<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On 6/04/2017, at 12:25 AM, Abdoul Osséni <<a href="mailto:abdoul.osseni@gmail.com" class="">abdoul.osseni@gmail.com</a>> wrote:</div><div class=""><div dir="ltr" class=""><div class="">I have always this issue with NAT devices using VSS-Monitoring protocol.</div><div class=""><br class=""></div><div class="">A network capture shows:</div><div class="">- Kamailio sends a tcp keepalive </div><div class="">- The NAT device sends a tck keepalive ACK to Kamailio with a new filed : vss-monitoring</div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span></div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>Frame 70: 62 bytes on wire (496 bits), 62 bytes captured (496 bits)</div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>Linux cooked capture</div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>Internet Protocol Version 4, Src: x.x.x.x, Dst: x.x.x.x</div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>Transmission Control Protocol, Src Port: 13178, Dst Port: 443, Seq: 2752, Ack: 6214, Len: 0</div><div class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span><font color="#ff0000" class=""><b class="">VSS-Monitoring ethernet trailer, Source Port: 0</b></font></div><div class=""><font color="#ff0000" class=""><b class=""><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>Src Port: 0</b></font></div></div></div></blockquote><br class=""></div><div>Hi,<div class=""><br class=""></div><div class="">VSS-Monitoring is a function of your monitoring tap, is is not a function of your NAT box - <a href="http://www.vssmonitoring.com/resources/feature-brief/Port-and-Time-Stamping.pdf" class="">http://www.vssmonitoring.com/resources/feature-brief/Port-and-Time-Stamping.pdf</a></div><div class="">It should not be included in the actual traffic packets going past the tap - only the packets that you see on your network analyser - if you find that it is included on actual packets, you need to talk to your networking people and get that fixed.</div><div class=""><br class=""></div><div class="">It is very unlikely that a NAT device sends anything other than synthesised RST packets. It certainly won’t be generating close notify TLS alerts - I’m not actually sure that it can, they might need to be authenticated.</div><div class=""><br class=""></div><div class="">If you are seeing a close notify, you should capture between the UAC and the NAT device - I believe you will see the close notify TLS alert coming from the UAC. If that is the case, you need to look at the UAC for why it’s doing that. Perhaps your UAC does not support TCP keepalives properly.</div><div class=""><br class=""></div><div class="">--</div><div class="">Nathan Ward</div><div class=""><br class=""></div></div></div></body></html>