. The SDP message will include IP and port numbers for RTP flow between the peers.

The issue seem to be more of losing audio on one side of the call than actually dropping the entire call. Its random, and happens both directions, but one side of the conversation is lost. The other side can be heard just fine. It took a bit to realize this was happening. Any ideas as to why we would just drop one side?

could be a jitter issue, or it could be a connection issue. Most times the problem on calls like that is a network issue with bad internet.

and you have seen this issue in mid-call?

Can you get a SIP trace/debug from the PBX so we can see what it thinks it is doing?

You might need to fire up wireshark and some port-mirroring or a 10/100 hub inline with the PBX. More then likely the PBX is sending the wrong IP info, or the gateway thinks it's smarter then you and screwing stuff up.