Zombie in closing?

Megamuch · Brekeke Member Joined: 06 Sep 2010 Posts: 10

1. Brekeke Product Name and Version:
sip proxy advanced 3.3.4.4
2. Java version:

3. OS type and the version:
windows
4. UA (phone), gateway or other hardware/software involved:

5. Your problem:

When setting up many calls to the sip provider simultaneously we see a lot of sessions ending up with a status of zombie in closing.

Example:

We set up 150 calls to 150 different destinations within 10 seconds. Some calls fail with 404 or 486 or no answer after 30 seconds so we cancel the call.

Version 3.3.4.4. shows the active session page just fine. It lists all calls that are still in progress - either talking or in call setup. However, the sessonlist page (http://192.168.0.202:18080/sip/cmd?cmd=sessionlist&param-a) shows many calls with a status of zombie in closing.

Looking at the logs I see something like the following:

session.164197: status: Zombie at Closing
session.164197: pkt=7 dp=1 st=0 sip:anonymized@anonymized(an ip from me:5060) --> sip:destinationnumber@sipprovider(ip of sip provider)
send="ACK sip:destination number@sipprovider SIP/2.0"

Since these are robocalls with many invalid destinations I have no real way to check if there is anything really wrong with this or that the system just need extra time to clean up.

Any tips?

taitan · Brekeke Master Guru Joined: 15 Mar 2008 Posts: 237

You don't have to worry about 'Zombie' sessions.

A SIP session becomes a 'Zombie' session if a session was rejected with an error response (such as 404).

A 'Zombie' session remains for while because a SIP UAS may resend a response packet. For handling such resending packets correctly, a 'Zombie' session will remain at least 32 seconds, and be cleared automatically.

Since the session has been closed already, the GUI's [Active Sessions] page doesn't list 'Zombie' sessions but the "sessionlist" command will list all of sessions including 'Zombie'.

taitan · Brekeke Master Guru Joined: 15 Mar 2008 Posts: 237

> Since these are robocalls with many invalid destinations

Are they made by attacker or hacker?

> or that the system just need extra time to clean up.

Yes, the SIP Server needs to wait subsequent packets at least 32sec.

A 'Zombie' status is one of internal information. That's why it is not shown in the GUI. so you don't have to care about it.
The 'sessionlist' command is for developers not for users.