Too much traffic

[Dionysis]

Hi all,

I've got a particularly weird issue.

We have an ISDN gateway in Country A, a SIP Server in Country B, and 2 Stream Managers acting as call recorders in Country B, with agents sitting in a call centre attached to the data centre in Country B.  The idea being that the RTP Stream stays in Country B, while the signalling traverses a link to country A.

Functionally everything works perfectly.

However, we are see 3 times the amount of UDP traffic from the agent PC's (all running IWS with SIP Endpoint) to the Stream Managers.  eg. if 1 Mb is sent from the Stream Manager to the Endpoint, 3 Mb's are being sent in the other direction.

We have several other call centres running in various places using almost identical architecture where the UDP traffic is close enough to being identical in both directions (agent leg and customer leg).

Anyone else seen anything like this?

[cavagnaro]

Maybe you are recording the calls?

[Dionysis]

[quote author=cavagnaro link=topic=7099.msg30571#msg30571 date=1334846604]
Maybe you are recording the calls?
[/quote]

Yes Cav, all calls are being recorded for all our sites.  But when using SM as a recorder there is still only 1 call leg to the gateway and 1 to the agent.  Which means 1 RTP stream from the SM to the agent, and 1 from the agent to the SM.  This generally gives you almost exactly the same amount of ingress and egress traffic.  However for the site in question I am seeing 3 times more from the agent to the SM than the other direction.

[aj]

Are the supervisors monitoring the calls?

[Dionysis]

No, no monitoring is occurring.

Since making this post I have confirmed that the SIP Server does not send a BYE message for some calls, the endpoint continues to send RTP after one of these calls.  However new calls connect to the agent without any issue, and the RTP for these calls ends correctly.

Critical ticket raised with Genesys, I suspect a either a SIP Server bug, or gateway config issue.

[aj]

I guess this one will be resolved, or at least understood, by now? Care to satisfy my curiosity? Please.

[Dionysis]

[quote author=aj link=topic=7099.msg30639#msg30639 date=1336401504]
I guess this one will be resolved, or at least understood, by now? Care to satisfy my curiosity? Please.
[/quote]

You are correct, we have resolved the issue.

Turns out there was a Juniper router as part of the link between the agent and SIP Server (not managed by me) that had SIP inspection active by default.  It was allowing most traffic through but occasionally was dumping some of the messages.  Disable SIP Inspect = problem solved.