Friday, January 8, 2021

Using TCP Keepalive to Detect Network Errors

This is not only a H.323 topic, but since H.323 also uses TCP connections, it applies to H.323 as well:

To detect network errors and signaling connection problems, you can enable TCP keep alive feature. It will increase signaling bandwidth used, but as bandwidth utilized by signaling channels is low from its nature, the increase should not be significant. Moreover, you can control it using keep alive timeout.

The problem is that most system use keep alive timeout of 7200 seconds, which means the system is notified about a dead connection after 2 hours. You probably want this time to be shorter, like one minute or so. On each operating system, the adjustment is done in a different way.

After settings all parameters, it's recommended to check whether the feature works correctly - just make a test call and unplug a network cable at either side of the call. Then see if the call terminates after the configured timeout.

Linux systems

Use sysctl -A to get a list of available kernel variables
and grep this list for net.ipv4 settings (sysctl -A | grep net.ipv4).
There should exist the following variables:
net.ipv4.tcp_keepalive_time:   time of connection inactivity after which
                               the first keep alive request is sent
net.ipv4.tcp_keepalive_probes: number of keep alive requests retransmitted
                               before the connection is considered broken
net.ipv4.tcp_keepalive_intvl:  time interval between keep alive probes

You can manipulate with these settings using the following command:

sysctl -w net.ipv4.tcp_keepalive_time=60 net.ipv4.tcp_keepalive_probes=3 \
    net.ipv4.tcp_keepalive_intvl=10

This sample command changes TCP keepalive timeout to 60 seconds with 3 probes,
10 seconds gap between each. With this, your application will detect dead TCP
connections after 90 seconds (60 + 10 + 10 + 10).

FreeBSD and MacOS X

For the list of available TCP settings (FreeBSD 4.8 an up and 5.4):

sysctl -A | grep net.inet.tcp

net.inet.tcp.keepidle - Amount of time, in milliseconds, that the (TCP) 
connection must be idle before keepalive probes (if enabled) are sent.

net.inet.tcp.keepintvl - The interval, in milliseconds, between 
keepalive probes sent to remote machines. After TCPTV_KEEPCNT (default 
8) probes are sent, with no response, the (TCP)connection is dropped.

net.inet.tcp.always_keepalive - Assume that SO_KEEPALIVE is set on all 
TCP connections, the kernel will periodically send a packet to the 
remote host to verify the connection is still up.

therefore formula to calculate maximum TCP inactive connection time is 
following:

net.inet.tcp.keepidle + (net.inet.tcp.keepintvl x 8)

the result is in milliseconds.

therefore, by setting
net.inet.tcp.keepidle = 10000
net.inet.tcp.keepintvl = 5000
net.inet.tcp.always_keepalive =1 (must be 1 always)

the system will disconnect a call when TCP connection is dead for:
10000 + (5000 x 8) = 50000 msec (50 sec)

To make system remember these settings at startup, you should add them 
to /etc/sysctl.conf file

Solaris

For the list of available TCP settings:

ndd /dev/tcp \?

Keepalive related variables:
- tcp_keepalive_interval - idle timeout

Example:
ndd -set /dev/tcp tcp_keepalive_interval 60000

Windows 2000 and Windows NT

Search Knowledge Base for article ID 120642:
http://support.microsoft.com/kb/120642/EN-US

Basically, you need to tweak some registry entries under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Thursday, October 29, 2020

GNU Gatekeeper 5.6 released

Today GNU Gatekeeper version 5.6 has  been released.

Download: https://www.gnugk.org/h323download.html

It contains an important bug fix to H.460.19 multiplexing and H.460.26 (media over TCP) when using GnuGk's internal call forwarding (ForwadOnFacility).

I have also added an interop tweak to be able to call video services that don't understand H.323 URL aliases (eg. videobutler.nl). You can enable it with

[Routing::SRV]
ConvertURLs=1

Here is the full changelog:

  • new switch: [Routing::SRV] ConvertURLs=1 to convert URL_IDs into H323_IDs
  • BUGFIX(ProxyChannel.cxx) fix RTP multiplexing and H.460.26 when ForwardOnFacility is used
  • BUGFIX(ProxyChannel.cxx) remove H.460.19 feature from Setup when using ForwardOnFacility=1
  • new switch: [Gatekeeper::Main] GrantAllBRQ=1 to accept any BRQ, even if the conferenceID is invalid


Tuesday, June 30, 2020

GNU Gatekeeper 5.5. released

I am happy to announce the release of GNU Gatekeeper 5.5.

This release has new features and bug fixes when you run clustered gatekeepers. It also improves the port detection feature and we have a complete and up to date Chinese documentation.

You can download it from https://www.gnugk.org/h323download.html

New features:
  • new feature GnuGkAssignedGatekeeper to push endpoints back to their intended home gatekeepers in the cluster, even if the endpoints don't support assigned gatekeepers
  • support new PBKDF2 password hashes for ssh logins to the status port
  • new switches to fine tune port detection for H.239 channels (IgnoreSignaledPublicH239IPsFrom=x and IgnoreSignaledAllH239IPs=1)
  • new Chinese manual

Bug fixes:
  • select correct source IP for neighbor pings
  • set altGKisPermanent=true when redirecting endpoints
  • fix RRJ to include alternates when RedirectGK=Endpoints limit is reached
  • fix reading of AllowSignaledIPs= switch
  • don't complain about [Neighbor::xxx] SendAliases switch when using--strict

Enjoy!

Tuesday, January 7, 2020

GNU Gatekeeper 5.4 released

I am happy to announce the release of GNU Gatekeeper 5.4.

You can download it from https://www.gnugk.org/h323download.html

New features:
  • new accounting module to send accounting data to an MQTT server
  • support for redis as database (eg. as backend for password storage)

Bug fixes:
  • important fix for H.245 tunneling translation with H.460.18 endpoints
  • fix for snmpwalk in PTLib-SNMP implementation
  • fix sending alternate gatekeeper list to endpoints with assigned gatekeeper
  • improved DRQ from child gatekeepers
  • fix TLS with neighbor gatekeeper


Please also note that a bug has been found in PTLib that can cause a crash in any GnuGk version if you use the status port (manually of from an application). Please upgrade to PTLib 2.10.9.3!

Monday, August 12, 2019

Howto block H.323 spam calls with fail2ban

When you run the GNU Gatekeeper, you can block spam calls from the well known bots ("MERA RU", "SimpleOPAL" etc.) eg. using a small LUA script in your config.

But that alone doesn't stop the load on the server, because often these bots keep on making calls.

Fail2ban to the rescue!

With this filter definition in /etc/fail2ban/filter.d/gnugk.conf you can check fro rejected calls:

[Definition]
failregex = Dropping call CRV=[0-9]+ from <HOST>:[0-9]+ due to Setup authentication failure
ignoreregex =



And then you can add this jail definition to /etc/fail2ban/jail.local to block the IP:

[gnugk]
enabled  = true
logpath  = /var/log/gnugk.log
filter   = gnugk
bantime  = 6000
maxretry = 2
action   = iptables[name=GnuGk, port=1720, protocol=tcp]



Voila!

Friday, July 26, 2019

GNU Gatekeeper 5.3 released

I have just released GNU Gatekeeper version 5.3.

You can download it from https://www.gnugk.org/h323download.html

This release has a number of new features as well as some important bug
fixes.

Whats new ?

  • LRQ loop detection to optimize calls flows between multiple neighbor gatekeepers This new feature has the potential to significantly reduce the load on all gatekeepers and prevent "LRQ storms".
  • new routing policy to set call destinations by querying HTTP or REST servers, see [Routing::Http]
  • much improved support for SNMP
  • important bug fix for TLS encryption of signaling channels
  • important bug fixes for H.460.18 NAT traversal (for H.245 tunneling and for multi-homed servers)
  • performance optimization: this version can handle 5-10% more proxied  calls on the same hardware
  • performance optimization: re-authenticate lightweight, additive registrations only when new aliases differ. This significantly reduces the load on password databases.

Enjoy!


Full change log:

- BUGFIX(ProxyChannel.cxx) don't send H.245 address to tunneling
  H.460.18 endpoint, breaks call when H.245 multiplexing
- performance optimization: 5% faster UDP handling
- changed default: [SNMP] Implementation=PTlib
- remove unfinished Windows-SNMP implementation, use PTLib-SNMP on Windows
- support SET and GET-NEXT in PTLib-SNMP
- support SNMP sysUpTime when running as standalone agent
- BUGFIX(configure.in) LARGE_FDSET defaults to off
- new SNMP OID 1.3.6.1.4.1.27938.11.1.9 to query total bandwidth allocated to ongoing calls
- BUGFIX(ProxyChannel.cxx) fix hangup when making many TLS calls quickly one after another
- BUGFIX(RasSrv.cxx) don't require H.460.22 parameters in ARQs
- BUGFIX(ProxyChannel.cxx) fix TLS without LARGE_FDSET
- BUGFIX(ProxyChannel.cxx) don't send H.460.22 priority field in SCI
- BUGFIX(gkauth.cxx) free memory from cached and expired passwords
- re-authenticate lightweight, additive registrations only when new aliases differ
- remove switch [Proxy]DisableRTPQueueing, always disabled now
- new routing policy: http with config section [Routing::Http]
- BUGFIX(ProxyChannel.cxx) fix H.460.18 on multi-homed servers (SCI comes from the correct IP now)
- new switch to disable SNMP traps [SNMP] EnableTraps=0
- BUGFIX(ProxyChannel.cxx) don't throw SNMP trap on H.245 connection errors
  (causes crash under load with Net-SNMP)
- BUGFIX(snmp.cxx) shutdown GnuGk when SNMP agent can't be started
- BUGFIX(snmp.cxx) protect NetSNMP library calls with mutex
- changed default: ForwardResponse now defaults to 1 in [RasSrv::LRQFeatures] and [Neighbor::...]
- new feature: loop detection for LRQs [RasSrv::LRQFeatures] LoopDetection=1
- BUGFIX(Neighbor.cxx) some settings in [RasSrv::LRQFeatures] were ignored if not set in [Neighbor::...]

Wednesday, June 5, 2019

Celebrating 20 Years of GnuGk

20 years

20 years ago, in June 1999, I released the first version of the GNU Gatekeeper. Back then we still called it "OpenH323 Gatekeeper".

The first version was very simple and only supported RAS and what we call 'direct mode' today, but it still seems useful to people and within a year it grew into a tool that people used in production.

I quit my day job in 2003 to work full time on GnuGk and it has feed the family ever since. I am still amazed how well it works to give software away for free. How many people and companies contribute and give feedback and how many are willing to pay for support or new
features.

I want to thank everybody who used it, provided feedback, bug fixes and ideas to make it into the great software that it is today!

We are not stopping here, the next release is already underway with many improvements and new features. Watch for it!

Happy Birthday GnuGk!