ok ... hab mal ein
ngrep "110" -qtW byline port 5060 or port 8088 -d any
auf "110" gemacht
Da sind zwei IP Adressen die nicht dahin gehören ...
173.172.2.208 und 151.105.39.118
.~..SIP/2.0 180 Ringing.
Via: SIP/2.0/TCP
173.172.2.208;branch=z9hG4bK5286610;received=192.168.8.11.
From: sip:
1101@sip.soho-piper.de;tag=18krwj8kxk.
To: sip:
1100@sip.soho-piper.de;tag=as6d931214.
Call-ID: vcap9y1c7hlxkjc5idx6.
CSeq: 4644 INVITE.
Server: Asterisk PBX 11.1.0.
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH.
Supported: replaces, timer.
Contact: <sip:1100@192.168.8.1:5060;transport=WS>.
Content-Length: 0.
.
T 2012/12/12 18:48:30.533221 94.221.97.128:8088 -> 192.168.8.10:53266 [AP]
ACK sip:1100@
151.105.39.118;transport=ws SIP/2.0.
Via: SIP/2.0/WS 192.168.8.1:5060;branch=z9hG4sededbK4a774a7c.
Max-Forwards: 70.
From: <sip:1101@192.168.8.1>;tag=as690f4abd.
To: <sip:1100@
151.105.39.118;transport=ws>;tag=w5cdffqvh8rle.
Contact: <sip:1101@192.168.8.1:5060;transport=WS>.
Call-ID: 6f68a2af41494af1517aa0713bdf8634@192.168.8.1:5060.
CSeq: 102 ACK.
User-Agent: Asterisk PBX 11.1.0.
Content-Length: 0.
.
T 2012/12/12 18:48:30.544707 94.221.97.128:8088 -> 192.168.8.11:49350 [AP]
SIP/2.0 486 Busy Here.
Via: SIP/2.0/TCP
173.172.2.208;branch=z9hG4bK5286610;received=192.168.8.11.
From: sip:
1101@sip.soho-piper.de;tag=18krwj8kxk.
To: sip:
1100@sip.soho-piper.de;tag=as6d931214.
Call-ID: vcap9y1c7hlxkjc5idx6.
CSeq: 4644 INVITE.
Server: Asterisk PBX 11.1.0.
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH.
Supported: replaces, timer.
X-Asterisk-HangupCause: User busy.
X-Asterisk-HangupCauseCode: 17.
Content-Length: 0.