We help IT Professionals succeed at work.

Why is my SIP server flooding my IP Phone with 35 DIS packets per second?

Dooglave asked
Medium Priority
Last Modified: 2012-05-05
Why is my SIP server flooding my IP Phone with 35 DIS Protocol packets per second?

I don't even know why the server is sending this packet but when it happens the incoming voice is all garbled. All of these DIS Packets come from the Server to the client phone. Never from the phone. Therefor outgoing voice is always crystal clear.  If we change the IP on the phone it clears up until some unknown events gets the server to start flooding the phone with these packets again.

If any one can give me clues to what this packet is used for I might be able to put together a idea of how to resolve this.  

Here is a packet:

No.     Time        Source                Destination           Protocol Info
    748 6.389540    xxx.xxx.xxx.xxx         xxx.xxx.xxx.xxx          DIS      Source port: 16396  Destination port: hbci

Frame 748 (294 bytes on wire, 294 bytes captured)
    Arrival Time: Jan 24, 2008 17:30:32.984011000
    [Time delta from previous captured frame: 0.030112000 seconds]
    [Time delta from previous displayed frame: 0.030112000 seconds]
    [Time since reference or first frame: 6.389540000 seconds]
    Frame Number: 748
    Frame Length: 294 bytes
    Capture Length: 294 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:ip:udp:dis]
    [Coloring Rule Name: UDP]
    [Coloring Rule String: udp]
Ethernet II, Src: JumpIndu_17:60:0b (00:e0:4b:17:60:0b), Dst: Aastra_18:bb:f4 (00:08:5d:18:bb:f4)
    Destination: Aastra_18:bb:f4 (00:08:5d:18:bb:f4)
        Address: Aastra_18:bb:f4 (00:08:5d:18:bb:f4)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Source: JumpIndu_17:60:0b (00:e0:4b:17:60:0b)
        Address: JumpIndu_17:60:0b (00:e0:4b:17:60:0b)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: IP (0x0800)
Internet Protocol, Src: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx), Dst: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 280
    Identification: 0x2cbd (11453)
    Flags: 0x00
        0... = Reserved bit: Not set
        .0.. = Don't fragment: Not set
        ..0. = More fragments: Not set
    Fragment offset: 0
    Time to live: 128
    Protocol: UDP (0x11)
    Header checksum: 0x7ecf [correct]
        [Good: True]
        [Bad : False]
    Source: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
    Destination: xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx)
User Datagram Protocol, Src Port: 16396 (16396), Dst Port: hbci (3000)
    Source port: 16396 (16396)
    Destination port: hbci (3000)
    Length: 260
    Checksum: 0x4e40 [correct]
        [Good Checksum: True]
        [Bad Checksum: False]
Distributed Interactive Simulation
        Protocol Version = Unknown Enum Value
        Exercise ID = 0
        PDU Type = Unknown Enum Value
        Protocol Family = Unknown Enum Value
        Timestamp = 84844320
        Length = 41171
        Explicit Padding (2 bytes)
    Unknown PDU

Watch Question

Telecom Engineer
Top Expert 2005
what kind of sip server are you using? is the traffic running through an SBC of some sort that may be remarking the packets? Seems odd that it would be using DIS unless there's some extenion you're running.


The EU was hitting random keys and that caused the problem on the server. A hot fix was compiled from the SW Vendor and that resolved it.


Fixed with Hotfix