Quadro using 20 meg a day data with no calls

[russell]

After first installing the Quadro 2X unit I noticed something that has never been present with any other VOIP PABX we have tried.

A steady constantly pulsing light on the router ethernet port that the 2X was plugged into and also on the WAN port.

On further investigation using the ADSL modems tools the 2X unit has a continuous steady 2Kbps upload and download. thats around 20 meg a day with no phone calls.

What's is this continuos stream of data ? and can it be reduced ?

[AramK]

The traffic generated by Quadro can have different reasons. Here are most common ones.

1. You have big amount of extensions on Quadro registered on internal SIP server.
solution: delete/unregister unused extensions.
2. Your ITSP reguires a very small timeout for SIP registration.
solution: insrease registration timeout.
3. STUN server is unnecessarily enabled on Quadro and due to failure it's not stopping port scanning.
solution: Disable STUN server.

Then can be another reasons too. Check these 3 points first, then we'll continue our investigation if needed.

[russell]

1) re extensions and sip server , I have disabled all external SIP registration for extensions and we are talking 20 meg a day to the WAN internet external to the ADSL modem

it is not a connection every 60 seconds or 30 seconds .... it is a steady continual 2Kbps upload and 2Kbps download ... the modems traffic tool shows a steady traffic rate of 2Kbps to and from the 2X unit

2) ITSP not sure where to look for this setting on the ITSP extension

3) even if STUN where active would it not be every 30 or 60 seconds etc ... this is a steady data stream.

I looked at the STUN setting but could not see where to turn it off

[AramK]

1. OK

2. Check the page "Telephony -> SIP Settings" page, SIP timers table.

3. You can disable NAT Traversal (STUN/Manual NAT) from "Telephony -> NAT Traversal Settings" page. I was talking about unnecessarily enabled STUN, when there is no need for STUN to be enabled. In that case if STUN isn't detecting the ports correctly, it will continue port scanning with small intervals and can produce such traffic. You can see the detected connection type by STUN from "System -> Status -> SIP Registration Status" page, in the very bottom.

Is there any other devices connected on Quadro LAN side or to the same ADSL line ?

[russell]

2) SIP timers are set to standard

3) NAT traversal was set to automatic , I have turned this OFF (made no change)

The Quadro LAN has nothing but IP Phones 6 off them 3 Snom, 1 Aastra , 1 x Grandstream , 1 x Polyvom

this continual traffic was not present before the Quadro was on the LAN. But I did have it auto configure all the phones (except the Grandstream)

[AramK]

It can't be connected to IP-Phones, because they are registering on Quadro. Can you explain the following sentence - "this continual traffic was not present before the Quadro was on the LAN" ?

[AramK]

Can you run a capture between Quadro WAN side and ADSL modem, to see what traffic is there exactly and to what IPs ? There is another suspect that you Quadro is under port scanning/attack from outside.

[russell]

"this continual traffic was not present before the Quadro was on the LAN"

I mean prior to installing the Quadro this was not happening

Re port scan: this started happening immediately when the unit was installed so I would guess that a port scan would not be so fast

I have got IDS turned on and there have been one or 2 reports of a port scan but the logs show that it is certainly not continuous.

[russell]

OK found the source.

On my ADSL modem I can block traffic ... I blocked the 2Kbps stream and the connection to the main office Asterisk server stopped working.

My question now is ... Once you setup a VOIP provider (ITSP) where on the Quadro can you change the time settings for the ITSP, obviously for some reason there is a continuous 2Kbps between the 2

I have had this same peer setup before between 2 asterisk servers and this traffic does not occur so I am guessing it's generated from the Quadro end.

[AramK]

Very strange ... Network capture is needed to determine what kind of traffic is there and who is the originator, then find the reason of that traffic and the ways of eliminating it.