Hallo
Our customers are complaining that their FreeSWITCH instances are sometimes sending SIP messages from another port than the configured 5060 UDP port. They observe some SIP messages coming from ports in the range 10000 - 10005.
I could verify this in Wireshark traces from our customers. The behavior seems to be quite sporadic. In one instance, I see that the FreeSWITCH sends an INVITE from port 10000, then resends the same INVITE 1 second later (normal SIP resend/retry), but this time from port 5060. Strange.
Some logs from their firewall:
000066: May 26 2015 17:36:59.874 CEDT: %SEC-6-IPACCESSLOGP: list ACL-WAN-IN denied udp 10.193.97.34(5060) -> 10.193.109.34(10001), 1 packet
…
000166: May 26 2015 17:46:18.115 CEDT: %SEC-6-IPACCESSLOGP: list ACL-WAN-IN denied udp 10.193.97.34(5060) -> 10.193.109.34(10003), 1 packet
000167: May 26 2015 17:46:51.521 CEDT: %SEC-6-IPACCESSLOGP: list ACL-WAN-IN denied udp 10.193.97.34(5060) -> 10.193.109.34(10000), 16 packets
000168: May 26 2015 17:47:51.520 CEDT: %SEC-6-IPACCESSLOGP: list ACL-WAN-IN denied udp 10.193.97.34(5060) -> 10.193.109.34(10001), 17 packets
000169: May 26 2015 17:49:51.519 CEDT: %SEC-6-IPACCESSLOGP: list ACL-WAN-IN denied udp 10.193.97.34(5060) -> 10.193.109.34(10002), 16 packets
=> Any idea what might cause this behavior? Maybe some configuration that we haven't set correctly? Or maybe even a (known) FreeSWITCH bug?
Btw: using FreeSWITCH 1.4.15, 64bit, running on Windows Server.
Thanks for any help and best regards,
Markus