I tracked the problem down to the auth-all-packets set to true on an authenticated call using both eyebeam and zoiper which i think use the same engine cos the sip looks identical.
When the auth-all-packets option is set it authenticates every sip message including the ack after the 200ok when the call is answered.
The way you do the auth includes putting the method name into the string that you do a hash on eg REGISTER, INVITE, ACK etc
Both these clients put the word INVITE in the hash even when it's an ACK and since tolerating this behavior is a security risk we have added it as part of the NDLB (no device left behind) series of config options.
update to latest trunk, recompile and add this to your sofia profile somewhere near where you set
auth-all-packets
<param name="NDLB-broken-auth-hash" value="true"/>
With this flag enabled, whenever auth fails on a packet that is not invite or register it will try 1 extra time with the word invite in the hash which will work around the problem.
FreeSWITCH Developer Conference
sip:888@conference.freeswitch.org
iax:guest@conference.freeswitch.org/888
googletalk:conf+888@conference.freeswitch.org
pstn:213-799-1400