Robyn - 2009-11-24

Hi,

I have the nf_nat_h323 module loaded on Kernel 2.6.30 on a Debian based Linux router and have a bunch for H323 speaking devices being NAT'ted behind it.  The H323 software in use is Mera MVTS Pro.  Several times per minute, the following message is sent to syslog:

nf_ct_h323: incomplete TPKT (fragmented?)

Initially there was an issue with the expect table overflowing and dropping excess packets.  I have resolved this issue by simply increasing the expect max value but the incomplete TPKT error still persists.  I am not sure at this point if this error is actually associated with any real problem or if it's safe to ignore.  Calls seem to be working properly with no reported issues since increasing the expect table size.

I ran a packet capture and viewed the TPKT info from several packets.  None of them had a length smaller than 4 (from researching it appears that this would have triggered the error message).  So, I am not sure what else to look for.  Any help would be greatly appreciated.

Thanks!

Robyn