Every time I have ever looked at an edited sip trace, the real problem has been obscured by the edits, so I don&#39;t bother looking at them anymore .  Check out the sip trace and debug and your config to see why it&#39;s detecting nat <span></span><br><br>On Wednesday, June 10, 2015, Sean Devoy &lt;<a href="mailto:sdevoy@bizfocused.com">sdevoy@bizfocused.com</a>&gt; wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">





<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">The SIP trace shows an oddity.  The request has expires=3600, but the response from FS says expires=30.  This is happening on ALL devices that have the latest
 CISCO firmware.  Can you see anything wrong with the registration request:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   ------------------------------------------------------------------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">recv 767 bytes from udp/[69.137.35.208]:1024 at 18:59:53.382917:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   ------------------------------------------------------------------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   REGISTER sip: [my domain name]  SIP/2.0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   From: &quot;Ann-Marie&quot; &lt;sip:11@[my domain name]&gt;;tag=86dec25c650ffef4o0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   To: &quot;Ann-Marie&quot; &lt;sip:11@[my domain name]&gt;<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Call-ID: <a href="javascript:_e(%7B%7D,&#39;cvml&#39;,&#39;d1a1e2df-34f61b38@192.168.2.11&#39;);" target="_blank">d1a1e2df-34f61b38@192.168.2.11</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   CSeq: 10545 REGISTER<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Max-Forwards: 70<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Authorization: Digest username=&quot;11&quot;,realm=&quot;[my domain name]&quot;,nonce=&quot;6d8f48f6-0d40-4f18-8a87-4b961f7b7881&quot;,uri=&quot;sip: [my domain name]&quot;,algorithm=MD5,response=&quot;c73d90489df58e17dad9a9d3b1b06865&quot;,qop=auth,nc=00000010,cnonce=&quot;4c9c7235&quot;<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Contact: &quot;Ann-Marie&quot; &lt;<a href="http://sip:11@69.137.35.208:1024" target="_blank">sip:11@69.137.35.208:1024</a>&gt;;expires=3600<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   User-Agent: Cisco/SPA504G-7.5.5<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Content-Length: 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Supported: replaces<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   ------------------------------------------------------------------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">send 614 bytes to udp/[69.137.35.208]:1024 at 18:59:53.386375:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">  ------------------------------------------------------------------------<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   SIP/2.0 200 OK<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Via: SIP/2.0/UDP 69.137.35.208:1024;branch=z9hG4bK-b2eec5e;rport=1024<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   From: &quot;Ann-Marie&quot; &lt;sip:11@[my domain name]&gt;;tag=86dec25c650ffef4o0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   To: &quot;Ann-Marie&quot; &lt;sip:11@[my domain name]&gt;;tag=tpUU52gppFZrj<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Call-ID: <a href="javascript:_e(%7B%7D,&#39;cvml&#39;,&#39;d1a1e2df-34f61b38@192.168.2.11&#39;);" target="_blank">d1a1e2df-34f61b38@192.168.2.11</a><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   CSeq: 10545 REGISTER<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Contact: &lt;<a href="http://sip:11@69.137.35.208:1024" target="_blank">sip:11@69.137.35.208:1024</a>&gt;;<span style="background:yellow">expires=30</span><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Date: Wed, 10 Jun 2015 18:59:53 GMT<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   User-Agent: FreeSWITCH-mod_sofia/1.2.22+git~20140309T212137Z~65fed130e5~64bit<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Supported: path, replaces<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d">   Content-Length: 0<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <a href="javascript:_e(%7B%7D,&#39;cvml&#39;,&#39;freeswitch-users-bounces@lists.freeswitch.org&#39;);" target="_blank">freeswitch-users-bounces@lists.freeswitch.org</a> [mailto:<a href="javascript:_e(%7B%7D,&#39;cvml&#39;,&#39;freeswitch-users-bounces@lists.freeswitch.org&#39;);" target="_blank">freeswitch-users-bounces@lists.freeswitch.org</a>]
<b>On Behalf Of </b>Michael Jerris<br>
<b>Sent:</b> Wednesday, June 10, 2015 1:41 PM<br>
<b>To:</b> FreeSWITCH Users Help<br>
<b>Subject:</b> Re: [Freeswitch-users] TOO Frequent SIP Registration<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Likely relates to us detecting them as nat.  Take a look at the registrations, do they say NAT?  To confirm why you would look at the sip trace to see whats going on with the registration, my guess would be sip ALG on the client side messing
 up the traffic.<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Jun 10, 2015, at 1:30 PM, Sean Devoy &lt;<a href="javascript:_e(%7B%7D,&#39;cvml&#39;,&#39;sdevoy@bizfocused.com&#39;);" target="_blank">sdevoy@bizfocused.com</a>&gt; wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">Hi everyone,<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">Forgive my lack of knowledge here.  I have a multi-tenant server setup and oddly everything is working correctly!  Working correctly isn’t odd, writing when everything is ok
 is odd.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">For one of my domains, all of the phones re-register about every 30 seconds.  The log is filled with messages like:<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="text-indent:.5in"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">sofia_reg.c:1532 SIP auth challenge (REGISTER) on sofia profile &#39;external&#39; for [43@&lt;snip&gt;]<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">On the phones I changed the “Reg Min Expires” to 300 and they disappeared from registration!!<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">Also, the phones are registered, I can call them and their status web page says next registration is xx (30 or less) seconds.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">So …<span> </span><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">How often show registered phones re-register?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">How/Where do I set it?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">Why only one of my domains?  (This domain may be the only one to get the latest firmware in the phones).<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">For extra points does this relate to NAT Keepalive at all?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif">I did google this but the only registration expiration info I can find is on gateways, not phones.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:&quot;Calibri&quot;,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>

</blockquote>