Troubleshooting SIP 408 Request Timeout Errors Across Carrier Peering Links

Problem

Outbound SIP INVITE requests sent across carrier peering interconnects fail with 'SIP 408 Request Timeout'. The local Session Border Controller (SBC) repeatedly retransmits the INVITE without receiving a 100 Trying or 180 Ringing response from the carrier endpoint, resulting in call setup failures and high Post-Dial Delay (PDD).

Symptoms

• Outbound calls fail after 32 seconds of PDD with a local 408 Request Timeout.
• SIP trace shows 7-11 INVITE retransmissions sent to the carrier IP without any response.
• Calls to specific NPA-NXX destinations fail while others on the same trunk succeed.
• Intermittent call failure during peak hours when SIP packet sizes exceed MTU thresholds.

Root cause

The carrier gateway is silently dropping INVITE packets due to an upstream firewall/ACL restriction, asymmetric network routing, or packet dropping caused by IP fragmentation when SDP size exceeds the link MTU over UDP.

Resolution steps

1. step #1

   Capture live SIP signaling traffic on the egress WAN interface filtered by the upstream carrier IP address to observe retransmissions.

   tcpdump -nn -s 0 -i eth0 host 192.0.2.50 and port 5060 -w sip_408_debug.pcap

2. step #2

   Analyze the packet trace using tshark to verify if the server is receiving any Layer 4 responses or if transaction timers are expiring.

   tshark -r sip_408_debug.pcap -Y "sip.CSeq.method == INVITE" -T fields -e frame.time_relative -e ip.src -e ip.dst -e sip.Status-Code -e sip.CSeq

3. step #3

   Check for IP fragmentation by sending oversized ICMP packets with the Don't Fragment (DF) flag set to the carrier peering IP.

   ping -M do -s 1472 192.0.2.50

4. step #4

   If UDP fragmentation is detected or suspected, force switching the transport protocol to TCP for the carrier destination in the Kamailio routing script.

   # Kamailio cfg snippet
   route[CARRIER_OUTBOUND] {
       $du = "sip:192.0.2.50:5060;transport=tcp";
       t_relay();
   }

5. step #5

   Verify local kernel network routing and source IP selection to confirm traffic is leaving the correct public-facing interface.

   ip route get 192.0.2.50

6. step #6

   Inspect active firewall connection tracking state tables to ensure outbound UDP states are not being cleared prematurely by short state timeouts.

   conntrack -L -p udp --dport 5060

7. step #7

   Adjust Kamailio transaction module (tm) timers to reduce Post-Dial Delay (PDD) before failover if the primary carrier path is non-responsive.

   # Lower final response timer (fr_timer) to 4 seconds for fast failover
   modparam("tm", "fr_timer", 4000)
   modparam("tm", "fr_inv_timer", 30000)

Verification evidence

A Wireshark/tshark capture on the WAN interface shows outbound INVITE packets with 'Fragmented IP protocol' headers where retransmissions occur at exponential backoff intervals (T1=500ms, T2=4000ms), followed by Kamailio's tm module generating an internal '408 Request Timeout' to the core network.