Hi, This is a very serious problem for my users AT this site. PLEASE help. I suspect it is a NAT issue reaching the extension. I have tried <variable name="sip-force-contact" value="NDLB-connectile-dysfunction"/> with no change. I have tried TCP instead of UDP. Details of the problem: User extension initiates a call (INVITE after auth required). User hears ringing for approximately 20 seconds, then a busy signal. Today a user called her own cell phone and said it WAS ringing when the call failed. I see some RTP packets between 183 session progress from FS to extension and CANCEL, but can't tell what extension hey are to/from. I see a very single strange RTP from FS to itself: unknown RTP protocol version 3. The call CANCEL is initiated from FreeSwitch at 22.75 seconds after the invite to FS. PCAP issue: I am trying to trace down a problem with tshark. The short version of my question is how do I tell which NAT extension RTP packets are going to and why did FS cancel the call? The full explanation is: I have identified the failed call based on the INVITE from the NAT extension's IP and PORT number. I am able to follow the SIP packets is OK. I see RTP packets to and from that IP address, but I cannot determine what extension it is going to. I also see an ICMP from the FSserver to the extension's external IP aftern the CANCEL. We block ICMP. Is that a problem? I have the full pcap file if someone could PLEASE help Pcacp file: http://brianbunce.com/capturefile.pcap (11 MB) It is a customer site, be kind. The invite from the ext is packet# 2334. The invite to the GW is packet# 2357. That will show you all IPs involved. Thanks for any help, Sean