Cannot connect to login server

[wahran]

Hi,

I have a PAP2 that has been configured and working with Voxalot for the last 5 months, until this past week. I am getting the "Cannot connect to login server" error message.

My PAP2 configuration has not changed, and I had done it per the voxalot instructions. I have tried all 3 server clusters: us, eu and au and with different combinations of ports (80, 443, 2060...etc port 5060 is blocked here, I have been changing the prefered cluster both in my voxalot profile and PAP config to match).

I have tried "telnet xxx.voxalot.com port#" and I get a connected, so these are not blocked (xxx = eu, us and port # = 80, 443, 2060 ...etc).

My login ID and password are correct, so what gives? I am out of ideas to try. Any help will be appreciated.

Thanks,

Chafik

[wahran]

Some "debugging" information, telnetting to active ports 80, 4060 and bogus port 9999 as a control

$ telnet us.voxalot.com 80
Trying 64.34.173.199...
Connected to us.voxalot.com.
Escape character is '^]'.

sip?

Connection closed by foreign host.

Chafik@CHStudio17 /cygdrive/c/downloads/SIPtrace
$ telnet us.voxalot.com 4060
Trying 64.34.173.199...
Connected to us.voxalot.com.
Escape character is '^]'.

Connection closed by foreign host.

Chafik@CHStudio17 /cygdrive/c/downloads/SIPtrace
$ telnet us.voxalot.com 9999
Trying 64.34.173.199...
telnet: Unable to connect to remote host: Connection refused

Chafik@CHStudio17 /cygdrive/c/downloads/SIPtrace
$

I believe the above shows that I can get through to us.voxalot.com on ports 80 and 4060.

Now using Sipsak on the same host/ports, obviously mypassword and myid I used were the real things.

C:\Downloads\SIPTrace>sipsak-0.9.5.exe -T -a mypassword -s sip:myid@us.voxalot.com:4060
warning: IP extract from warning activated to be more informational

(I had to CTRL-C out of it after a few minutes wait).

C:\Downloads\SIPTrace>sipsak-0.9.5.exe -T -a mypassword -s sip:myid@us.voxalot.com:80
warning: IP extract from warning activated to be more informational
nothing received, select returned error

C:\Downloads\SIPTrace>sipsak-0.9.5.exe -T -a mypassword -s sip:myid@us.voxalot.com:9999
warning: IP extract from warning activated to be more informational
0: timeout after 500 ms
0: timeout after 1000 ms
0: timeout after 2000 ms

I might be wrong, but this seems to indicate that the problem is not on my
end.

Thanks,

Chafik

[wahran]

Hello again,

Any chance an admin can quickly check my account to make sure there is nothing wrong with it?

I have a VoxLite account so that I could connect to axvoice on their default port 5060 (blocked here), and I really need to use my phone line.

I understand that this is a low cost service ($15/yr) and I knew not to expect much in terms of support, but I would be grateful if voxalot could just tell me that my account is fine, and to look for the problem elsewhere.

(using wireshark and sipsack to initiate the registration didn't help much, there were no replies whatsoever from voxalot).

Thanks,

Chafik

[boatman]

Originally Posted by wahran

I have tried "telnet xxx.voxalot.com port#" and I get a connected, so these are not blocked (xxx = eu, us and port # = 80, 443, 2060 ...etc).

Of course telnet uses TCP packets whereas your PAP2 is probably set to use UDP packets for SIP messages. Did any of your test programs use UDP packets?

Have you used Wireshark to monitor packets to and from your PAP2?

How do you know that your ISP has not switched from simple blocking of port 5060 to a more sophisticated deep packet inspection?

[wahran]

First, thanks for your reply.

Originally Posted by boatman

Of course telnet uses TCP packets whereas your PAP2 is probably set to use UDP packets for SIP messages. Did any of your test programs use UDP packets?

No, just TCP, to make sure these ports were not blocked (assuming most times, when the ISP blocks them, it's both TCP and UDP.), now how would you test UDP if you have no control over the other end, is there a way? I am under the impression that you send your UDP packet and it's gone (no ack...etc).

Originally Posted by boatman

Have you used Wireshark to monitor packets to and from your PAP2?

Yes, but I didn't learn much from it. I used sipsak to register on voxalot, and wireshark to observe the handshaking, I could see sipsak trying to register, but nothing coming back.

Originally Posted by boatman

How do you know that your ISP has not switched from simple blocking of port 5060 to a more sophisticated deep packet inspection?

I don't. I was just trying to eliminate one unknown, which is that the voxalot end is ok.

Chafik

[boatman]

Originally Posted by wahran

how would you test UDP if you have no control over the other end, is there a way? I am under the impression that you send your UDP packet and it's gone (no ack...etc).

Using nmap and Wireshark I sent some UDP packets on port 4060. I observed that when there is no service running on that port then an "ICMP Destination unreachable" packet is returned, but if there is a service then no packet is returned.

nmap -P0 -sU -p4060 us.voxalot.com
no packet was returned

nmap -P0 -sU -p4040 us.voxalot.com
ICMP Destination unreachable" packet was returned because us.voxalot.com does not use UDP port 4040.

nmap -P0 -sU -p4060 proxy01.sipphone.com
ICMP Destination unreachable" packet was returned because proxy01.sipphone.com does not use UDP port 4060.

[wahran]

Here is the nmap UDP scans:

$ ./nmap.exe -PO -sU -p4060 us.voxalot.com

Starting Nmap 5.00 ( Nmap - Free Security Scanner For Network Exploration & Security Audits. ) at 2009-10-08 08:24 Eastern Daylight Time

Interesting ports on premium.voxalot.com (64.34.173.199):
PORT STATE SERVICE
4060/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 5.97 seconds

Well no needed to paste all the scans, the result is the same.

Thanks,

Chafik