freeswtich request on port 4242?
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242. A whois shows the ipv4 to be from Telewest Broadband in the UK. The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1. Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results. FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit) Thanks, -Terry
Hi There, Well, from here (in the UK) and now (10:00 UTC 140323), I've just checked Flowroute.com and can't see why your fS would connect to 82.45.148.209 or port 4242, but ... For normal operation with external gateways, I'm not surprised that the port is not explicitly in your config. Typically, where your box registers depends on DNS entries your external service has put into DNS. [The gory details are at <http://www.ietf.org/rfc/rfc3263.txt>] If your fS is registering with an external service, it will (unless disabled) do a lookup in DNS to find out the server to which it should register. That lookup starts with a query on NAPTR records at <sipdomain>, which will spell out where to look for a SRV record (if it isn't the default place, which is _sip._udp.<sipdomain> or _sip._tcp.<sipdomain>), where <sipdomain> is the fully qualified domain name of the service to which your fS registers. (Some services do have a NAPTR, some don't; if there isn't one, fS will assume the SRV is in the default place as above). Next is a query for SRV records. If present in the gateway's zone, that DNS SRV record set will show the host **and port** of the servers that're running SIP for that domain. fS will then attempt to make a sip connection to the "best" priority server and port, to register. [If there isn't even a SRV there, the assumption is that the service is just using an A or AAAA record in the DNS at <sipdomain>, treated as a fully qualified domain name,] Thus I wouldn't expect you to see anything with that port number explicitly in your config. do a dig for NAPTR at <sipdomain> do a dig for SRV on _sip._udp.<whatever the sip domain is in your flowroute sip gateway config> I have no idea the SIP URI as which you register, but, if it were something like <sip:1234@flowroute.com>, then the <sipdomain> would be flowroute.com. From here & now, for flowroute.com, I get: ------------------- dig NAPTR flowroute.com ; <<>> DiG 9.8.1 <<>> NAPTR flowroute.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12965 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 6, ADDITIONAL: 9 ;; QUESTION SECTION: ;flowroute.com. IN NAPTR ;; ANSWER SECTION: flowroute.com. 41837 IN NAPTR 100 10 "s" "SIP+D2U" "" _sip._udp.flowroute.com. flowroute.com. 41837 IN NAPTR 102 20 "s" "SIP+D2T" "" _sip._tcp.flowroute.com. ;; AUTHORITY SECTION: flowroute.com. 171437 IN NS d.ns.zerigo.net. flowroute.com. 171437 IN NS c.ns.zerigo.net. flowroute.com. 171437 IN NS f.ns.zerigo.net. flowroute.com. 171437 IN NS e.ns.zerigo.net. flowroute.com. 171437 IN NS b.ns.zerigo.net. flowroute.com. 171437 IN NS a.ns.zerigo.net. ;; ADDITIONAL SECTION: a.ns.zerigo.net. 12778 IN A 64.27.57.11 a.ns.zerigo.net. 12778 IN AAAA 2607:fc88:1001:1::4 c.ns.zerigo.net. 12778 IN A 109.74.192.232 d.ns.zerigo.net. 12778 IN A 174.36.24.250 d.ns.zerigo.net. 12778 IN AAAA 2607:f0d0:1004:82::4 f.ns.zerigo.net. 85037 IN A 174.37.229.229 f.ns.zerigo.net. 85037 IN AAAA 2607:f0d0:3001:90::4 _sip._udp.flowroute.com. 42252 IN SRV 10 10 5060 sip-nv1.flowroute.com. _sip._udp.flowroute.com. 42252 IN SRV 20 10 5060 sip-ca1.flowroute.com. ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Sun Mar 23 10:08:46 2014 ;; MSG SIZE rcvd: 474 ------------------ and ... ------------------ host sip-nv1.flowroute.com sip-nv1.flowroute.com has address 216.115.69.144 host sip-ca1.flowroute.com sip-ca1.flowroute.com has address 70.167.153.130 ------------------ all the best, Lawrence On 23 Mar 2014, at 06:32, Terry Barnum <terry@digital-outpost.com> wrote:
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
This is FreeSWITCH checking to see if its behind NAT as soon as it starts up... That is all On 3/23/14 12:32 AM, "Terry Barnum" <terry@digital-outpost.com> wrote:
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch Twitter: @FreeSWITCH
It's FreeSWITCH trying to automatically detect the ${local_ipv4} and ${local_ipv6} values. It does this by attempting to send a packet to an IP it knows will have to go over the Internet and seeing which local IP the packet would leave the machine from. That means if you have multiple IPs assigned to your machine it'll know which one will send via the default gateway. That handles the simple single-homed case anyway. It doesn't really matter whether NAT happens or not, it works just as well if your machine is listening on the public IP natively. It's just trying to auto-detect what IP you're most likely to be reachable on. Try a packet trace... from memory it only creates the socket, doesn't actually send the packet (?). But I may be wrong there. -Steve On 23 March 2014 02:32, Terry Barnum <terry@digital-outpost.com> wrote:
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Oh, and both IP and port are hardcoded in the source code. On 24 March 2014 00:58, Steven Ayre <steveayre@gmail.com> wrote:
It's FreeSWITCH trying to automatically detect the ${local_ipv4} and ${local_ipv6} values.
It does this by attempting to send a packet to an IP it knows will have to go over the Internet and seeing which local IP the packet would leave the machine from. That means if you have multiple IPs assigned to your machine it'll know which one will send via the default gateway. That handles the simple single-homed case anyway.
It doesn't really matter whether NAT happens or not, it works just as well if your machine is listening on the public IP natively.
It's just trying to auto-detect what IP you're most likely to be reachable on.
Try a packet trace... from memory it only creates the socket, doesn't actually send the packet (?). But I may be wrong there.
-Steve
On 23 March 2014 02:32, Terry Barnum <terry@digital-outpost.com> wrote:
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Specifically it's in src/switch_utils.c:1408 switch_find_local_ip() Reading the code shows that setting the variables force_local_ip_v4 or force_local_ip_v6 will use the value you set instead of autodetecting, should you want to avoid the behaviour you've seen. I'm not sure the origin of the IPv4 address, but the IPv6 one is one of the root DNS servers. Looking at the source appears to confirm my previous statement... it creates a UDP socket and then calls connect to set the destination for packets, but it never actually sends any - just uses getsockname to see which IP it locally bound to. -Steve On 24 March 2014 00:59, Steven Ayre <steveayre@gmail.com> wrote:
Oh, and both IP and port are hardcoded in the source code.
On 24 March 2014 00:58, Steven Ayre <steveayre@gmail.com> wrote:
It's FreeSWITCH trying to automatically detect the ${local_ipv4} and ${local_ipv6} values.
It does this by attempting to send a packet to an IP it knows will have to go over the Internet and seeing which local IP the packet would leave the machine from. That means if you have multiple IPs assigned to your machine it'll know which one will send via the default gateway. That handles the simple single-homed case anyway.
It doesn't really matter whether NAT happens or not, it works just as well if your machine is listening on the public IP natively.
It's just trying to auto-detect what IP you're most likely to be reachable on.
Try a packet trace... from memory it only creates the socket, doesn't actually send the packet (?). But I may be wrong there.
-Steve
On 23 March 2014 02:32, Terry Barnum <terry@digital-outpost.com> wrote:
While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thank you very much for the thoughtful responses Lawrence, Ken and Steve. -Terry On Mar 24, 2014, at 1:35 AM, Steven Ayre <steveayre@gmail.com> wrote:
Specifically it's in src/switch_utils.c:1408 switch_find_local_ip()
Reading the code shows that setting the variables force_local_ip_v4 or force_local_ip_v6 will use the value you set instead of autodetecting, should you want to avoid the behaviour you've seen.
I'm not sure the origin of the IPv4 address, but the IPv6 one is one of the root DNS servers.
Looking at the source appears to confirm my previous statement... it creates a UDP socket and then calls connect to set the destination for packets, but it never actually sends any - just uses getsockname to see which IP it locally bound to.
-Steve
On 24 March 2014 00:59, Steven Ayre <steveayre@gmail.com> wrote: Oh, and both IP and port are hardcoded in the source code.
On 24 March 2014 00:58, Steven Ayre <steveayre@gmail.com> wrote: It's FreeSWITCH trying to automatically detect the ${local_ipv4} and ${local_ipv6} values.
It does this by attempting to send a packet to an IP it knows will have to go over the Internet and seeing which local IP the packet would leave the machine from. That means if you have multiple IPs assigned to your machine it'll know which one will send via the default gateway. That handles the simple single-homed case anyway.
It doesn't really matter whether NAT happens or not, it works just as well if your machine is listening on the public IP natively.
It's just trying to auto-detect what IP you're most likely to be reachable on.
Try a packet trace... from memory it only creates the socket, doesn't actually send the packet (?). But I may be wrong there.
-Steve
On 23 March 2014 02:32, Terry Barnum <terry@digital-outpost.com> wrote: While playing with freeswitch yesterday, Little Snitch reported that freeswitch immediately upon launch tries to establish a connection to 82.45.148.209 and 2001:503:ba3e::2:30 on port 4242.
A whois shows the ipv4 to be from Telewest Broadband in the UK.
The only port 4242 setting I find is in conf/autoload_configs/event_multicast.conf.xml but for 225.1.1.1.
Blocking the connection prevents sofia from registering with flowroute so I'm curious what it is. I couldn't find any relevant search results.
FreeSWITCH Version 1.5.11b+git~20140301T003717Z~f2331de68b~64bit (git f2331de 2014-03-01 00:37:17Z 64bit)
Thanks, -Terry _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (4)
-
Ken Rice
-
Lawrence Conroy
-
Steven Ayre
-
Terry Barnum