Cisco 7960G malformed packets

I have two 7960G phones which were using SCCP
I have just upgraded them to POS3-05-3-00 to work for SIP
SInce upgrading both phones are now sending malformed packets and a wireshark trace show no checksum on the packet.
Can anyone suggest how I might change the firmware as TFTP is the only option, currently using 3CDeamon.
Thanks
John

hello - I have just moved your post to the Topic forums - you had posted your question in an obscure, non-visible, promotional community. Hopefully our community users will see your question now.

Similar Messages

Malformed packets

Hi,
Thanks in advance for your help.
Let me describe the issue briefly.
-Our system is configured with Video Streamer (winsend on PC),
Cisco 7609 and DSLAM with ATM traffic.
-Video streamer is connected to Cisco 7609 FE port.
-The video traffic is routed to ATM port and distributed to DSLAM.
-I could see that the video traffic is forwarded to ATM side but for some reason the packet is malformed and could not see
the video on ATM side.
I am connecting the routers the following way:
The DSLAM is connected to the 7609.
FE ATM
PC (winsend)------Cisco 7500--------DSLAM-----DSL
|
|
PC (winsend)------Cisco 7609------------+
FE ATM
-I also ran video traffic from Cisco 7500 to Cisco 7609.
The video traffic comming from Cisco 7500 works fine. (video stream is created winsend as well). The above problem happens only on video origninating from Cisco 7609.
-I Captured the video traffic on ATM by ethereal, noticed followings.
-Video traffic through Cisco 7500 is working fine, I could see Source and Destiation with proper IP address. Protocol shows UDP properly.
-Video traffic originating on Cisco 7609 has packet malformed.
The sniffer (Ethereal) showed the packet in strange status. Source and Destination shows MAC address, Protocol shows it as "0x1f64" which is not understandable.
I would appreciate any input.

correction on packet count - 200+ malformed out of 20k total packets
captured.
>>> On 12/17/2009 at 10:10 AM, Mysterious<[email protected]> wrote:
> On 12/17/2009 05:09 PM, John wrote:
>> some packet examples
>>
>> 3770 7.278536 00.00.00 04.00.00 FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 20:00:00:00:8b:72 (20:00:00:00:8b:72)
>>
>> 4933 8.959812 00.00.00 31.00.00 FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 20:00:00:00:b7:81 (20:00:00:00:b7:81)
>>
>> 9441 13.559633 72.82.b8 20.00.1b FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 00:00:00_00:8b:63 (00:00:00:00:8b:63)
>>
>> 9443 13.559657 72.82.b8 07.00.1b FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 00:00:00_00:96:41 (00:00:00:00:96:41)
>
> does your server use the bx2.lan driver?

Malformed packets - slow web page loading

I'm running bm3.9 sp2 with some post bm sp2 files as provided by Novell
support on a nw6.5 server.
I've noticed that on IE and Fireforx browsers, that web pages will often
take a long time to load and typically if I hit the 'stop' button on the
browser and do a 'reload' or 'refresh' for that web page, it will
immediately load fine.
I've been looking at the tcp stats but don't notice anything strange there.
I ran pktscan and the only thing standing out is about 200+ malformed
packets out of about 3000 packets. I've run pktscan a few different times on
different days and still noticing these malformed packets.
I was wondering if this could be a problem or any other suggestions on what
to look at.
TIA

correction on packet count - 200+ malformed out of 20k total packets
captured.
>>> On 12/17/2009 at 10:10 AM, Mysterious<[email protected]> wrote:
> On 12/17/2009 05:09 PM, John wrote:
>> some packet examples
>>
>> 3770 7.278536 00.00.00 04.00.00 FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 20:00:00:00:8b:72 (20:00:00:00:8b:72)
>>
>> 4933 8.959812 00.00.00 31.00.00 FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 20:00:00:00:b7:81 (20:00:00:00:b7:81)
>>
>> 9441 13.559633 72.82.b8 20.00.1b FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 00:00:00_00:8b:63 (00:00:00:00:8b:63)
>>
>> 9443 13.559657 72.82.b8 07.00.1b FC Unknown frame[Malformed Packet]
>> Ethernet II, Src: 00:00:00_00:40:00 (00:00:00:00:40:00), Dst:
>> 00:00:00_00:96:41 (00:00:00:00:96:41)
>
> does your server use the bx2.lan driver?

SSID=Broadcast Malformed Packet cause switch CPU increase 90 %

I have a Wirelles LAN composed of 4 WISM controllers mounted on 2 6513 catalyst . On the ACCESS switch I can see a lot of abnormal traffic that are in use in the port . After sniffing this traffic I have clear that was WIRELESS broacast traffic in particular : SSID=Broadcast Malformed Packet.
How to reduce this traffic ? I have to proceed in the WISM or just cut all the broacast strom over the switch ?
thank for any help

For that do disable the broadcast SSID. It may help you .

Malformed packets found in packet captures

While running a packet capture I noticed SEVERAL lines with Malformed Packets. The line contained the MACs of the laptop and AP that the laptop was connected.
Is this something I should worry about or what is going on here?
I added a print shot of the packet capture if that helps.
Thank you, Gary

The malformed packets aren't LWAPP but seen in IEEE's association request packet.These messages aren't bad. All it is is that Ethereal could not fully decode the content of the packet because there wasn't enough information in it to decode.As these messages are sent from wireless clients to AP, as long as the clients are able to associate, shouldn't be a concern.

Malformed Packets and Bad Checksums

..I have a customer who uses MPLS to connect to all remote locations. The MPLS carrier has recently merged with another carrier, and they are in the middle of making changes to their MPLS network(s). As a result, some (but not all) of my customer's sites that have gone through these changes are having problems with one particular application only. Wireshark packet captures at the remote location and at the affected application server shows the following, among other things:
- Bad IP Checksum
- Malformed TDS Packets
- Malformed SSL Packets
- Malformed GSM over IP Packets
- Malformed ASAP Packets
- TCP Sequence out of order
- ACKed lost TCP segment
- Previous TCP segment lost
- Fast TCP retransmission suspected
This is only a subset of the problems that Wireshark shows. The strange thing is that only a subset of the remote sites are affected, and it really is only one particular application of a large suite of applications. All other applications work acceptably. In addition, other sites that have been converted work just fine as well. There are about 15 of 80 sites having thus problem. The MPLS provider of have reviewed their equipment and configurations. Unfortunately, after the changes were made, we have no visibility into the MPLS network (it just shows one hop), so I have no way of helping them to troubleshoot.
We have the ability to test the application using a site that is connected via Fiber, and the application works just fine. Of course, we have moved PCs, etc from site to site. The problem seems to stay with the site, rather than the computers.
Any advice or ideas on what I can do to test would be appreciated.
Sent from Cisco Technical Support iPad App

Jason,
there is lot of interesting troubleshooting to be done Yours is the type of case I loved when I was in the TAC as I enjoyed using creative ways to investigate and tackle similar problems.
there might be so many approaches for this that I have difficulties to list them all.
I am afraid that a CSC post is not the right place for that as this can be time comsuming and lot of effort is needed.
I suggest you to open a TAC case where you can find some engineer with the right mind set for this CSI type of troubleshooting.
cheers,
Riccardo

Cisco 3400 Input Packet 0

Dears,
We re using Cisco 3400 in out network with Metro Ip Access 12.2(53)Version.
The issue is that we Plug SFP SFP-GE-L 10-2144-01,1000 BASE LX/LH and loop the Fiber Patch Cord we do not recieve any packet.
Even if we connect to other Cisco we are unable to recieve packet even the Interface status Shows UP..
Need your expert advice.
Thanks
Jawwad

Hi Jawwad,
do you mean that the issue occurs ONLY if you use SFP SFP-GE-L and not if you use other SFPs?
If this is the case, which other SFPs did you try?
What do you see on 'show interface gix/x" after you send some traffic? can you attach the outputs?
All ports are affected or just some?
Can you attach the port configuration?
regards,
Riccardo

WRT54GL & Cisco 7960G VoIP Phone

Hello fellow Cisco users,
I use a Cisco VoIP phone, the ubiquitous 7960G IP phone, and have no problem using it with non-Cisco routers. The phone does not seem to work with the Cisco WRT54GL router under the setup I have as explained below.
I usually connect my Cisco IP phone directly to my laptop's ethernet port giving the phone a shared internet connection. This arrangement works fine with two non-Cisco routers I've used. With the Cisco WRT54GL router however, the phone cannot get an IP configuration, even after opening the needed ports, leading me to believe the problem is likely to be something with the router. I have also tried setting up a DMZ for the router without success. The biggest problem is that the phone uses DHCP (which I also prefer) and the DMZ and port forwarding features require I set the phone's IP address.
I would greatly appreciate any thoughts on how to resolve this.
Many thanks for suggestions.
PS: I forgot to add that the phone works (i.e. receive and make calls) when plugged via ethernet cable into the router. Apart from the problem of having an ethernet cable running across a room, this setup also has some features missing like date and time so calls aren't stamped.

I think your phone is not getting IP address when it is connected to the computer. But when you connect it directly to the modem, it works.
You can try to upgrade/re-flash the firmware on your router.
Connect the computer with the Ethernet cable to the router.
Download the latest firmware from Linksys website and save it on your computer. Open the setup page of the router. Click on Administration tab and go to Firmware upgrade sub tab. Browse the firmware file that you have already downloaded and upgrade it on your router.
After upgrading the firmware on the router, it is recommended that you should reset the router and reconfigure it. Press and hold the reset button on the router for 30 seconds. Release the reset button and wait for 30 seconds. Power cycle the router and reconfigure it.
Also try to change some advanced wireless settings on the router. Click on Wireless tab and go to Advanced wireless settings. Change the Beacon interval to 75, RTS threshold to 2307 and fragmentation threshold to 2306. Save the settings.

Missing Cisco 7960G config files

Hi
By mistake I'v deleted my configuration files for my phones, and I'm a total newbee in this area.
Can anybodt please post the files or a link to the files?
If possible with all config options writen in the files.
//Piet Pedersen

You can download 7960g software load, from the following URL:
http://www.cisco.com/kobayashi/sw-center/sw-voice.shtml

How cisco CSM parses packets?

Hi all, Some days ago i had a problem with a Cisco CSM configuration. The short history is that i had to change the parse-length (virtual server submode) command to the max. 4000 bytes value for this implementation to work, if i dont do this the CSM sends resets to the client. what i would like to know is if someone knows how the CSM parses packets when it is "searching" for a string,cookie,etc, i am having some difficulties finding info about this.

The parse length on the CSM is the amount of bytes we can store to find the needed information (ie: cookie).
So when we get an HTTP request or response the CSM will buffer everything it received up to max parse-len or header limit (\r\n\r\n).
Once we reached the end of the HTTP header we stop buffering.
While buffering we also start looking for the info that we need.
If we do find it we also stop buffering.
There is nothing magic here.
If the HTTP header gets so big that the info we are looking for goes beyond the max-parse-len when we start buffering looking for the info, we endup using all the buffer space allocated to the connection and decide to drop the connections as we don't know if the info is just not there, or somewhere further in the header but we don't have space to buffer more.
When the CSM was created a long time ago, 2000bytes for the header was normal.
Nowadays, http header tends to be bigger and it is very often require to bump the parse length even further than 4000 bytes.
This can be done with a variable.
Gilles.

Cisco 7960G when restart??

Hello,
Anyone knows how to check the data when a ip phone 7960G restart?. Is there any report en RTMT??
Thanks

You can check the app logs in CUCM or the logs in the phone directly.

Cisco 1113 ACS 4.2 1113 configure auth. for Infoblox appl.

Hi there,
I have an issue with Cisco ACS and an Infoblox appliance. We want to authenticate users, that login on the Infoblox, via the Cisco ACS. After that the ACS should reply with a passed (RADIUS) authentication and reply with an administrative groupname that the user belongs on the Infoblox. To do this I have to import a VSA to have the option in the ACS to reply with this groupname. On the Infoblox these groups are allready made and this must match the group that the ACS replies.
Now I have imported the VSA and configured an AAA client (infoblox) to use the new RADIUS (VSA) to support the Infoblox. In the groupsetting I've turned on the Infoblox-Group_info attribute and filled in a specific groupname that the authenticated user belongs to. Now here comes the part where the group info is returned, but the Infoblox Appliance gives me a RADIUS error reply message. As I can see in the logs of the ACS the authentication part of the user is fine. So it has to be between the info that the ACS replies with, when the user logs in.
I've attach the VSA and a *.pcap of wireshark to see what's going on.
Can anyone advice of suggest any option that can make this thing work.
With regards,
Richard Gosen

Halijenn,
Unfortunatly the above solution doesn't do the trick. When I delete the imported VSA, via the attached *.csv, the Infoblox attributes still shows up when I re-add the Infoblox appliance to a network device group en there choose "Radius (Infoblox)" for the authentication. After deleting the VSA I have restarted the ACS SE. The returned acknowledgment from the ACS still presents a malformed packet. When I uncheck the checkbox of the "RADIUS (Infoblox)" attribute in the group settings, then it shows no malformed packet, but no group information is sent either.
Again I have imported the original accountsAction.csv and restarted the SE, but it still returns malformed packets.
Any other possibilities?
Kind regards,
Richard Gosen

IOs for cisco 1900 series router

Hi,
Kindly provide me the IOS version (cisco 1900 router) which can fix the below listed Bugs,
Cisco IOS TCP Listener Crafted Packets Remote DoS (CSCek37177)
Cisco Multiple Devices Crafted IP Option Remote Code Execution (CSCeh52410)
Cisco IOS System Timers Remote Overflow (CSCei61732)
Cisco IOS Secure Shell Server TACACS+ Multiple DoS (CSCed65778, CSCed65285)
Cisco IOS IKE XAUTH ISAKMP IPSec SA Establish Authentication Bypass(CSCeg00277)
Cisco IOS Telnet Service DoS (CSCef46191)
Cisco IOS H.323 Protocol Implementation Flaws Cisco IOS Malformed IPv4 Packet Remote DoS Cisco SSH2 Server/Client Malformed Packet Remote DoS (CSCdz60229, CSCdy87221, CSCdu75477)
Cisco IOS SSH Large Packet CPU Consumption DoS (CSCdw33027) Cisco SIP Crafted INVITE Message Handling DoS (CSCdz39284, CSCdz41124) Cisco IOS Data-link Switching (DLSw) Capabilities Exchange Remote DoS (CSCsf28840)
Cisco IOS AAA RADIUS Long Username Authentication Bypass (CSCee45312)
Cisco IOS TCLSH AAA Command Authorization Bypass (CSCeh73049)
Cisco IOS MMP Stack Group Bidding Protocol (SGBP) Crafted UDP Packet Remote DoS (CSCsb11124)
Cisco IOS IPv6 Packet Processing Arbitrary Code Execution (CSCef68324)
Cisco IOS Malformed BGP Packet Processing Remote DoS (CSCee67450)
Cisco IOS Multi Protocol Label Switching (MPLS) Packet Remote DoS (CSCeb56909)
Cisco IOS IPv6 Packet Processing Remote DoS (CSCed40933)
Cisco IOS SCCP Control Protocol Malformed Message DoS (CSCee08584)
Cisco IOS OSPF Packet Handling DoS (CSCec16481) Cisco IOS ARP Table Overwrite DoS (CSCdu81936)
Regards,
Bala

Hi,
The Current running IOS version is 12.2(4)T7. I tried through bug toolkit. but i couldn't able to consolidate the IOS to fix these bugs.
Regards,
A.Bala
leolaohoo wrote at Tue Jan 25 02:20:52 GMT+05:30 2011:
>Balakrishnan Appavu,
>
>A new message was posted in the Discussion thread "IOs for cisco 1900 series router":
>
>https://supportforums.cisco.com/message/3277195#3277195
>
>Author : leolaohoo
>Profile : https://supportforums.cisco.com/people/leolaohoo
>
>Message:

Video/Voice Conference -8 Error Explained for Cisco Routers

I cannot tell you how long I have spent trying to figure out this problem. We have a bunch of macs sitting behind a NATed Cisco 2811 router, and iChat will just never work, throwing the good ole' -8 error.
Having a good understanding of SIP, I decided to get down an dirty with the investigation of why iChat doesn't work behind some routers, while it does on others.
iChat uses SIP, but as I have found, Apple's implementation of it does not completely honor the RFC. This is the root cause of iChat not working behind enterprise grade routers that have SIP ALG activated (details later).
Apple uses its own flavor of NAT traversal: SNATMAP. This is an Apple service that is utilized every time a video/voice conference is created from iChat. For those of you familiar with SIP, SNATMAP essentially performs the same function as a STUN server. This service abstracts the port specifications necessary to get around NATs to a server on the public Internet.
With some routers, this SNATMAP seems to work fine. With others, not so much. I honestly don't have too deep of an understanding of SNATMAP so I cannot get into too much detail as to why it doesn't work with some routers. If anyone knows, please chime in!
I can, however, clearly indicate why it doesn't work behind routers that have a SIP ALG, which essentially has the intelligence to pick apart to SIP packet to make them NAT friendly. Basically, there is a portion of SIP packets called the SDP (Session Description Protocol) that provides all of the information necessary to set up the voice and video stream. The SIP RFC calls for this section to include information like the connection IP address, port, video codec, audio codec, etc. HOWEVER, Apple's implementation of iChat DOES NOT INCLUDE THE PORT IN THE SDP. Therefore, when a SIP ALG tries to intelligently convert the port, it isn't there to change. Even if it does manage to insert a port number into the SDP, the iChat client receiving the SIP packet doesn't respect that port number and just dumbly sends the request back to the default SIP port (5060).
Here is a little flow of the process:
1. A SIP packet is sent out from iChat to the cisco router
2. Cisco intercepts the packet, changes the private IP address of my computer to the public IP address of the interface, and changes the port to one that it assigns on the public interface. So, basically the SIP packet enters the cisco with the SDP info like 192.168.100.137:5060 and leaves the Cisco like <public IP>:1877.
3. On the receiving end, the SIP packet and SDP section is read with our DSL connection's public IP address, so when it tries to make contact back, requests are sent to the DSL public IP address and not an unrouteable private IP. Also, it sends to the port specified in the SDP section.
4. When a packet comes in from the peer, the destination is something like <public IP>:1877. The cisco NAT translation table remembers that things destined to port 1877 should be converted to 192.168.100.137 on port 5060. The SDP section of the SIP packet is modified and things are peachy.
5. This happens back and forth for all SIP messages that traverse the NAT.
iChat is not SIP RFC compliant which is why we are having these natting issues. iChat does not specify a port in the SDP portion of the SIP messages it is sending out: a big no-no. Therefore, when the recipient iChat is sending back its requests to 207.182.233.32, it is sending it to port 5060 instead of assigned port 1877. The public port 5060 is blocked, and is not routed to any specific computer, resulting in a timeout. Here is the Cisco output 'debug ip nat sip'
001892: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] processing INVITE message
001893: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] register:0 door_created:0
001894: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] translated embedded address 192.168.100.138-><public IP>
001895: .Oct 2 22:53:04.108 PCTime: NAT: SIP: [0] No port present. Use new port 5060->1210
As you can see, it is processing the INVITE request and translating the internal IP address to the public one.
However, it reports no port present, meaning that the port specification in the SDP section of the SIP packet is not present. It does a port translation because it feels obligated to, but iChat doesn't respect that on the other end and sends to 5060 anyway which is not mapped to any specific internal IP addess, so, alas, it doesn't work.
Now, that being, said, this explains why iChat doesn't work behind SIP ALGs. However, if you are able to disable the SIP ALG (on cisco: 'no ip nat service sip udp 5060'), it still doesn't work. With the ALG turned off, the SDP translations don't occur, but for some reason SNATMAP still doesn't work either. I am thinking that could be due to a nat issue, but I haven't figured that out yet. Anyone's insight would be appreciated!
Hope this helps anyone out there seeking help / console with iChat Error -8 issues behind an enterprise grade router.
Hopefully we can figure out why iChat's SNATMAP implementation doesn't work with a Cisco NAT next...

Hi
Ok for the Homehub's.
UPnP should be enabled.
Set the Quicktime streaming setting, goto sys prefs/quicktime/streaming/streaming speed, set to 1.5mbps(dont use automatic)
In ichats prefs click on video and change bandwidth limit to NONE.
Goto to sys prefs/sharing/firewall and turn on(dont add any ports for ichat, leave anything that is ticked ticked).
Restart ichat.
And try connecting to me defcom1 .mac account.
Tony

Cisco 2811 as LAC

Hi,
If anyone can help me with this problem please?
I use Cisco 2811 as L2TP access concentrator (LAC) in my network (pppoe sessions are forwarded via L2TP tunnel to LNS).
CPU usage goes up to 70% with only 30Mb/s traffic rate.
30% of CPU usage is due to IP input process. Is this normal? Does Cisco 2811 these packets (from pppoe sessions through L2TP tunnel) forward with process switching? CEF is not used for L2TP?
In L2TP specification I saw that as LNS Cisco 2811 can handle up to 30Mb/s of traffic.
Is this number valid for LAC as well?
Also on this 2811 there is one L2TP tunnel and aproximatelu 90 corresponding pppoe sessions.
Thanks in advance,
A.

Hi,
so forwarding of packets from PPPoE sessions via L2TP tunnels are done in proccess switching mode(on 2800 series)?
Is this valid also for 7200 series?
I have few small sites where I'm using 2811 as LAC and on large sites I have 7200 as LNS (which concentrates small sites).
I though that 2811 could handle up to 60Mb/s as declared in product sheet, because it is not cost effective for me to put 7200 on smaller sites
Thank you,
A

Cisco 7960G malformed packets

Similar Messages

Maybe you are looking for