I have a linode instance that is dropping SIP packets via nf_ct_sip from a particular site in Asia.
Nov 2 09:39:06 kernel: nf_ct_sip: dropping packetIN=eth0 OUT= MAC=f2::91:df:c9::c8:4c:75:f5:c4:ff:08:00 SRC=11_.21_.8_.13_ DST=_.1.2_.22_ LEN=594 TOS=0x00 PREC=0xA0 TTL=47 ID=53543 PROTO=UDP SPT=17747 DPT=5060 LEN=574
This is known to be "solved" by blacklisting kernel modules:
nf_nat_sip nf_conntrack_sip
However on linode it appears to be that the kernel has them linked statically.
My Ubuntu instance apparently wont boot with anything older than 2.6.32 which is the version that included a change to test the lenght of the packet compared to the Content Length reported on the SIP headers.
My question is, can anything be done on server side (iptables rules) or on the client site to try to overcome this issue?
