• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 304
  • Last Modified:

weird error on my CISCO2911/K9 voice gateway ...

Anyone know why my log buffer in my functioning voice gateway 2911 is full of this message and how I can stop it? debug is not turned on....:

SIP: Trying to parse unsupported attribute at media level

I see a bug report at https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv36964 but they have no advice for how to stop it from constantly filling up my log buffer .... does anyone know how to make this irritating message stop? Is there any way to determine exactly what the "unsupported attribute" message might be that triggers this or where it is coming from? If someone has an old test sending out something repeatedly, am I going to have to sniff packets all day to find it?
0
Jane Updegraff
Asked:
Jane Updegraff
  • 3
  • 2
1 Solution
 
arnoldCommented:
Do you have the packet/sip entire info to see whether this is a sip fishing type of event.
Given the info, what are you hoping to achieve?
First thing, as noted, identify the source of the packet. If external to your provider......
There is little you can do to stop an external source from sending this packet your way.
0
 
Jane UpdegraffSr. Systems AdministratorAuthor Commented:
All I want to achieve is to not have this event filling up my log buffer. I can't keep logs of any "real" activity when one of these messages is logged every five or ten minutes. I guess I can increase the buffer size. Or replace this aging device....

You said:

here is little you can do to stop an external source from sending this packet your way.

....that's what i thought you would say. *sigh*

According to what I've read in the community, this message can't be turned off.  And although I may be able to figure out what's triggering the log entry, if it is something normal that actually belongs in the traffic then I'm out of luck, it seems.  

But thanks for confirming ....
0
 
arnoldCommented:
What resources do you have. Instead of relying on the buffer, I.e. You can forward these event to a syslog server in your environment to a point that you can proactively can configure it to evaluate the event as it arrives, and generate an alert, notification on an event of concern, while these can be discarded, ignored.

Identifying the source of these packets, if coming from the same source, email a complaint to the people in charge based on the Ip registration (arin.net, ripe.net, apnic.net)
They may address this issue and reduce your issue.
0
 
Jane UpdegraffSr. Systems AdministratorAuthor Commented:
As you suggest I would rather know where they are coming from and stop the message from being created to begin with, rather than have to filter my syslog. Thanks for the ideas. :-)
0
 
Jane UpdegraffSr. Systems AdministratorAuthor Commented:
Thanks for the ideas!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now