[aprssig] Bursts of old packets on APRS-IS (AVRT7 bug)

[Heikki Hannikainen]

FYI to people staring at APRS packet logs:

If you see bursts of really old packets appearing repeatedly on APRS-IS 
these days, sometimes with a valid beacon packed with a TOCALL of APVRT7 
appended to the end, it might be due to this bug.

The SainSonic AVRT7, a chinese igate appliance, is having some sort of 
memory/buffer management issues, and may go into a mode where it starts 
sending out some old packets which it has received earlier from the 
APRS-IS. Some packets which were originally sent a long time ago by some 
completely different station. The packets may be perfectly valid or 
somewhat corrupted. They go out at the time when the AVRT7 is trying to 
send out its own beacon.

We did a packet capture of the connection from the offending igate to a 
server. Here's wireshark's rendering of the data flowing to/from the 
client. Red stuff is data coming from the avrt7 igate (KF6FPU-15), blue 
stuff is sent by aprsc (keepalives every 20 seconds):

http://he.fi/misc/kf6fpu-15-avrt7-corrupted-input-cn.png

You can clearly see the correct packets, and then some incomplete packets, 
and full packet fron KQ6DI-1, and then a concatenated one. Needless to 
say, KQ6DI was a bit annoyed by this: he was sending something completely 
different, with a different software, at this time.

The operator of that bugging AVRT7 igate rebooted the device (I asked him 
to), and it stopped sending out the old packets. But I wouldn't be 
surprised if it, or one of the many others out there, would do the same 
with some other callsigns and data later on.

BG6QBV, the author of AVRT7, also replied to my email / bug report and 
promised to find the problem right away.

This seems to be quite rare (I couldn't find any other examples yet in my 
logs, but it may be hard to notice unless some of the packets are 
corrupted). Please let me know if you see it happening somewhere else.

  - Hessu, OH7LZB/AF5QT