Applied fix on docker-2.supportedsystems.com to resolve production ACK drops.
### Root Cause:
UDP conntrack timeout (30s) expires BEFORE SIP Timer H (32s):
- Asterisk retransmits 200 OK at exponential backoff (t+0.5, 1, 2, 4, 8, 16, 32s)
- Twilio re-sends ACK for each retransmission
- Conntrack sees ACK retransmissions as "same packet, not new traffic"
- At t+30s, conntrack expires the flow
- At t+32s, Asterisk's final 200 OK triggers ACK from Twilio
- Kernel drops ACK (no conntrack entry) → Timer H fires → call dies at 64s
### The Fix Applied:
```bash
sudo sysctl -w net.netfilter.nf_conntrack_udp_timeout=120
echo "net.netfilter.nf_conntrack_udp_timeout = 120" | \
sudo tee /etc/sysctl.d/99-sip-conntrack.conf
```
**Before:** 30s (expires before Timer H)
**After:** 120s (88s headroom beyond Timer H)
### Impact:
- Production fix: ACKs should now reach asterpbx on UDP path
- No TCP switch needed (though TCP remains valid alternative)
- Affects ALL UDP SIP traffic on docker-2 (positive side effect)
### Agent Thread:
- 007-root-cause-found-conntrack-timeout.md documents full diagnosis
- Includes timing tables showing conntrack lifecycle vs SIP timers
- Recommends testing UDP before switching to TCP
This completes the cross-layer debugging:
1. sip-guardian: ACK fast-path (architectural fix)
2. docker-2: conntrack timeout (production blocker - FIXED)
See: docs/agent-threads/ack-loss-from-twilio-trunk/007-*
Ryan Malloy
22f86fa867