CajunWon
join:2005-12-30
Cary, NC
 ·ViaTalk
| Router blocking Viatalk as DOS
trivial perhaps as the phone service works great.
I understand how/why my router is blocking 216.246.105.146 ViaTalk, LLC SCNET for DoS protection. My ATA is behind router.
Is there any harm to VoIP quality from this DoS Blocking? IOW will DMZ'n the ATA offer any improvement?
curious |
|
chas3
join:2004-12-03
Dallastown, PA
·ViaTalk
 ·Comcast
| I have never resolved a similar issue for 1.5 years and doesn't seem to cause problems. I get the following in the router's log...
Blocked outgoing ICMP packet (ICMP type 3) from 192.168.1.5 to 64.151.85.68
also, same log to ip 216.246.37.202
I have asked around why my router (Zyxel x-550) is blocking outgoing packets with no resolution. I have tried DMZ, SPI on/off, SIP ALG on/off,...turning off every feature I could and could not get rid of this.
But, phone works pretty well anyway. DMZ off with several ports forwarded. I would like to understand what this blocking is all about. |
|
philster
join:2007-11-05
Columbus, OH
edit:
October 2nd, @01:57PM
| Ping is a ICMP packet. You adapter is trying to ping Viatalk. Your router should have a setting to alowe outgoing pings. Try turning it on. |
|
chas3
join:2004-12-03
Dallastown, PA | only incoming pings can be changed. And I've tried that too. I'm not concerned since my phone works well, just thought it might be related issue to CajunWon. |
|
CajunWon
join:2005-12-30
Cary, NC
·ViaTalk
| reply to CajunWon
Adding to trivia question -still trivial, learning interest only.
I can't monitor traffic, nor do I care to, curious why VT is pinging me. I know the ATA registers periodically, sends then receives a ping from the same IP -that's not being blocked. So why does VT send a ping from another IP address to my BYOD ATA? They don't really need to know about it.
VT does need to initiate an unsolicited ping to my ATA with incoming call.
Incidentally: router was blocking that ping every 2-5 seconds when I started this post. Yet that IP doesn't appear today in the blocked list. |
|
jester121
join:2003-08-09
Lake Zurich, IL | Isn't this part of the new architecture where the ATA calls are routed directly through the gateway instead of through VT's servers? |
|
philster
join:2007-11-05
Columbus, OH | reply to CajunWon
If I remember right the ping is to let Viatalk server know your adapter is active. |
|
CajunWon
join:2005-12-30
Cary, NC
·ViaTalk
| said by philster  :If I remember right the ping is to let Viatalk server know your adapter is active. I was thinking that the adapter initiates a periodic registration, thus sending a ping which gets gets an immediate ping reply (which should not be blocked by router). I set the registration interval, forget but think it's once every 6 minutes. |
|
mogulman
Premium
join:2002-09-09
Parker, CO
·ViaTalk
·Comcast
| reply to CajunWon
Actually a lot of this is DNS for the ATA (PAP2) devices. The way Viatalk configurs the PAP2(T) devices, they are set up to do Parallel DNS to the DNS Servers (Usually VT servers).
The ATA sends DNS requests to both DNS servers at the exact same time and which ever one responds first is the one it uses. Some routers block this because they think it is some kind of DoS attempt. I know many routers that use the same type of firmware from D-Link, Zyxel and Trendnet.
You can change the setting in the PAP2 devices on the system tab. DNS Query Mode is the setting. Just change it from Parallel to Sequential. Sequential will cause the ATA to use one first and then the other, rather then both at the same time.
Of course if you want the above change to be permanent on a VT provided device, you would need to have VT change your provision file. |
|
johnzprecisi
join:2007-09-05
Elma, NY
·RoadRunner Cable
| I was wondering if this is the same thing going on as in the other posts. I have a Dlink DGL4100 router and this goes on continuously. The adapter is currently in the DMZ. The adapter is a Viatalk PAP2T at the 192.168.0.111 address. Are the addresses the adapter is trying to send packets to addresses it should be? Like I said above the logs are just filled with all it can record. Any help or explanation would be very much appreciated.
[INFO] Wed Oct 08 07:29:55 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:29:16 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:29:02 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:27:45 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:27:17 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:26:56 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:26:37 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 98.115.129.45
[INFO] Wed Oct 08 07:26:00 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:25:15 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:24:56 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:23:18 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:23:07 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:22:12 2008 Log viewed by IP address 192.168.0.123
[INFO] Wed Oct 08 07:22:08 2008 Allowed configuration authentication by IP address 192.168.0.123
[INFO] Wed Oct 08 07:21:47 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 69.1.229.40
[INFO] Wed Oct 08 07:21:47 2008 Previous message repeated 6 times
[INFO] Wed Oct 08 07:21:36 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 216.246.37.203
[INFO] Wed Oct 08 07:21:36 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:21:23 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:21:07 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:20:17 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 64.151.85.68
[INFO] Wed Oct 08 07:20:17 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 216.246.37.202
[INFO] Wed Oct 08 07:19:48 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:19:19 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:19:01 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:17:48 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201
[INFO] Wed Oct 08 07:17:26 2008 Previous message repeated 1 time
[INFO] Wed Oct 08 07:16:57 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 193.61.111.40
[INFO] Wed Oct 08 07:16:47 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 64.151.85.68
[INFO] Wed Oct 08 07:16:47 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 216.246.37.202
[INFO] Wed Oct 08 07:15:55 2008 Blocked outgoing ICMP packet (ICMP type 3) from 192.168.0.111 to 198.209.32.201 |
|
mogulman
Premium
join:2002-09-09
Parker, CO | reply to CajunWon
yep.. same thing.. DNS requests.. you can remove a lot of them by adjusting the Parallel to Sequential DNS setting in the PAP2. |
|
johnzprecisi
join:2007-09-05
Elma, NY | Well thanks for the reply, I put in a ticket for Viatalk to change my provisioning file to sequential. Many of the entries seem to be at separate times and they are still being blocked. Will this effect the service in any way? |
|
mogulman
Premium
join:2002-09-09
Parker, CO
edit:
October 8th, @10:03AM
| Yeah.. because it only shows the blocked message. Not the duplicate that actually got through.
I haven't noticed it affecting anything either way. I just like having my log cleaner. |
|
mogulman
Premium
join:2002-09-09
Parker, CO | reply to CajunWon
BTW.. changing this won't completely eliminating the log entries, but there will be less. |
|
