This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Loop Detected

0

Hello

What does SIP Loop Detected Error means? And how can i avoid it?

asked 28 Jun '15, 04:08

hayasb's gravatar image

hayasb
6112
accept rate: 0%

edited 28 Jun '15, 09:00

Hadriel's gravatar image

Hadriel
2.7k2939

Are you sure that's SIP? Can you share a capture somewhere public, or at least post a screenshot of capture with the packet showing the error?

(28 Jun '15, 04:22) grahamb ♦

Please refer to the attached screenshotalt text

(28 Jun '15, 04:25) hayasb

2 Answers:

0

As per the relevant RFC (3261):

21.4.20 482 Loop Detected

The server has detected a loop (Section 16.3 Item 4).

4 Optional Loop Detection check

  An element MAY check for forwarding loops before forwarding a
  request.  If the request contains a Via header field with a sent-
  by value that equals a value placed into previous requests by the
  proxy, the request has been forwarded by this element before.  The
  request has either looped or is legitimately spiraling through the
  element.  To determine if the request has looped, the element MAY
  perform the branch parameter calculation described in Step 8 of
  Section 16.6 on this message and compare it to the parameter
  received in that Via header field.  If the parameters match, the
  request has looped.  If they differ, the request is spiraling, and
  processing continues.  If a loop is detected, the element MAY
  return a 482 (Loop Detected) response.

answered 28 Jun '15, 04:55

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 28 Jun '15, 04:56

Thank you for the information.

Now I had disabled the proxy server from my pc and connecting directly to the internet but still get this error!!

(28 Jun '15, 05:03) hayasb

It's hard to know the precise culprit when we can only see the packet list snapshot instead of the actual packet details, but there's one thing that's visibly wrong:

Look at the target request URI of the REGISTER request message - i.e., the "sip:188.247.67.90" - that identifies the ultimate target of the request. But "188.247.67.90" is the same IP Address as the sender of the message to begin with - in other words, the host 188.247.67.90 is sending the REGISTER message with a SIP destination of 188.247.67.90, so it's no wonder a loop is detected. My guess is that on the 188.247.67.90 computer/phone, you have the Registrar, Registrar Domain, or Address-of-Record set incorrectly.

(28 Jun '15, 08:58) Hadriel

I followed the UDP stream and got the below result; To and from are using the same IP Address. I am using inGate Siparator as DMZ/LAN but don't know what am missing!!:

REGISTER sip:188.247.67.90;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.179.128.228:49012;branch=z9hG4bK-524287-1---3d15be2bf3d75655;rport
Max-Forwards: 70
Contact: <sip:[email protected]:49012;rinstance=24fc7df247922ed7;transport=UDP>
To: "203"<sip:[email protected];transport=UDP>
From: "203"<sip:[email protected];transport=UDP>;tag=88f9ff4d
Call-ID: 9M-KyvmjzBrGB4TqI3H5Fg..
CSeq: 1 REGISTER
Expires: 60
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, outbound, path, X-cisco-serviceuri
User-Agent: Zoiper r30911
Allow-Events: presence, kpml
Content-Length: 0

SIP/2.0 482 Loop Detected Via: SIP/2.0/UDP 10.179.128.228:49012;branch=z9hG4bK-524287-1—3d15be2bf3d75655;received=188.247.77.83;rport=33785 From: "203"<sip:[email protected];transport=UDP>;tag=88f9ff4d Call-ID: 9M-KyvmjzBrGB4TqI3H5Fg.. CSeq: 1 REGISTER To: "203"<sip:[email protected];transport=UDP>;tag=488579bf366f69151236 Server: SIParator/5.0.5 Content-Length: 0

(28 Jun ‘15, 12:35) hayasb

0

Presumably your comment meant to show this:

REGISTER sip:188.247.67.90;transport=UDP SIP/2.0
Via: SIP/2.0/UDP 10.179.128.228:49012;branch=z9hG4bK-524287-1---3d15be2bf3d75655;rport
Max-Forwards: 70
Contact: sip:[email protected]:49012;rinstance=24fc7df247922ed7;transport=UDP
To: "203"sip:[email protected];transport=UDP
From: "203"sip:[email protected];transport=UDP;tag=88f9ff4d
Call-ID: 9M-KyvmjzBrGB4TqI3H5Fg..
CSeq: 1 REGISTER
Expires: 60
Allow: INVITE, ACK, CANCEL, BYE, NOTIFY, REFER, MESSAGE, OPTIONS, INFO, SUBSCRIBE
Supported: replaces, norefersub, extended-refer, timer, outbound, path, X-cisco-serviceuri
User-Agent: Zoiper r30911
Allow-Events: presence, kpml
Content-Length: 0

SIP/2.0 482 Loop Detected Via: SIP/2.0/UDP 10.179.128.228:49012;branch=z9hG4bK-524287-1—3d15be2bf3d75655;received=188.247.77.83;rport=33785 From: "203"sip:[email protected];transport=UDP;tag=88f9ff4d Call-ID: 9M-KyvmjzBrGB4TqI3H5Fg.. CSeq: 1 REGISTER To: "203"sip:[email protected];transport=UDP;tag=488579bf366f69151236 Server: SIParator/5.0.5 Content-Length: 0

Are those the contents of the same capture file you showed a screenshot of?

It doesn’t look like it would be the same messages, but if it is that’s even more confusing… because the IP layer shown in the screenshot showed the IP source address of 188.247.67.90 and destination address of 192.168.0.113 (in the third and fourth columns). Or are your columns reversed? What exactly are the IP source and destination addresses of the SIP message contents shown above (not the SIP-layer info, but the IP-layer info).

I was assuming the IP source was 188.247.67.90, sending a SIP REGISTER request message to 192.168.0.113, but with a SIP request URI of “sip:188.247.67.90;transport=tcp”. That would cause a loop, because when the SIP device on 192.168.0.113 receives it, it will want to forward it right back to 188.247.67.90 (although it may not be a loop if it forwards it to a different TCP/UDP port, but I’ll ignore that detail for now).

The “To” and the “From” headers don’t actually decide how SIP messages are “routed” at the SIP layer (despite the words “To” and “From” sounding like they should). For SIP request messages, such as the REGISTER request, the “request URI” is what decides the ultimate target (along with any “Route” headers, but you don’t have those). The request URI is the string “sip:188.247.67.90;transport=UDP” right after the word “REGISTER”, the first line of the SIP message. The “To” header URI in a REGISTER request identifies the address-of-record being registered for, and the “From” header URI in a REGISTER request identifies the entity performing the registration - usually the same as the “To” header URI, except for third-party registrations (which does not apply to your case).

I don’t know the inGate Siparator, but presumably it’s a SIP ALG, such that it will replace various SIP headers to make it work though NATs and hide internal addressing. So to figure out what’s going wrong we might need a capture of both the “inside” and “outside” packets - i.e., the ones sent to/from the Zoiper soft phone to the inGate, and the ones sent to/from the inGate and the SIP service provider.

But as I said before, you probably didn’t configure your SIP phone correctly (the Zoiper softphone). For a Zoiper, there’s a “Account Wizard” dialog box that shows up when you create the SIP account - what did you set the “[email protected]” field and “domain/outbound proxy” fields to? My guess is one of those two is not set correctly. It looks like you set one of them to “188.247.67.90”, when it should instead be the domain name of your SIP service provider.

answered 28 Jun ‘15, 14:43

Hadriel's gravatar image

Hadriel
2.7k2939
accept rate: 18%

Hello,

Tha configuration am doing is as the attached image.

The idea of it is remote sip extension can able to connect to the pbx without vpn connection. So 188.247.67.90 is the company public IP address. The 1st capture was trying to connect from laptop through wifi connection the other one is connected from mobile phone through data plan in both cases it gave loop detected.

So what you are suggesting is entering public ip address in the domain and the outbound proxy enter the sip domain for the pbx?alt text

(29 Jun ‘15, 02:16) hayasb