Troubleshooting SIP with Cisco Unified Communications

(1)

(2)

Troubleshooting SIP with Cisco Unified

Communications

BRKUCC-2932

Paul Giralt

Distinguished Services Engineer

pgiralt@cisco.com

(3)

Agenda



Introduction



Session Initiation Protocol (SIP) Overview



Troubleshooting Tools



Unified CM Tracing



Cisco Unified Border Element (CUBE) Tracing

(4)

(5)

What is SIP?



Signaling protocol used to establish, manage, and terminate sessions

over an IP network



Core protocol defined in RFC 3261



Extended in many, many other RFCs



ASCII-based messages

(6)

What is SIP?



User Agents



SIP Messages

–

Requests and Responses

–

Headers



Media Negotiation

–

Session Description Protocol

–

Offer/Answer Model

–

Early Offer vs. Delayed Offer

–

Early Media

(7)

User Agents



User Agent Clients (UAC) send requests to User Agent Servers (UAS)



User Agent Servers send responses to the requests



Most SIP devices are both a UAC and a UAS (they both initiate and accept

requests)



Unified CM and CUBE are both Back-to-Back User Agents (B2BUA) (as

(8)

SIP Request Methods from RFC 3261



INVITE

- A user or service is being invited to participate in a multimedia

session



ACK

- Confirms that a client has received a final response to an INVITE

request



BYE

- Terminates an existing session; can be sent by any user agent (in a

multiparty session)



CANCEL

- Cancels pending requests; does not terminate sessions that

have been accepted



OPTIONS

- Queries the capabilities of servers (Also used as a keep alive)

(9)

Additional SIP Request Methods



INFO

(RFC 2976) - to send more information within an established dialog



PRACK

(RFC 3262) - to acknowledge a provisional response



SUBSCRIBE

(RFC 3265) - to tell a remote node to look for a certain event



NOTIFY

(RFC 3265) - to respond when that certain event occurs



UPDATE

(RFC 3311) - to update parameters of a session set-up



MESSAGE

(RFC 3428) - SIP instant messaging



REFER

(RFC 3515) – to “refer” one UA to communicate with another UA



PUBLISH

(RFC 3903) - to push UA state information to a compositor/presence

(10)

SIP INVITE Method

INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665

From: "Test User 1" <sip:9195551111@172.18.106.59>;tag=97903bc0-43adcd-45510543

To: <sip:+18775551234@172.18.159.231>

Call-ID: 7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59

Supported: timer,resource-priority,replaces

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER

CSeq: 101 INVITE

Expires: 180

Allow-Events: presence, kpml

Supported: X-cisco-srtp-fallback

Supported: Geolocation

Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"

Cisco-Guid: 2081204224-3137452793-0000000466-0996807340

Session-Expires: 1800

P-Asserted-Identity: "Test User 1" <sip:9195551111@172.18.106.59>

Contact: <sip:9195551111@172.18.106.59:5060>;video;audio

Max-Forwards: 69

Content-Length: 864

(11)

SIP Request Line

INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665

From: "Test User 1" <sip:9195551111@172.18.106.59>;tag=97903bc0-43adcd-45510543

To: <sip:+18775551234@172.18.159.231>

Call-ID: 7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59

Supported: timer,resource-priority,replaces

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER

CSeq: 101 INVITE

Expires: 180

Allow-Events: presence, kpml

Supported: X-cisco-srtp-fallback

Supported: Geolocation

Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"

Cisco-Guid: 2081204224-3137452793-0000000466-0996807340

Session-Expires: 1800

P-Asserted-Identity: "Test User 1" <sip:9195551111@172.18.106.59>

Contact: <sip:9195551111@172.18.106.59:5060>;video;audio

Max-Forwards: 69

Content-Length: 864

Content-Type: application/sdp

SIP Method

(12)

SIP Headers

INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0

Via:

SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665

From:

"Test User 1" <sip:9195551111@172.18.106.59>;tag=97903bc0-43adcd-45510543

To:

<sip:+18775551234@172.18.159.231>

Call-ID:

7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59

Supported:

timer,resource-priority,replaces

User-Agent:

Cisco-CUCM8.6

Allow:

INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER

CSeq:

101 INVITE

Expires:

180 Allow-Events:

presence, kpml

Supported:

X-cisco-srtp-fallback

Supported:

Geolocation

Call-Info:

<sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"

Cisco-Guid:

2081204224-3137452793-0000000466-0996807340

Session-Expires:

1800

P-Asserted-Identity:

"Test User 1" <sip:9195551111@172.18.106.59>

Contact:

<sip:9195551111@172.18.106.59:5060>;video;audio

Max-Forwards:

69 Content-Length:

864

(13)

SIP Response

SIP/2.0 404 Not Found

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210123ca7-45568313

To: <sip:+19195551212@10.81.2.30>;tag=253488-726

Date: Mon, 16 Jan 2012 04:00:22 GMT

Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59

CSeq: 101 INVITE

Allow-Events: telephone-event

Server: Cisco-SIPGateway/IOS-15.2.2.T

Reason: Q.850;cause=1

Content-Length: 0

(14)

SIP Response

SIP/2.0 404 Not Found

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210123ca7-45568313

To: <sip:+19195551212@10.81.2.30>;tag=253488-726

Date: Mon, 16 Jan 2012 04:00:22 GMT

Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59

CSeq: 101 INVITE

Allow-Events: telephone-event

Server: Cisco-SIPGateway/IOS-15.2.2.T

Reason: Q.850;cause=1

Content-Length: 0

Response Code

Free-text Reason

(15)

SIP Response

SIP/2.0 404 Not Found

Via

: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4

From

: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210123ca7-45568313

To

: <sip:+19195551212@10.81.2.30>;

tag=253488-726

Date

: Mon, 16 Jan 2012 04:00:22 GMT

Call-ID

: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59

CSeq

: 101 INVITE

Allow-Events

: telephone-event

Server

: Cisco-SIPGateway/IOS-15.2.2.T

Reason

: Q.850;cause=1

Content-Length

: 0

(16)

SIP Responses

Response Code

Description

Example

1xx

Informational – Request Received and Continuing to Process

Request

100 Trying

180 Ringing

183 Session Progress

2xx

Success – Action was successfully received, understood, and

accepted

200 OK

202 Acceptable

3xx

Redirection – Another SIP Element needs to be contacted in order

to complete the request

300 Multiple Choices

301 Moved Permanently

302 Moved Temporarily

4xx

Client Error – Request contains bad syntax or cannot be fulfilled at

this server

401 Unauthorized

404 Not Found

406 Not Acceptable

486 Busy Here

488 Not Acceptable Here

5xx

Server Error – Server failed to fulfill an apparently valid request

503 Service Unavailable

6xx

Global Failure – Request is invalid at any server

600 Busy Everywhere

(17)

INVITE

200 OK

Session Established

Phone 1

Unified CM

Basic SIP Call Setup

ACK

BYE

200 OK

(18)

INVITE

200 OK

Session Established

Phone 1

Unified CM

Basic SIP Call Setup with B2BUA (Unified CM)

ACK

BYE

200 OK

Phone 2

INVITE

200 OK

ACK

BYE

200 OK

CUBE

SBC (CUBE)

(19)

INVITE

200 OK

Phone 1

Basic SIP Call Setup with Unified CM and CUBE

ACK

BYE

200 OK

Unified CM

CUBE

SBC (CUBE)

INVITE

200 OK

ACK

BYE

200 OK

INVITE

200 OK

ACK

BYE

200 OK

SIP

SP

SBC

SP SBC

Session Established

(20)

Media Negotiation



SIP leverages the Session Description Protocol (SDP)

(RFC 4566/3266/2327) to communicate media information.



SIP uses the offer/answer model described in RFC 3264 to negotiate media

(21)

Offer/Answer Model (RFC 3264)



One endpoint sends an offer SDP containing all the capabilities the endpoint

wishes to negotiate.



SDP contains m lines for each media stream being negotiated (i.e. audio,

video, content channel, etc…)



Receiving endpoint sends an answer SDP that contains the same or a subset

of capabilities received in the offer.



Per RFC 3264, “For each "m=" line in the offer, there MUST be a

corresponding "m=“ line in the answer. The answer MUST contain exactly the

same number of "m=" lines as the offer.”

(22)

Session Description Protocol (SDP) - Offer

v=0

o=Cisco-SIPUA 26964 0 IN IP4 172.18.159.152

s=SIP Call

t=0 0

m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101

c=IN IP4 172.18.159.152

a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

a=rtpmap:0 PCMU/8000

a=rtpmap:8 PCMA/8000

a=rtpmap:18 G729/8000

a=fmtp:18 annexb=no

a=rtpmap:102 L16/16000

a=rtpmap:9 G722/8000

a=rtpmap:116 iLBC/8000

a=fmtp:116 mode=20

a=rtpmap:124 ISAC/16000

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

a=sendrecv

m=video 25466 RTP/AVP 97

c=IN IP4 172.18.159.152

b=TIAS:1000000

a=rtpmap:97 H264/90000

a=fmtp:97 profile-level-id=42801E

a=recvonly

(23)

Session Description Protocol (SDP) - Answer

v=0

o=CiscoSystemsCCM-SIP 2000 1 IN IP4 172.18.106.59

s=SIP Call

c=IN IP4 172.18.159.152

t=0 0

m=audio 30308 RTP/AVP 0 101

a=rtpmap:0 PCMU/8000

a=ptime:20

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

m=video 0 RTP/AVP 97

(24)

Media Negotiation – Early Offer and Delayed Offer



Initiator of the call can send SDP offer in the INVITE – this is called an Early

Offer (EO)



Receiving endpoint can send the SDP offer in a response if the INVITE did not

contain an offer – this is called a Delayed Offer (DO)



For Early Offer, the answer is sent in a response (usually 200 OK).

(25)

INVITE with SDP -

Offer

200 OK with SDP -

Answer

Session Established

Phone 1

Unified CM

Early Offer

ACK (no SDP)

BYE

200 OK

(26)

INVITE (no SDP)

200 OK with SDP -

Offer

Session Established

Phone 1

Unified CM

Delayed Offer

ACK with SDP -

Answer

BYE

200 OK

(27)

Early Media



Delayed Offer calls do not set up media until the 200 OK (call is answered)



If media is required prior to the call being connected, SIP has provisions for

Early Media



With Early Media on a Delayed Offer call, the offer comes from the terminating

side in a provisional response (e.g. 183 Session Progress)



Originating side sends SDP Answer in a PRACK message (defined in RFC

(28)

INVITE (no SDP)

200 OK (INVITE) w/ SDP (should be same as answer)

Session Established

Phone 1

Unified CM

Early Media

ACK

BYE

200 OK

183 Session Progress with SDP -

Offer

PRACK with SDP -

Answer

Media Stream Established

200 OK (PRACK)

(29)

Media Re-negotiation

Re-INVITE



Either UA involved in a call can re-INVITE an existing dialog to re-negotiate

parameters for the call.



Cannot re-INVITE until any previous INVITE messages have received a final

response.

(30)

Media Re-negotiation

Re-INVITE

INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901f9c72c19221

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776

To:

<sip:89915644@172.18.106.59>;

tag=

0022bdd6843100702aae8e5b-4be253be

Date: Wed, 11 Jan 2012 03:08:51 GMT

Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59

Supported: timer,resource-priority,replaces

Min-SE: 1800

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY

CSeq: 104 INVITE

Max-Forwards: 70

Expires: 180

Allow-Events: presence

Call-Info: <urn:x-cisco-remotecc:callinfo>; security= Authenticated; orientation= from; gci= 2-231448; call-instance= 2

Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=calling;screen=yes;privacy=off

Contact: <sip:89915644@172.18.106.59:5061;transport=tls>

Content-Type: application/sdp

(31)

Media Re-negotiation

Re-INVITE – Stopping a Media Session

v=0

o=CiscoSystemsCCM-SIP 15462272 2 IN IP4 172.18.106.59

s=SIP Call

c=IN IP4 0.0.0.0

t=0 0

m=audio 19594 RTP/SAVP 9 101

a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

a=rtpmap:9 G722/8000

a=ptime:20

a=inactive

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

m=video 19444 RTP/AVP 126

b=TIAS:1000000

a=rtpmap:126 H264/90000

a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1

a=inactive

a=mid:227796888

(32)

Media Re-negotiation

Re-INVITE – Delayed Offer to Re-establish Media Stream

INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776

To: <sip:89915644@172.18.106.59>;tag=0022bdd6843100702aae8e5b-4be253be

Date: Wed, 11 Jan 2012 03:08:52 GMT

Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59

Supported: timer,resource-priority,replaces

Min-SE: 1800

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY

CSeq: 106 INVITE

Max-Forwards: 70

Expires: 180

Allow-Events: presence

Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= from; gci= 2-231448; call-instance= 2

Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=calling;screen=yes;privacy=off

Contact: <sip:89915644@172.18.106.59:5061;transport=tls>

Content-Length: 0

(33)

Media Re-negotiation

Re-INVITE – Offer in 200 OK

SIP/2.0 200 OK

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776

To: <sip:89915644@172.18.106.59>;tag=0022bdd6843100702aae8e5b-4be253be

Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59

Date: Wed, 11 Jan 2012 03:08:52 GMT

CSeq: 106 INVITE

Server: Cisco-CPCIUS/9.2.1

Contact: <sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls>

Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO

Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=called;id-type=subscriber;privacy=off;screen=yes

Supported:

replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.2.0,X-cisco-xsi-8.5.1

Allow-Events: kpml,dialog

Recv-Info: conference

Recv-Info: x-cisco-conference

Content-Length: 788

Content-Type: application/sdp

Content-Disposition: session;handling=optional

(34)

Media Re-negotiation

Re-INVITE – Offer in 200 OK

v=0

o=Cisco-SIPUA 26259 2 IN IP4 10.116.101.41

s=SIP Call

t=0 0

m=audio 32518 RTP/SAVP 0 8 18 102 9 116 124 101

c=IN IP4 10.116.101.41

a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

a=rtpmap:0 PCMU/8000

a=rtpmap:8 PCMA/8000

a=rtpmap:18 G729/8000

a=rtpmap:102 L16/16000

a=rtpmap:9 G722/8000

a=rtpmap:116 iLBC/8000

a=rtpmap:124 ISAC/16000

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

a=sendrecv

m=video 17614 RTP/AVP 126 97

c=IN IP4 10.116.101.41

b=TIAS:2500000

a=rtpmap:126 H264/90000

a=fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1

a=rtpmap:97 H264/90000

a=fmtp:97 profile-level-id=42801F;packetization-mode=0;level-asymmetry-allowed=1

a=sendrecv

(35)

Media Re-negotiation

Re-INVITE – Answer in ACK

ACK sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fb064465a06

From: "Paul Giralt"

<sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776

To: <sip:89915644@172.18.106.59>;tag=0022bdd6843100702aae8e5b-4be253be

Date: Wed, 11 Jan 2012 03:08:52 GMT

Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59

Max-Forwards: 70

CSeq: 106 ACK

Allow-Events: presence

Content-Type: application/sdp

Content-Length: 446

(36)

Media Re-negotiation

Re-INVITE – Answer in ACK – Decline Video Support

v=0

o=CiscoSystemsCCM-SIP 15462272 3 IN IP4 172.18.106.59

s=SIP Call

t=0 0

m=audio 4000 RTP/SAVP 0

c=IN IP4 172.18.106.58

a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

a=rtpmap:0 PCMU/8000

a=ptime:20

a=sendonly

m=video

0 RTP/AVP 126

c=IN IP4 10.116.101.50

b=TIAS:1000000

a=rtpmap:126 H264/90000

a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1

a=mid:227796888

(37)

DTMF Relay



3 Methods for passing DTMF digits over a SIP network:

–

RFC 2833

–

SIP NOTIFY

(38)

DTMF Relay

RFC 2833



Digits are passed in the RTP stream with a unique payload type



Capability is negotiated in SDP like any other codec

m=audio 30414 RTP/AVP 0 8 116 18 100

101 c=IN IP4 172.18.106.231

a=rtpmap:0 PCMU/8000

a=rtpmap:8 PCMA/8000

a=rtpmap:116 iLBC/8000

a=fmtp:116 mode=20

a=rtpmap:18 G729/8000

a=fmtp:18 annexb=no

a=rtpmap:100 X-NSE/800

a=fmtp:100 192-194

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-16

m=audio 17236 RTP/AVP 0

101 a=rtpmap:0 PCMU/8000

a=ptime:20

a=rtpmap:101 telephone-event/8000

a=fmtp:101 0-15

Offer

Answer

(39)

DTMF Relay

SIP NOTIFY



Passes DTMF information in a SIP NOTIFY message telephone-event Event



Negotiated in Call-Info header

INVITE sip:+19195553333@172.18.106.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434

From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14902469~0d0d25d7-4931-4a07-83c6

To: <sip:+19195553333@172.18.106.231>

Date: Mon, 13 May 2013 14:48:00 GMT

Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59

... snip ...

Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"

Call-Info: <urn:x-cisco-remotecc:callinfo>;x-cisco-video-traffic-class=DESKTOP

... snip ...

Max-Forwards: 69

Content-Length: 0

Offer

(40)

DTMF Relay

SIP NOTIFY

SIP/2.0 200 OK

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434

From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14902469~0d0d25d7-4931-4a07-83c6

To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC

Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59

... snip ...

Allow-Events: telephone-event

Call-Info: <sip:172.18.106.231:5060>;method="NOTIFY;Event=telephone-event;Duration=500”

... snip ...

Content-Length: 601

Answer

(41)

DTMF Relay

SIP NOTIFY



Digits passed in payload of a NOTIFY message

NOTIFY sip:172.18.106.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK98443140152a0a

From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14902469~0d0d25d7-4931-4a07-83c6

To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC

Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59

CSeq: 104 NOTIFY

Max-Forwards: 70

Date: Mon, 13 May 2013 14:48:11 GMT

User-Agent: Cisco-CUCM10.0

Event: telephone-event

Subscription-State: active

Contact: <sip:172.18.106.59:5060>

P-Asserted-Identity: "Paul Giralt" <sip:9195551234@172.18.106.59>

Content-Type: audio/telephone-event

Content-Length: 4

(42)

DTMF Relay

SIP KPML



Passes DTMF information in a SIP NOTIFY message kpml Event



Capability advertised in Allow-Events – uses SUBSCRIBE message to subscribe

INVITE sip:+19195554444@172.18.106.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4

From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6

To: <sip:+19195554444@172.18.106.231>

Date: Mon, 13 May 2013 15:05:24 GMT

Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59

User-Agent: Cisco-CUCM10.0

... snip ...

Allow-Events: presence, kpml

... snip ...

Session-Expires: 18000

Max-Forwards: 69

Content-Length: 0

Offer

(43)

DTMF Relay

SIP KPML

SIP/2.0 200 OK

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4

From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6

To: <sip:+19195554444@172.18.106.231>;tag=437394E8-2E1

Date: Mon, 13 May 2013 15:05:26 GMT

Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59

CSeq: 101 INVITE

Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO

Allow-Events: kpml

, telephone-event

Remote-Party-ID: <sip:9196247285@172.18.106.231>;party=called;screen=no;privacy=off

Contact: <sip:+19196247285@172.18.106.231:5060>

Supported: replaces

Server: Cisco-SIPGateway/IOS-15.2.4.M3

Require: timer

Session-Expires: 18000;refresher=uac

Content-Type: multipart/mixed;boundary=uniqueBoundary

Mime-Version: 1.0

Content-Length: 600

Answer

(44)

DTMF Relay

SIP KPML

SUBSCRIBE

sip:9195554444@172.18.106.59:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.231:5060;branch=z9hG4bKBAE27139E

From: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1

To: "Paul Giralt" <sip:9195554444@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6

Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59

CSeq: 101 SUBSCRIBE

Max-Forwards: 70

User-Agent: Cisco-SIPGateway/IOS-15.2.4.M3

Event: kpml

Expires: 7200

Contact: <sip:172.18.106.231:5060>

Content-Type: application/kpml-request+xml

Content-Length: 327

<?xml version="1.0" encoding="UTF-8"?><

kpml-request

xmlns="urn:ietf:params:xml:ns:kpml-request"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request kpml-xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request.xsd" version="1.0"><pattern persist="persist">

<regex

tag="dtmf">[x*#ABCD]</regex>

</pattern></kpml-request>

(45)

DTMF Relay

SIP KPML

NOTIFY sip:172.18.106.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986f73662cca3b

From: "Paul Giralt" <sip:9195554444@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6

To: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1

Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59

CSeq: 104 NOTIFY

Max-Forwards: 70

User-Agent: Cisco-CUCM10.0

Event: kpml

Subscription-State: active;expires=7197

Contact: <sip:9195554444@172.18.106.59:5060>

Content-Type: application/kpml-response+xml

Content-Length: 336

<?xml version="1.0" encoding="UTF-8" ?>

<

kpml-response

xmlns="urn:ietf:params:xml:ns:kpml-response"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-response kpml-response.xsd" code="200"

digits="1"

forced_flush="false" suppressed="false" tag="dtmf" text="Success" version="1.0"/>

(46)

(47)

SIP Troubleshooting Tools



Unified CM / SME Tools:

–

Real Time Monitoring Tool / Session Trace

–

TranslatorX

(48)

RTMT Session Trace Tool

Session Trace Features



Allows you to search for a call based on calling or called number



Does not depend on Call Detail Records



Session trace only traces SIP sessions in detail



Can display raw SIP messages



Uses correlation tags to include all call legs related to the call selected



On versions 8.5 and 8.6, can only be used on calls for which traces still exist

on the server. Unified CM 9.0 allows viewing traces that have been archived

off-server.

(49)

(50)

RTMT Session Trace Tool

(51)

RTMT Session Trace Tool

(52)

TranslatorX Tool

Features



Parses through Unified CM CCM/SDI Trace Files (SDL in 9.0+)



Drag-and-Drop support for .txt as well as .gz files.



Latest version supports IOS CUBE ccsip debugs



Decodes SIP, SCCP, H.323, MGCP, Q.Sig, and ISDN Q.931 messages



Call List based on CDR information in the Traces



Can generate multi-protocol ladder diagrams



Sophisticated filtering capabilities



Download for Windows, Mac OS X, and Linux from:

http://translatorx.cisco.com/



NOTE: Do not call TAC for support on TranslatorX (although many TAC engineers use it so

feel free to mention you’re using it)

(53)

(54)

TranslatorX Tool

(55)

TranslatorX Tool

Call List Filtering

Double-click for complete

Call Detail Record

(56)

TranslatorX Tool

(57)

TranslatorX Tool

(58)

TranslatorX Tool

Call List Filtering

Select a Call and click

“Generate Filter” button

(59)

TranslatorX Tool

(60)

(61)

(62)

Wireshark



Open Source network packet capture and analysis tool



Available at

http://www.wireshark.org



Available for Windows, Mac OS X, and UNIX/Linux

(63)

(64)

Wireshark

(65)

Wireshark

(66)

Wireshark

How to Gather a Trace?



Both Unified CM and IOS provide a mechanism to gather a packet capture

(67)

(68)

Unified CM Trace Configuration



SIP messaging in Unified CM is written to the CCM/SDI trace file when

appropriate trace levels are set (SDL trace in 9.0+)



Configured from

Cisco Unified Serviceability

>

Trace

>

Configuration

or by

using AnalysisManager



Unified CM 9.0 combines SDI and SDL traces into the SDL traces



Unified CM 9.0 and later default to detailed tracing – no need to configure

(69)

Unified CM Trace Configuration

Select the

Server

Select the Service on

Which Trace Needs to

Be Enabled

Select Service

Group

(70)

Unified CM Trace Configuration

1. Press

Set Default

2. Set to

Detailed

Updates All

Servers in This

Cluster with

These Settings

(71)

Unified CM Trace Configuration

Enable SIP Stack Trace is NOT needed to see SIP Messages.

Do not enable SIP Stack Trace prior to 9.0 unless directed by TAC

(72)

Unified CM Trace Configuration



Can Also Use the

Troubleshooting Trace Settings

Page in

(73)

Trace Collection

Various Ways to Collect Trace Files



RTMT Analysis Manager



RTMT Remote Browse



RTMT Collect Files



RTMT Query Wizard



OS CLI (

file get

or

file tail

)

(74)

Gathering a Packet Capture from Unified CM



Use the Platform CLI command ‘utils network capture’

admin:utils network capture ? Syntax:

utils network capture [options]

options optional page, numeric, file fname, count num, size bytes, src addr, dest addr, port num, host protocol addr

admin:utils network capture file capturefile count 100000 size ALL host ip 10.1.1.1 Executing command with options:

size=ALL count=100000 interface=eth0 src= dest= port= ip=10.1.1.1

admin:file list activelog platform/cli capturefile.cap dir count = 0, file count = 1

admin:file get activelog platform/cli/capturefile.cap Please wait while the system is gathering files info ...done. Sub-directories were not traversed.

Number of files affected: 1 Total size in Bytes: 24

Total size in Kbytes: 0.0234375 Would you like to proceed [y/n]? y

(75)

Cisco Unified Border Element (CUBE) Tracing

Configuration

(76)

CUBE Debugging



CUBE / IOS Tools:

–

IOS debugs

–

IOS show commands

–

Per-call trace

(77)

CUBE Debugging



When debugging in IOS, configure logging buffered to a fairly large value

(based on available memory)



Disable logging to the console with command ‘no logging console’



Enable timestamps for debugs



Make sure router has NTP enabled

service timestamps debug datetime msec localtime

service timestamps log datetime msec localtime

logging buffered 10000000

no logging console

clock timezone EST -5 0

clock summer-time EDT recurring

ntp server 10.14.1.1

(78)

CUBE Debugging



Various SIP debugs available:

CUBE#

debug ccsip ?

all Enable all SIP debugging traces

calls Enable CCSIP SPI calls debugging trace

dhcp Enable SIP-DHCP debugging trace

error Enable SIP error debugging trace

events Enable SIP events debugging trace

function Enable SIP function debugging trace

info Enable SIP info debugging trace

media Enable SIP media debugging trace

messages Enable CCSIP SPI messages debugging trace

preauth Enable SIP preauth debugging traces

states Enable CCSIP SPI states debugging trace

translate Enable SIP translation debugging trace

transport Enable SIP transport debugging traces

verbose Enable verbose mode

(79)

CUBE Debugging

Sample ‘debug ccsip messages’

Jan 12 03:14:43.102: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg: Received:

INVITE sip:+19193922900@10.14.1.10:5060 SIP/2.0

Via: SIP/2.0/TCP 172.18.106.59:5060;branch=z9hG4bK978d2e8df73dc

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=16218435~-b82e2c213ca7-45552048 To: <sip:+19193922900@10.14.1.10>

Date: Thu, 12 Jan 2012 03:09:42 GMT

Call-ID: ddc4e480-f0e14ef6-94ca5c-3b6a12ac@172.18.106.59 Supported: 100rel,timer,resource-priority,replaces

Min-SE: 1800

User-Agent: Cisco-CUCM8.6

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY CSeq: 101 INVITE Expires: 180 Allow-Events: presence, kpml Supported: X-cisco-srtp-fallback Supported: Geolocation Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500" Cisco-Guid: 3720668288-0000065536-0000015564-0996807340 Session-Expires: 1800

P-Asserted-Identity: "Paul Giralt" <sip:89915644@172.18.106.59>

Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=calling;screen=yes;privacy=off Contact: <sip:89915644@172.18.106.59:5060;transport=tcp>;video;audio

Max-Forwards: 69 Content-Length: 0

(80)

CUBE Debugging



Other generic voice debugs can be useful as well:

–

debug voice ccapi inout

–

debug voice dialpeer

–

debug voice rtp session dtmf-relay

(81)

Cisco Unified Border Element Basic Call Flow

1. Incoming VoIP setup message from originating endpoint

2. This matches inbound VoIP dial peer 1 for characteristics such as codec, VAD, DTMF

method, protocol, etc.

3. Match the called number to outbound VoIP dial peer 2

4. Outgoing VoIP setup message

Incoming VoIP Call

Outgoing VoIP Call

dial-peer voice 1 voip destination-pattern 1000 incoming called-number .T session protocol sipv2

session target ipv4:192.168.10.50 dtmf-relay rtp-nte sip-kpml codec g711ulaw

dial-peer voice 2 voip destination-pattern 2000 session protocol sipv2

session target ipv4:192.168.12.25 dtmf-relay rtp-nte codec g711ulaw

Originating

Endpoint

Terminating

Endpoint

CUBE

voice service voip

(82)

CUBE

show

Commands



show call active voice [brief]

shows state of currently active calls

0 : 2807 92135710ms.1 (23:55:20.115 EST Mon Jan 16 2012) +1770 pid:1 Answer 89915644 active

dur 00:00:14 tx:743/14860 rx:718/14360 dscp:0 media:0 audio tos:0xB8 video tos:0x0

IP 10.116.101.41:23412 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g729r8 TextRelay: off media inactive detected:n media contrl rcvd:n/a timestamp:n/a

long duration call detected:n long duration call duration:n/a timestamp:n/a

0 : 2808 92135720ms.1 (23:55:20.125 EST Mon Jan 16 2012) +1750 pid:100 Originate 9193922900 active

dur 00:00:14 tx:718/14360 rx:755/15100 dscp:0 media:0 audio tos:0xB8 video tos:0x0

IP 172.30.206.164:10076 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g729r8 TextRelay: off media inactive detected:n media contrl rcvd:n/a timestamp:n/a

long duration call detected:n long duration call duration:n/a timestamp:n/a

Telephony call-legs: 0 SIP call-legs: 2 H323 call-legs: 0

Call agent controlled call-legs: 0 SCCP call-legs: 0

Multicast call-legs: 0 Total call-legs: 2

(83)

CUBE Per-Call Debugging (PCD)



Useful for CUBE under high call volume



Available on all CUBE(Ent) ASR releases and in 15.1(2)T and later on ISR



All the debug pertaining to a particular call goes into a buffer



“Trigger-points” looks for specific info in the buffers to export the debug info to

an output destination



Can trigger based on user-defined criteria or log every call

–

SIP 4XX, 5XX, or 6XX Response

–

Q.850 Cause code

(84)

1. Define buffers and

buffer sizes

2. Turn per-call debugging

on/off

3. Set trigger

points

per-call num-buffer <num>

per-call buffer-size debug <num>

per-call shutdown

per-call active debug

per-call inactive

per-call trigger cause 1

per-call trigger cause 41

per-call trigger sip-message 404

per-call trigger sip-message 488

4. Export debug buffer

content

per-call export primary [flash | ftp | http | pram |

rcp | tftp] secondary [flash | ftp | http | pram | rcp |

tftp]

show per-call stat

show per-call buffer list

router#show per-call buffer content ?

<0-10000000> Specify the buffer num

router#show per-call buffer content 1

6. Show buffer contents on console

5. Show buffer content status

CUBE Per-Call Debugging (PCD)

PCD Configuration

(85)

CUBE – IP Traffic Capture

Export Packet Data in PCAP Format



IP Traffic Export feature allows export of packets on an interface



Configuration:



Usage:

ip traffic-export profile CUBE_Debug mode capture

bidirectional

incoming access-list 101

outgoing access-list 101

interface GigabitEthernet0/0

ip traffic-export apply CUBE_Debug size 10000000

traffic-export interface g0/0 start

traffic-export interface g0/0 stop

(86)

(87)

Case Study 1: Unable to place a call

Problem Description



A user reports that every time they call (919) 555-1212, they get a message that

(88)

Case Study 1: Unable to Place a Call

Use RTMT Session Trace



Enter *5551212 into Called Number/URI field



Set time and duration appropriately

(89)

Case Study 1: Unable to Place a Call

Use RTMT Session Trace



Double-click to see

message diagram



Clearly shows the

far-end sfar-ends back a 404

Not Found

(90)

Case Study 1: Unable to Place a Call

Troubleshoot Call on CUBE



Enable SIP message debugs –

debug ccsip messages

Jan 16 04:00:22.679: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg: Received:

INVITE sip:+19195551212@10.81.2.30:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4

From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210128~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45568313 To: <sip:+19195551212@10.81.2.30>

Date: Mon, 16 Jan 2012 03:55:17 GMT

Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59 Supported: timer,resource-priority,replaces

Min-SE: 1800

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY CSeq: 101 INVITE Expires: 180 Allow-Events: presence, kpml Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500" Cisco-Guid: 3852191232-0000065536-0000018595-0996807340 Session-Expires: 1800

P-Asserted-Identity: "Paul Giralt" <sip:89915644@172.18.106.59> Contact: <sip:89915644@172.18.106.59:5060>

Max-Forwards: 69 Content-Length: 0

(91)

Case Study 1: Unable to Place a Call

Troubleshoot Call on CUBE



Check to see if the number matches a valid dial peer

Jan 16 04:00:22.687: //98/E59BC6000000/SIP/Msg/ccsipDisplayMsg:

Sent:

SIP/2.0 404 Not Found

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4

From: "Paul Giralt"

<sip:89915644@172.18.106.59>;tag=19210128~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45568313

To: <sip:+19195551212@10.81.2.30>;tag=253488-726

Date: Mon, 16 Jan 2012 04:00:22 GMT

Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59

CSeq: 101 INVITE

Allow-Events: telephone-event

Server: Cisco-SIPGateway/IOS-15.2.2.T

Reason: Q.850;cause=1

Content-Length: 0

CUBE#

show dialplan number +19195551212

Macro Exp.: +19195551212

(92)

Case Study 2: Unable to Place a Call #2

Problem Description



A user reports that every time they call (919) 555-1212, they get reorder (fast

(93)

Case Study 2: Unable to Place a Call #2

Use RTMT Session Trace



Enter *5551212 into Called Number/URI field



Set time and duration appropriately

(94)

Case Study 2: Unable to Place a Call #2

Use RTMT Session Trace



Trace shows

signaling from phone

as well as to CUBE



CUBE is responding

(95)

Case Study 2: Unable to Place a Call #2

Problem Description



As of IOS 15.1(2)T, IOS will reject calls from unknown sources by default



Can either disable the feature or add the list of permitted addresses

voice service voip

no ip address trusted authenticate

allow-connections sip to sip

sip

voice service voip

ip address trusted list

ipv4 172.18.106.0 255.255.255.0

allow-connections sip to sip

sip

OR

(96)

Case Study 3: No One Answers the Phone

Problem Description



A user reports that every time they call a specific phone number, no one answers

the call, but if they call from their cell phone, the call is answered immediately

every time.



Calling phone is extension 89919236.

(97)

Case Study 3: No One Answers the Phone

Collect Traces

(98)

Case Study 3: No One Answers the Phone

Use TranslatorX



Problem is reproducible, so generate a test call and then collect traces. Select

File

>

Open Folder…

(99)

Case Study 3: No One Answers the Phone

Use TranslatorX to Analyze Traces

(100)

Case Study 3: No One Answers the Phone

Use TranslatorX to Analyze Traces



Disable Filters



Select the INVITE

(101)

Case Study 3: No One Answers the Phone

Use TranslatorX to Analyze Traces

03/29/2010 10:36:41.497 |//SIP/SIPUdp/wait_SdlSPISignal: Outgoing SIP UDP message to 172.18.159.231:[5060]:

INVITE sip:+18772888362@172.18.159.231:5060 SIP/2.0

Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665

From: "Test User 1" <sip:9194769236@172.18.106.59>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510543

To: <sip:+18772888362@172.18.159.231>

Date: Mon, 29 Mar 2010 14:36:41 GMT

Call-ID: 7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59

Supported: timer,resource-priority,replaces Min-SE: 1800

Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY CSeq: 101 INVITE Expires: 180 Allow-Events: presence, kpml Supported: X-cisco-srtp-fallback Supported: Geolocation Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500" Cisco-Guid: 2081204224-3137452793-0000000466-0996807340 Session-Expires: 1800

P-Asserted-Identity: "Test User 1" <sip:9194769236@172.18.106.59> Contact: <sip:9194769236@172.18.106.59:5060>;video;audio Max-Forwards: 69

(102)

Case Study 3: No One Answers the Phone

Use TranslatorX to Analyze Traces

(103)

Case Study 3: No One Answers the Phone

Use TranslatorX to Analyze Traces



Select the INVITE



Create New Filter (control/command-N)



Filter by IP Address (control/command – I)

(104)

Case Study 3: No One Answers the Phone

(105)

Case Study 3: No One Answers the Phone

INVITE from IP Phone w/ SDP

03/29/2010 10:36:33.771 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321

with 1717 bytes:

INVITE sip:9@172.18.106.59;user=phone SIP/2.0

Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1636ab61

From: "Test User 1" <sip:89919236@172.18.106.59>

;tag=00260bd9669e07147bcb3aac-3cda8f0c

To: <sip:9@172.18.106.59;user=phone>

Call-ID: 00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152

Max-Forwards: 70

Date: Mon, 29 Mar 2010 14:36:33 GMT

CSeq: 101 INVITE

User-Agent: Cisco-CP9951/9.0.1

Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=tls>

Expires: 180

Accept: application/sdp

Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO

Remote-Party-ID: "Test User 1" <sip:89919236@172.18.106.59>;party=calling;id-type=subscriber;privacy=off;screen=yes

Supported:

replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.0.0,X-cisco-xsi-9.0.1

Allow-Events: kpml,dialog

Content-Length: 632

Content-Type: application/sdp

Content-Disposition: session;handling=optional

(106)

Case Study 3: No One Answers the Phone

INVITE from IP Phone w/ SDP (continued)

v=0 o=Cisco-SIPUA 26964 0 IN IP4 172.18.159.152 s=SIP Call t=0 0 m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101 c=IN IP4 172.18.159.152 a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX a=rtpmap:0 PCMU/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:18 G729/8000 a=fmtp:18 annexb=no a=rtpmap:102 L16/16000 a=rtpmap:9 G722/8000 a=rtpmap:116 iLBC/8000 a=fmtp:116 mode=20 a=rtpmap:124 ISAC/16000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=sendrecv m=video 25466 RTP/AVP 97 c=IN IP4 172.18.159.152 b=TIAS:1000000 a=rtpmap:97 H264/90000 a=fmtp:97 profile-level-id=42801E a=recvonly

(107)

Case Study 3: No One Answers the Phone

Unified CM Sends a 100 Trying

03/29/2010 10:36:33.773 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682 index 2321

SIP/2.0 100 Trying

Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1636ab61

From: "Test User 1" <sip:89919236@172.18.106.59>;tag=00260bd9669e07147bcb3aac-3cda8f0c

To: <sip:9@172.18.106.59;user=phone>

Date: Mon, 29 Mar 2010 14:36:33 GMT

Call-ID: 00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152

CSeq: 101 INVITE Allow-Events: presence Content-Length: 0

(108)

Case Study 3: No One Answers the Phone

Unified CM Sends a REFER to Play Outside Dialtone

REFER sip:89919236@172.18.159.152:51682 SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf

From: <sip:89919236@172.18.106.59>;tag=2144536187 To: <sip:89919236@172.18.159.152> Call-ID: 7747f400-bb01baf1-14685-3b6a12ac@172.18.106.59 CSeq: 101 REFER Max-Forwards: 70 Contact: <sip:89919236@172.18.106.59:5061;transport=tls> User-Agent: Cisco-CUCM8.0 Expires: 0 Refer-To: cid:1234567890@172.18.106.59 Content-Id: <1234567890@172.18.106.59> Require: norefersub Content-Type: application/x-cisco-remotecc-request+xml Referred-By: <sip:89919236@172.18.106.59> Content-Length: 409

(109)

Case Study 3: No One Answers the Phone

Unified CM Sends a REFER to play Outside Dialtone (continued)

<x-cisco-remotecc-request> <playtonereq> <dialogid> <callid>00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152</callid> <localtag>97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542</localtag> <remotetag>00260bd9669e07147bcb3aac-3cda8f0c</remotetag> </dialogid>

<tonetype>DtOutsideDialTone</tonetype> <direction>user</direction>

</playtonereq>

(110)

Case Study 3: No One Answers the Phone

Unified CM Sends a SUBSCRIBE for KPML

SUBSCRIBE sip:89919236@172.18.159.152:51682 SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f

From: <sip:9@172.18.106.59>;tag=1976165806

To: <sip:89919236@172.18.159.152>

Call-ID: 7747f400-bb01baf1-14686-3b6a12ac@172.18.106.59

CSeq: 101 SUBSCRIBE

Date: Mon, 29 Mar 2010 14:36:33 GMT User-Agent: Cisco-CUCM8.0

Event: kpml; call-id=00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152; from-tag=00260bd9669e07147bcb3aac-3cda8f0c Expires: 7200

Contact: <sip:9@172.18.106.59:5061;transport=tls> Accept: application/kpml-response+xml

Max-Forwards: 70

Content-Type: application/kpml-request+xml

Content-Length: 424

<?xml version="1.0" encoding="UTF-8" ?>

<kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request kpml-request.xsd" version="1.0">

</pattern> </kpml-request>

(111)

Case Study 3: No One Answers the Phone

Phone Sends 200 OK for the REFER and SUBSCRIBE

03/29/2010 10:36:33.802 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321 with 453 bytes:

SIP/2.0 200 OK

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf

From: <sip:89919236@172.18.106.59>;tag=2144536187

To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07167c743311-343ee3af

Date: Mon, 29 Mar 2010 14:36:33 GMT CSeq: 101 REFER

Server: Cisco-CP9951/9.0.1

Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS> Content-Length: 0

SIP/2.0 200 OK

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f

From: <sip:9@172.18.106.59>;tag=1976165806

To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89

Date: Mon, 29 Mar 2010 14:36:33 GMT CSeq: 101 SUBSCRIBE

Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS> Expires: 7200

(112)

Case Study 3: No One Answers the Phone

IP Phone

(172.18.159.152)

Unified CM

(172.18.159.152)

CUBE

(172.18.159.231) INVITE 100 Trying REFER SUBSCRIBE 200 OK (REFER) 200 OK (SUBSCRIBE)

(113)

Case Study 3: No One Answers the Phone

User Dials a ‘1’

NOTIFY sip:9@172.18.106.59:5061 SIP/2.0

Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1cd529ba

To: <sip:9@172.18.106.59>;tag=1976165806

From: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89

Date: Mon, 29 Mar 2010 14:36:33 GMT CSeq: 1001 NOTIFY

Event: kpml

Subscription-State: active; expires=7200 Max-Forwards: 70 Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS> Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE Content-Length: 209 Content-Type: application/kpml-response+xml Content-Disposition: session;handling=required <?xml version="1.0" encoding="UTF-8"?>

<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" version="1.0" code="200" text="OK" suppressed="false" forced_flush="false"

(114)

Case Study 3: No One Answers the Phone

Unified CM Replies to NOTIFY With a 200 OK

SIP/2.0 200 OK

Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1cd529ba

From: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89 To: <sip:9@172.18.106.59>;tag=1976165806

Date: Mon, 29 Mar 2010 14:36:34 GMT

CSeq: 1001 NOTIFY Content-Length: 0

(115)

Case Study 3: No One Answers the Phone

Unified CM Replies Sends a REFER to Disable Outside Dialtone

REFER sip:89919236@172.18.159.152:51682 SIP/2.0

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0

From: <sip:89919236@172.18.106.59>;tag=1574166193 To: <sip:89919236@172.18.159.152> Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59 CSeq: 101 REFER Max-Forwards: 70 Contact: <sip:89919236@172.18.106.59:5061;transport=tls> User-Agent: Cisco-CUCM8.0 Expires: 0 Refer-To: cid:1234567890@172.18.106.59 Content-Id: <1234567890@172.18.106.59> Require: norefersub

Content-Type: application/x-cisco-remotecc-request+xml

Referred-By: <sip:89919236@172.18.106.59> Content-Length: 401

(116)

Case Study 3: No One Answers the Phone

<x-cisco-remotecc-request> <playtonereq>

</dialogid>

<tonetype>Dt_NoTone</tonetype> <direction>user</direction>

</playtonereq>

(117)

Case Study 3: No One Answers the Phone

Phone Replies With 200 OK to REFER

SIP/2.0 200 OK

Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0

From: <sip:89919236@172.18.106.59>;tag=1574166193

To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07184b08b96b-796ab86f

Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59

Date: Mon, 29 Mar 2010 14:36:33 GMT CSeq: 101 REFER

Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS> Content-Length: 0