That would be a CNG frame (AST_FRAME_CNG). While a frame exists to convey CNG to capable channel drivers, CNG itself is not implemented or handled in chan_sip (or most of Asterisk).

There’s a lot of intervening points between sip_write and whatever generated the CNG frame. Most likely, res_rtp_asterisk is generating this due to receiving a CN RTP packet. On the receiving channel, that will normally just generate a single NOTICE message for that RTP session and be done. It’s possible that in your Asterisk 11 deployment, your channels were natively bridged, which would result in the RTP packet containing the CN
indication being directly written out to the bridged party. Depending on the configuration you are using in your Asterisk 13 deployment, your channels may no longer be natively bridged, at which point the CNG frame is created and passed up to the core. If that is the case, then I would expect to see that WARNING message in either version of Asterisk.

Yup.

Check how the channels are bridged. If they are natively bridged in 11 but not in 13, and native bridging is an option, you may want to determine why the channels are not natively bridging in 13.

Not at all. CN handling was not changed between 11/13.

Matt