Sip T&S PDF

#CLUS
Troubleshooting SIP
with Cisco Unified
Communications
Paul Giralt, Distinguished Services Engineer
pgiralt@cisco.com - @PaulGiralt
BRKUCC-2932
#CLUS
Agenda
• Session Initiation Protocol (SIP) Overview
• Troubleshooting Tools
• Unified CM Tracing
• Expressway / VCS Tracing
• Cisco Unified Border Element (CUBE) Tracing
• Sample Call Flows / Case Studies
• Live Demos
#CLUS BRKUCC-2932 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 3
SIP Protocol Overview
What is SIP?
• Signaling protocol used to establish, manage, and terminate
sessions over an IP network
• Core protocol defined in RFC 3261
• Relies heavily on RFC 3262, RFC 3263, RFC 3264, and RFC 3265
• Extended in many, many other RFCs
• ASCII-based messages
What is SIP?
• User Agents
• SIP Messages
• Requests and Responses
• Headers
• Media Negotiation
• Session Description Protocol
• Offer/Answer Model
• Early Offer vs. Delayed Offer
• Early Media
• DTMF Relay
User Agents
• User Agent Clients (UAC) send requests to User Agent Servers
(UAS)
• User Agent Servers send responses to the requests
• Most SIP devices are both a UAC and a UAS
(they both initiate and accept requests)
• Unified CM and CUBE are both Back-to-Back User Agents (B2BUA)
(as opposed to Proxies)
• Cisco VCS and Cisco Expressway operate as both proxies and
B2BUA’s
SIP Request Methods from RFC 3261
• INVITE - A user or service is being invited to participate in a multimedia
session
• ACK - Confirms that a client has received a final response to an INVITE
request
• BYE - Terminates an existing session; can be sent by any user agent
(in a multiparty session)
• CANCEL - Cancels pending requests; does not terminate sessions that
have been accepted
• OPTIONS - Queries the capabilities of servers (Also used as a keep alive)
• REGISTER - Registers the user agent with the registrar server of a domain
Additional SIP Request Methods
• INFO (RFC 2976) - to send more information within an established dialog
• PRACK (RFC 3262) - to acknowledge a provisional response
• SUBSCRIBE (RFC 3265) - to tell a remote node to look for a certain event
• NOTIFY (RFC 3265) - to respond when that certain event occurs
• UPDATE (RFC 3311) - to update parameters of a session set-up
• MESSAGE (RFC 3428) - SIP instant messaging
• REFER (RFC 3515) – to “refer” one UA to communicate with another UA
• PUBLISH (RFC 3903) - to push UA state information to a
compositor/presence server
SIP INVITE Method
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665
From: "Test User 1" <sip:9195551111@172.18.106.59>;tag=97903bc0-43adcd-45510543
To: <sip:+18775551234@172.18.159.231>
Call-ID: 7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59
Supported: timer,resource-priority,replaces
User-Agent: Cisco-CUCM12.0
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER
CSeq: 101 INVITE
Expires: 180
Allow-Events: presence, kpml
Session-ID: 52c41df700105000a00074a02fc0cf3b;remote=00000000000000000000000000000000
Supported: Geolocation
Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Session-Expires: 1800
P-Asserted-Identity: "Test User 1" <sip:9195551111@172.18.106.59>
Contact: <sip:9195551111@172.18.106.59:5060>;video;audio
Max-Forwards: 69
Content-Length: 864
Content-Type: application/sdp
SIP Request Line
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
To: <sip:+18775551234@172.18.159.231>
Request URI SIP Version
SIP OPTIONS,
Allow: INVITE, MethodINFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 864
SIP Headers
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
To: <sip:+18775551234@172.18.159.231>
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 864
SIP Response
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Date: Mon, 16 Jan 2018 04:00:22 GMT
CSeq: 101 INVITE
Allow-Events: telephone-event
Session-ID: 747a0ead00105000a00074a02fc0cf3b;remote=52c41df700105000a00074a02fc0cf3b
Server: Cisco-SIPGateway/IOS-15.6.2.T
Reason: Q.850;cause=1
Content-Length: 0
SIP Response
SIP/2.0 404 Not Found Free-text Reason
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Response
Date: Mon, 16 Jan Code GMT
2012 04:00:22
CSeq: 101 INVITE
Content-Length: 0
SIP Response
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Date: Mon, 16 Jan 2018 04:00:22 GMT
CSeq: 101 INVITE
Content-Length: 0
SIP Responses
Response Code Description Example
1xx Informational – Request Received and Continuing to Process 100 Trying

Request 180 Ringing
183 Session Progress
2xx Success – Action was successfully received, understood, and 200 OK
accepted 202 Acceptable
3xx Redirection – Another SIP Element needs to be contacted in 300 Multiple Choices
order to complete the request 301 Moved Permanently
302 Moved Temporarily
4xx Client Error – Request contains bad syntax or cannot be fulfilled 401 Unauthorized
at this server 404 Not Found
406 Not Acceptable
486 Busy Here
488 Not Acceptable Here
5xx Server Error – Server failed to fulfill an apparently valid request 503 Service Unavailable
6xx Global Failure – Request is invalid at any server 600 Busy Everywhere
603 Decline
SIP Mandatory Headers – RFC 3261 Section 20
• Where column: Header field where proxy ACK BYE CAN INV OPT REG
___________________________________________________________
• R: header field may only appear in requests; Accept R - o - o m* o
• r: header field may only appear in responses; Accept
Accept
2xx
415
-
-
-
c
-
-
o
c
m* o
c c
• 2xx, 4xx, etc.: A numerical value or range indicates Accept-Encoding R - o - o o o
response codes with which the header field can be used; Accept-Encoding
Accept-Encoding
2xx
415
-
-
-
c
-
-
o
c
m* o
c c
• c: header field is copied from the request to the response. Accept-Language R - o - o o o
Accept-Language 2xx - - - o m* o
• Requirements: Accept-Language
Alert-Info
415
R ar
-
-
c
-
-
-
c
o
c
-
c
-
• c: Conditional; requirements on the header field depend Alert-Info 180 ar - - - o - -
on the context of the message. Allow
Allow
R
2xx
-
-
o
o
-
-
o o
m* m* o
o
• m: The header field is mandatory. Allow r - o - o o o

• m*: The header field SHOULD be sent, but clients/servers Allow
Authentication-Info
405
2xx
-
-
m
o
-
-
m
o
m
o
m
o
need to be prepared to receive messages without that Authorization R o o o o o o
header field. Call-ID
Call-Info
c r
ar
m
-
m
-
m
-
m
o
m
o
m
o
• o: The header field is optional. Contact R o - - m o o
• t: The header field SHOULD be sent, but clients/servers Contact
Contact
1xx
2xx
-
-
-
-
-
-
o
m
-
o
-
o
need to be prepared to receive messages without that Contact 3xx d - o - o o o
header field. If a stream-based protocol (such as TCP) is Contact
Content-Disposition
485 -
o
o
o
-
-
o
o
o
o
o
o
used as a transport, then the header field MUST be sent. Content-Encoding o o - o o o
• *: The header field is required if the message body is not Content-Language
Content-Length ar
o
t
o
t
-
t
o
t
o
t
o
t
empty. See Sections 20.14, 20.15 and 7.4 for details. Content-Type * * - * * *
CSeq c r m m m m m m
Basic SIP Call Setup
Phone Unified CM
INVITE
200 OK
ACK
Session Established
BYE
200 OK
Basic SIP Call Setup with B2BUA (Unified CM)
Phone 1 Unified CM SBC (CUBE)
Phone 2
INVITE
INVITE
200 OK
200 OK
ACK
ACK
Session Established
BYE
BYE
200 OK
200 OK
Basic SIP Call Setup with Unified CM SPand
SBC
CUBE
Phone Unified CM SBC (CUBE)
SIP
SP
SBC
INVITE
INVITE
INVITE
200 OK
200 OK
200 OK ACK
ACK
ACK
Session Established
BYE
BYE
BYE 200 OK
200 OK
200 OK
Media Negotiation
• SIP leverages the Session Description Protocol (SDP)
(RFC 4566/3266/2327) to communicate media information.
• SIP uses the offer/answer model described in RFC 3264 to
negotiate media using SDP
Offer/Answer Model (RFC 3264)
• One endpoint sends an offer SDP containing all the capabilities the
endpoint wishes to negotiate.
• SDP contains m lines for each media stream being negotiated (i.e.
audio, video, content channel, etc…)
• Receiving endpoint sends an answer SDP that contains the same or
a subset of capabilities received in the offer.
• Per RFC 3264, “For each "m=" line in the offer, there MUST be a
corresponding "m=“ line in the answer. The answer MUST contain
exactly the same number of "m=" lines as the offer.”
Session Description Protocol (SDP) - Offer
v=0
o=Cisco-SIPUA 26964 0 IN IP4 172.18.159.152
s=SIP Call
t=0 0
m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 172.18.159.152
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:102 L16/16000
a=rtpmap:9 G722/8000
a=rtpmap:116 iLBC/8000
a=fmtp:116 mode=20
a=rtpmap:124 ISAC/16000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
m=video 25466 RTP/AVP 97
c=IN IP4 172.18.159.152
b=TIAS:1000000
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801E
a=recvonly
Session Description Protocol (SDP) - Answer
v=0
o=CiscoSystemsCCM-SIP 2000 1 IN IP4 172.18.106.59
s=SIP Call
c=IN IP4 172.18.159.152
t=0 0
m=audio 30308 RTP/AVP 0 101
a=ptime:20
a=fmtp:101 0-15
Media Negotiation – Early Offer and Delayed
Offer
• Initiator of the call can send SDP offer in the INVITE – this is called
an Early Offer (EO)
• Receiving endpoint can send the SDP offer in a response if the
INVITE did not contain an offer – this is called a Delayed Offer (DO)
• For Early Offer, the answer is sent in a response (usually 200 OK).
• For Delayed Offer, the answer is typically sent in the ACK.
Early Offer
Phone Unified CM
INVITE with SDP - Offer
200 OK with SDP - Answer
ACK (no SDP)
Session Established
BYE
200 OK
Delayed Offer
Phone Unified CM
INVITE (no SDP)
200 OK with SDP - Offer
ACK with SDP - Answer
Session Established
BYE
200 OK
Early Media
• Delayed Offer calls do not set up media until the 200 OK (call is
answered)
• If media is required prior to the call being connected, SIP has
provisions for Early Media
• With Early Media on a Delayed Offer call, the offer comes from the
terminating side in a provisional response (e.g. 183 Session
Progress)
• Originating side sends SDP Answer in a PRACK message
(defined in RFC 3262)
Early Media
Phone Unified CM
INVITE (no SDP)
183 Session Progress with SDP - Offer
PRACK with SDP - Answer
Media Stream Established

200 OK (PRACK)
200 OK (INVITE)
ACK
Session Established
BYE
200 OK
Early Media w/ Early Offer
Phone Unified CM
INVITE with SDP - Offer
183 Session Progress with SDP - Answer
PRACK (optional)
Media Stream Established

200 OK (PRACK) (optional)
200 OK (INVITE) with SDP (same as Answer in 183)
ACK
Session Established
BYE
200 OK
Media Re-negotiation
Re-INVITE
• Either UA involved in a call can re-INVITE an existing dialog to re-
negotiate parameters for the call.
• Cannot re-INVITE until any previous INVITE messages have
received a final response.
• UPDATE method can also be used to re-negotiate prior to a final
response.
Re-INVITE
INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901f9c72c19221
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:89915644@172.18.106.59>;tag=0022bdd6843100702aae8e5b-4be253be
Date: Wed, 11 Jan 2018 03:08:51 GMT
Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59
Min-SE: 1800
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 104 INVITE
Max-Forwards: 70
Expires: 180
Allow-Events: presence
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= Authenticated; orientation= from; gci= 2-231448; call-instance= 2
Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=calling;screen=yes;privacy=off
Contact: <sip:89915644@172.18.106.59:5061;transport=tls>
Content-Length: 489
Re-INVITE – Stopping a Media Session
v=0
s=SIP Call
c=IN IP4 0.0.0.0
t=0 0
m=audio 19594 RTP/SAVP 9 101
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=ptime:20
a=inactive
a=fmtp:101 0-15
b=TIAS:1000000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=inactive
a=mid:227796888
Re-INVITE – Delayed Offer to Re-establish Media Stream
INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
Date: Wed, 11 Jan 2018 03:08:52 GMT
Min-SE: 1800
CSeq: 106 INVITE
Max-Forwards: 70
Expires: 180
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= from; gci= 2-231448; call-instance= 2
Content-Length: 0
Re-INVITE – Offer in 200 OK
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
Date: Wed, 11 Jan 2018 03:08:52 GMT
CSeq: 106 INVITE
Server: Cisco-8865/12.0.1
Contact: <sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=called;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-
service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.2.0,X-cisco-xsi-8.5.1
Allow-Events: kpml,dialog
Recv-Info: conference
Recv-Info: x-cisco-conference
Content-Length: 788
Content-Disposition: session;handling=optional
Re-INVITE – Offer in 200 OK
v=0
s=SIP Call
t=0 0
m=audio 32518 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 10.116.101.41
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:18 G729/8000
a=rtpmap:102 L16/16000
a=fmtp:101 0-15
a=sendrecv
m=video 17614 RTP/AVP 126 97
c=IN IP4 10.116.101.41
b=TIAS:2500000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801F;packetization-mode=0;level-asymmetry-allowed=1
a=sendrecv
Re-INVITE – Answer in ACK
ACK sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fb064465a06
Date: Wed, 11 Jan 2018 03:08:52 GMT
Max-Forwards: 70
CSeq: 106 ACK
Content-Length: 446
Re-INVITE – Answer in ACK – Decline Video Support
v=0
s=SIP Call
t=0 0
m=audio 4000 RTP/SAVP 0
c=IN IP4 172.18.106.58
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=ptime:20
a=sendonly
c=IN IP4 10.116.101.50
b=TIAS:1000000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=mid:227796888
DTMF Relay
• 3 Methods for passing DTMF digits over a SIP network:
• RFC 4733 (a.k.a. RFC 2833)
• SIP NOTIFY
• SIP Keypad Markup Language (KPML)
DTMF Relay
RFC 4733 / RFC 2833
• Digits are passed in the RTP stream with a unique payload type
• Capability is negotiated in SDP like any other codec
Offer Answer
m=audio 30414 RTP/AVP 0 8 116 18 100 101 m=audio 17236 RTP/AVP 0 101
c=IN IP4 172.18.106.231 a=rtpmap:0 PCMU/8000
a=rtpmap:0 PCMU/8000 a=ptime:20
a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000
a=rtpmap:116 iLBC/8000 a=fmtp:101 0-15
a=fmtp:116 mode=20
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:100 X-NSE/800
a=fmtp:100 192-194
a=fmtp:101 0-16
DTMF Relay
SIP NOTIFY
• Passes DTMF information in a SIP NOTIFY message telephone-event Event
• Negotiated in Call-Info header
“Offer”
INVITE sip:+19195553333@172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434
From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14902469~0d0d25d7-4931-4a07-83c6
To: <sip:+19195553333@172.18.106.231>
Date: Mon, 13 May 2017 14:48:00 GMT
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
... snip ...
Call-Info: <urn:x-cisco-remotecc:callinfo>;x-cisco-video-traffic-class=DESKTOP
... snip ...
Max-Forwards: 69
Content-Length: 0
DTMF Relay
SIP NOTIFY
“Answer”
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434
To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
... snip ...
Call-Info: <sip:172.18.106.231:5060>;method="NOTIFY;Event=telephone-event;Duration=500”
... snip ...
Content-Length: 601
DTMF Relay
SIP NOTIFY
• Digits passed in payload of a NOTIFY message
NOTIFY sip:172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK98443140152a0a
To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
CSeq: 104 NOTIFY
Max-Forwards: 70
Date: Mon, 13 May 2017 14:48:11 GMT
Event: telephone-event
Subscription-State: active
Contact: <sip:172.18.106.59:5060>
P-Asserted-Identity: "Paul Giralt" <sip:9195551234@172.18.106.59>
Content-Type: audio/telephone-event
Content-Length: 4
.d
DTMF Relay
SIP KPML
• Passes DTMF information in a SIP NOTIFY message kpml Event
• Capability advertised in Allow-Events – uses SUBSCRIBE message to subscribe
“Offer”
INVITE sip:+19195554444@172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4
To: <sip:+19195554444@172.18.106.231>
Date: Mon, 13 May 2017 15:05:24 GMT
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
... snip ...
... snip ...
Max-Forwards: 69
Content-Length: 0
DTMF Relay
SIP KPML “Answer”
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4
To: <sip:+19195554444@172.18.106.231>;tag=437394E8-2E1
Date: Mon, 13 May 2017 15:05:26 GMT
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO
Allow-Events: kpml, telephone-event
Remote-Party-ID: <sip:9196247285@172.18.106.231>;party=called;screen=no;privacy=off
Contact: <sip:+19196247285@172.18.106.231:5060>
Supported: replaces
Require: timer
Session-Expires: 18000;refresher=uac
Content-Type: multipart/mixed;boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 600
DTMF Relay
SIP KPML Subscribe to KPML
SUBSCRIBE sip:9195554444@172.18.106.59:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.231:5060;branch=z9hG4bKBAE27139E
From: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1
To: "Paul Giralt" <sip:9195554444@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 101 SUBSCRIBE
Max-Forwards: 70
User-Agent: Cisco-SIPGateway/IOS-15.6.2.T
Event: kpml
Expires: 7200
Contact: <sip:172.18.106.231:5060>
Content-Type: application/kpml-request+xml
Content-Length: 327
<?xml version="1.0" encoding="UTF-8"?><kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-
request kpml-request.xsd" version="1.0"><pattern persist="persist"><regex
tag="dtmf">[x*#ABCD]</regex></pattern></kpml-request>
DTMF Relay
SIP KPML Send a Digit
NOTIFY sip:172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986f73662cca3b
To: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 104 NOTIFY
Max-Forwards: 70
Event: kpml
Subscription-State: active;expires=7197
Contact: <sip:9195554444@172.18.106.59:5060>
Content-Type: application/kpml-response+xml
Content-Length: 336
<?xml version="1.0" encoding="UTF-8" ?>

<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-response kpml-response.xsd" code="200" digits="1"
forced_flush="false" suppressed="false" tag="dtmf" text="Success" version="1.0"/>
SIP Session-ID (RFC 7989)
• Session-ID Header carries an end-to-end session identifier
• Allows you to track a call as it traverses through various SIP systems
Session-ID: 65596d4800105000a00074a02fc0d796;remote=747a0ead00105000a00074a02fc0cf3b
Local UUID Remote UUID
• Session Identifier represented as {A,B} referring to {local,remote} UUIDs

• {A,B} is equivalent to {B,A}
SIP Call with Session-ID Headers
Phone 1 Unified CM Phone 2 Phone 3
INVITE {A,N}
INVITE {A,N}
100 Trying {N,A}
100 Trying {B,A}
200 OK {B,A}
200 OK {B,A}
ACK {A,B}
ACK {A,B}
Session Established
REFER {B,A}
200 OK {A,B}
SIP Call with Session-ID Headers
Phone 1 Unified CM Phone 2 Phone 3
INVITE {A,N}
200 OK {C,A}
re-INVITE {C,A}
200 OK {A,C}
ACK {A,C}
Session Established
BYE {A,B}
200 OK {B,A}
SIP Session-ID Support
• Current Support:
• Unified CM 11.0 and later
• Jabber 11.5 and later
• 78XX/88XX Endpoints 11.0 and later
• CUBE 15.6(2)T and later
• CVP 11.5 and later
• Expressway X8.10 and later
• CE and RoomOS Endpoints 9.6 and later
• Webex Calling / Webex Teams Hybrid Call Services
Troubleshooting Tools
SIP Troubleshooting Tools
• Unified CM / SME Tools:
• Real Time Monitoring Tool / Session Trace
• TranslatorX
• Collaboration Solutions Analyzer
• IOS (CUBE) and VCS Troubleshooting Tool:

• TranslatorX
• Collaboration Solutions Analyzer
• Wireshark
RTMT Session Trace Tool
Session Trace Features
• Allows you to search for a call based on calling or called number
• Does not depend on Call Detail Records (uses calllogs file)
• Session trace only traces SIP sessions (no SCCP, H.323, or MGCP)
• Can display raw SIP messages
• Uses correlation tags to include all call legs related to the call
selected
Call Flow Diagram
Click on the message in the call flow diagram to see the actual message
TranslatorX Tool
Features
• Parses through Unified CM Trace Files (and CUBE, CUSP,
VCS/Expressway, Jabber 10.x+, 88XX Phone Logs, PCAP Files (basic
support))
• Drag-and-Drop support for .txt as well as .gz files.
• Decodes SIP, SCCP, H.323, MGCP, Q.Sig, and ISDN Q.931 messages
• Call List based on CDR information in the Traces
• Can generate multi-protocol ladder diagrams
• Sophisticated filtering capabilities (including Session-ID Support)
• Download for Windows, Mac OS X, and Linux from: http://translatorx.org/
• NOTE: Do not call TAC for support on TranslatorX (although many TAC
engineers use it so feel free to mention you’re using it)
TranslatorX Tool
TranslatorX Tool – Call List Window
TranslatorX Tool – Call List Filtering
Double-click for
complete Call Detail
Record
TranslatorX Tool – CDR View
TranslatorX Tool – CDR View
TranslatorX Tool – Generating Filters
Select a Call and click

“Generate Filter” button
TranslatorX Tool - Filters
TranslatorX Tool – Call Flow Diagram
TranslatorX Tool – Call Flow Diagram
Collaboration Solutions Analyzer
cway.cisco.com/csa
Wireshark
• Open Source network packet capture and analysis tool
• Available at http://www.wireshark.org
• Available for Windows, Mac OS X, and UNIX/Linux
• Provides VoIP Call and SIP analysis
Wireshark
Wireshark
VoIP Call Analysis
Wireshark
VoIP Call Ladder Diagram
Unified CM Trace Configuration
• SIP messaging in Unified CM is written to the SDL trace file when
appropriate trace levels are set (SDI trace in for pre-9.0)
• Configured from Cisco Unified Serviceability > Trace >
Configuration or by using Analysis Manager
• Unified CM 9.0 and later combines SDI and SDL traces into the SDL
traces
• Unified CM 9.0 and later fresh install and later default to detailed
tracing – no need to configure traces.
Select the Server
Select Service Group
Select the Service on

Which Trace Needs to
Be Enabled
1. Press Set Default
Updates All Servers

in this cluster with
these settings
2. Set to Detailed
Trace Collection
Various Ways to Collect Trace Files
• RTMT Collect Files Recommended
• RTMT Analysis Manager
• RTMT Remote Browse
• RTMT Query Wizard
• OS CLI (file get or file tail)
• file tail activelog cm/trace/ccm/sdl recent
Reference
Gathering a Packet Capture from Unified CM
Use the Platform CLI command ‘utils network capture’
admin:utils network capture ? (or utils network capture-rotate)
Syntax:
utils network capture [options]
options optional page, numeric, file fname, count num, size bytes, src addr,
dest addr, port num, host protocol addr
admin:utils network capture file capturefile count 100000 size ALL host ip
10.1.1.1
Executing command with options:
size=ALL count=100000 interface=eth0
src= dest= port=
ip=10.1.1.1
admin:file list activelog platform/cli

capturefile.cap
dir count = 0, file count = 1
admin:file get activelog platform/cli/capturefile.cap

Please wait while the system is gathering files info ...done.
Sub-directories were not traversed.
Number of files affected: 1
Total size in Bytes: 24
Total size in Kbytes: 0.0234375
Would you like to proceed [y/n]? y
Expressway / VCS
Trace Configuration
VCS / Expressway Trace Configuration
• VCS / Expressway-C / Expressway-E can log SIP messages to a
diagnostic log file.
• To enable, navigate to Maintenance >
Diagnostics > Diagnostic logging
Select this if you want to

get a Wireshark capture
Click Start new log
Click OK to Confirm
Click Stop logging after

reproducing your problem
Click to Collect the log and

tcpdump (for Wireshark)
Click to Download the log and

tcpdump (for Wireshark)
Cisco Unified Border Element (CUBE)
Trace Configuration
CUBE Debugging
• CUBE / IOS Tools:
• IOS debugs
• IOS show commands
• Event Trace
• Packet export
CUBE Debugging
• When debugging in IOS, configure logging buffered to a fairly large value
(based on available memory)
• Disable logging to the console with command ‘no logging console’
• Enable timestamps for debugs
• Make sure router has NTP enabled
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
logging buffered 10000000 debugging

no logging console
clock timezone EST -5 0

clock summer-time EDT recurring
ntp server 10.14.1.1
CUBE Debugging
Various SIP debugs available
CUBE#debug ccsip ?
all Enable all SIP debugging traces
calls Enable CCSIP SPI calls debugging trace
dhcp Enable SIP-DHCP debugging trace
error Enable SIP error debugging trace
events Enable SIP events debugging trace
function Enable SIP function debugging trace
info Enable SIP info debugging trace
media Enable SIP media debugging trace
messages Enable CCSIP SPI messages debugging trace
non-call Enable Non-Call-Context trace (OPTIONS, SUBSCRIBE etc)
preauth Enable SIP preauth debugging traces
states Enable CCSIP SPI states debugging trace
translate Enable SIP translation debugging trace
transport Enable SIP transport debugging traces
verbose Enable verbose mode
CUBE Debugging
Sample ‘debug ccsip messages’
Jan 12 03:14:43.102: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:+19193922900@10.14.1.10:5060 SIP/2.0
Via: SIP/2.0/TCP 172.18.106.59:5060;branch=z9hG4bK978d2e8df73dc
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=16218435~-b82e2c213ca7-45552048
To: <sip:+19193922900@10.14.1.10>
Date: Thu, 12 Jan 2012 03:09:42 GMT
Call-ID: ddc4e480-f0e14ef6-94ca5c-3b6a12ac@172.18.106.59
Supported: 100rel,timer,resource-priority,replaces
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Supported: X-cisco-srtp-fallback
Cisco-Guid: 3720668288-0000065536-0000015564-0996807340
Contact: <sip:89915644@172.18.106.59:5060;transport=tcp>;video;audio
Max-Forwards: 69
Content-Length: 0
CUBE Debugging
• Other generic voice debugs can be useful as well:
• debug voice ccapi inout
• debug voice dialpeer
• debug voice rtp session dtmf-relay
• debug voice rtp session named-event (for any RFC 4733/2833 packets)
CUBE Logging Persistent
• Continuously log debugs to flash / hard disk on CUBE
Router(config)#logging buffer 10000000 debugging
Router(config)#logging persistent url flash0:/MYDEBUGS
size 104857600 filesize 5242880
Directory for Logs
Total Space Used Size of Each File
Router#dir flash0:MYDEBUGS
Directory of flash0:/MYDEBUGS/
223 -rw- 5239168 Sep 27 2013 11:31:16 -04:00 log_20170927-112427

224 -rw- 5239631 Sep 27 2013 11:38:06 -04:00 log_20170927-113117
225 -rw- 3500757 Sep 27 2013 11:42:40 -04:00 log_20170927-113807
Cisco Unified Border Element Basic Call Flow
• Incoming VoIP setup message from originating endpoint
• This matches inbound VoIP dial peer 1 for characteristics such as codec, VAD,
DTMF method, protocol, etc.
• Match the called number to outbound VoIP dial peer 2
• Outgoing VoIP setup message voice service voip
allow-connections sip to sip
Originating Terminating
Endpoint Endpoint
Incoming VoIP Call Outgoing VoIP Call
CUBE
dial-peer voice 1 voip dial-peer voice 2 voip

destination-pattern 1000 destination-pattern 2000
incoming called-number .T session protocol sipv2
session protocol sipv2 session target ipv4:192.168.12.25
session target ipv4:192.168.10.50 voice-class sip early-offer forced
dtmf-relay rtp-nte sip-kpml dtmf-relay rtp-nte
codec g711ulaw codec g711ulaw
CUBE show Commands
• show call active voice [brief] shows state of currently active calls
0 : 13185070 3497557126ms.1 (19:31:29.719 EDT Fri Jun 8 2018) +2440 pid:200 Answer 9195555644 connected
dur 00:00:11 tx:535/107000 rx:466/93200 dscp:0 media:0 audio tos:0xB8 video tos:0x0
IP 173.37.124.198:57542 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g711ulaw TextRelay: off Transcoded: No ICE: Off
media inactive detected:n media contrl rcvd:n/a timestamp:n/a
long duration call detected:n long duration call duration:n/a timestamp:n/a
LostPacketRate:0.00 OutOfOrderRate:0.00
LocalUUID:c3ef30eaf83e77070c95a8a250e52fcd
RemoteUUID:ee064c2b6a275ea7a41bd022ab4f659c
VRF:
0 : 13185071 3497557126ms.2 (19:31:29.719 EDT Fri Jun 8 2018) +2440 pid:100 Originate 8008001180 connected
dur 00:00:11 tx:466/93200 rx:548/109600 dscp:0 media:0 audio tos:0xB8 video tos:0x0
IP 208.70.21.21:16016 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g711ulaw TextRelay: off Transcoded: No ICE: Off
media inactive detected:n media contrl rcvd:n/a timestamp:n/a
long duration call detected:n long duration call duration:n/a timestamp:n/a
LostPacketRate:0.00 OutOfOrderRate:0.00
LocalUUID:ee064c2b6a275ea7a41bd022ab4f659c
RemoteUUID:c3ef30eaf83e77070c95a8a250e52fcd
VRF:
CUBE show Commands
• show cube calls shows more specific CUBE-related call information
and allows filtering
CUBE# show cube calls all ?
callID Display information matches callID
called-number Display information matches called number
calling-number Display information matches calling number
conf-id Display information matches conference ID
detail Display detail level information
fpi-cor Display information matches FPI Correlator
peer-callID Display information matches peer callID
peer-rtp-port Display information matches peer rtp-port number
rtp-port Display information matches rtp-port number
| Output modifiers
CUBE show Commands
CUBE#show cube calls all called-number 8008001180
called number: 8008001180 info are as the following:
=============================================================
=============================================================
Phone number 8008001180 has the following callID associated to it:
=============================================================
CallID: 1730781, calling number: 9195551234
============================================================
A total of 1 call legs associated to number: 8008001180
============================================================
CUBE show Commands
CUBE#show cube calls all callID 1730781
callid: 1730781 info are as the following:
=============================================================
SIP call leg info:
=============================================================
SIP CALL INFO of CCAPI callid 1730781
Call 1
SIP Call ID : 41669A03-D5611E5-8A6384B0-5DED4CDB@64.102.250.104
State of the call : STATE_ACTIVE (7)
Substate of the call : SUBSTATE_NONE (0)
Calling Number : 9195551234
Called Number : 8008001180
Called URI : sip:8008001180@208.70.21.21:5060
Bit Flags : 0xE04018 0x90000100 0x0
CC Call ID : 1730781
Source IP Address (Sig ): 64.102.250.104
Destn SIP Req Addr:Port : [208.70.21.21]:5060
Destn SIP Resp Addr:Port: [208.70.21.21]:5060
Reference
CUBE – IOS-XE Embedded Traffic Capture

Export Packet Data in PCAP Format
• IP Traffic Export feature allows export of packets on an interface
• Configuration (From Enable mode, not Config mode):

monitor capture capture-name access-list access-list-name
monitor capture capture-name limit duration seconds
monitor capture capture-name interface interface-name both
monitor capture capture-name buffer circular size bytes
• Usage:
monitor capture capture-name start

monitor capture capture-name export file-location/file-name
monitor capture capture-name stop
Reference
CUBE – IOS IP Traffic Capture

Export Packet Data in PCAP Format
• IP Traffic Export feature allows export of packets on an interface
• Configuration:
ip traffic-export profile CUBE_Debug mode capture
bidirectional
incoming access-list 101
outgoing access-list 101
interface GigabitEthernet0/0
ip traffic-export apply CUBE_Debug size 10000000
• Usage:
traffic-export interface g0/0 start
traffic-export interface g0/0 stop
traffic-export interface g0/0 copy scp://10.1.1.1/capture.pcap
Case Studies
Case Study 1: Unable to Place a Call
Problem Description
• A user reports that every time they call (919) 555-1212, they get a
message that the call could not be completed as dialed
Use RTMT Session Trace
• Enter *5551212 into Called Number/URI field
• Set time and duration appropriately
• Search Finds two calls
• Double-click to see
message diagram
• Clearly shows the far-
end sends back a
404 Not Found
Troubleshoot Call on CUBE
• Enable SIP message debugs – debug ccsip messages
Jan 16 04:00:22.679: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:+19195551212@10.14.1.10:5060 SIP/2.0
To: <sip:+19195551212@10.14.1.10>
Date: Mon, 16 Jan 2018 03:55:17 GMT
Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 3852191232-0000065536-0000018595-0996807340
Contact: <sip:89915644@172.18.106.59:5060>
Max-Forwards: 69
Content-Length: 0
Troubleshoot Call on CUBE
• Check to see if the number matches a valid dial peer
Jan 16 04:00:22.687: //98/E59BC6000000/SIP/Msg/ccsipDisplayMsg:
Sent:
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210128~0d0d25d7-4931-4a07-83c6 b82e2c213ca7-
45568313
To: <sip:+19195551212@10.14.1.10>;tag=253488-726
Date: Mon, 16 Jan 2018 04:00:22 GMT
Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59
CSeq: 101 INVITE
Content-Length: 0 CUBE#show dialplan number +19195551212
Macro Exp.: +19195551212
No match, result=-1
Case Study 2: Unable to Place a Call #2
Problem Description
• A user reports that every time they call 80010001, they get reorder
(fast busy) tone
• Enter *80010001 into Called Number/URI field
• Set time and duration appropriately
• Search Finds one call
• Trace shows
signaling from both
phone and to
destination SIP trunk
• Receiving a 503
Service Unavailable
from destination
SIP/2.0 503 Service Unavailable
Via: SIP/2.0/UDP 172.18.106.58:5060;branch=z9hG4bK34a0915e2c7a20
From: "Paul Giralt" <sip:89915644@172.18.106.58>;tag=5964355~0d0d25d7-4931-4a07-
83c6-b82e2c213ca7-44286097
To: <sip:80010001@10.81.98.203>;tag=932088316
Date: Sun, 07 Jun 2015 16:02:18 GMT
Call-ID: 9126a680-57416b0a-349ed0-3a6a12ac@172.18.106.58
CSeq: 101 INVITE
Warning: 399 collab-ccie-cm1a "Unable to find a device handler for the request received on
port 5060 from 172.18.106.58"
Content-Length: 0
Case Study 3: No One Answers the Phone
Problem Description
• A user reports that every time they call a specific phone number, no
one answers the call, but if they call from their cell phone, the call is
answered immediately every time.
• Calling phone is extension 89919236
• Called number is 1 877 288-8362
Collect Traces
• Problem is reproducible, so generate a test call and then collect traces.
Use TranslatorX to Analyze Traces
• Problem is reproducible, so generate a test call and then collect traces.
Drag and Drop folder into TranslatorX
• Try to find call in Call List
• Search for called party number
• Disable Filters
• Select the INVITE
• Filter by SIP Call ID (control/command – S)
• Where did the call originate? Try searching for the calling party number
• Select the INVITE
• Create New Filter (control/command-N)
• Filter by IP Address (control/command – I)
• Re-enable Filters
INVITE from IP Phone w/ SDP
03/29/2010 10:36:33.771 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682
index 2321 with 1717 bytes:
INVITE sip:9@172.18.106.59;user=phone SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1636ab61
From: "Test User 1" <sip:89919236@172.18.106.59>;tag=00260bd9669e07147bcb3aac-3cda8f0c
To: <sip:9@172.18.106.59;user=phone>
Call-ID: 00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152
Max-Forwards: 70
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
User-Agent: Cisco-CP9951/9.0.1
Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=tls>
Expires: 180
Accept: application/sdp
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "Test User 1" <sip:89919236@172.18.106.59>;party=calling;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-
cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.0.0,X-cisco-xsi-9.0.1
Allow-Events: kpml,dialog
Content-Length: 632
Content-Disposition: session;handling=optional
INVITE from IP Phone w/ SDP (continued)
v=0
s=SIP Call
t=0 0
m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 172.18.159.152
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:102 L16/16000
a=fmtp:116 mode=20
a=fmtp:101 0-15
a=sendrecv
c=IN IP4 172.18.159.152
b=TIAS:1000000
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801E
a=recvonly
Unified CM Sends a 100 Trying
03/29/2010 10:36:33.773 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682 index 2321
SIP/2.0 100 Trying
To: <sip:9@172.18.106.59;user=phone>
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
Content-Length: 0
Unified CM Sends a REFER to Play Outside Dialtone
REFER sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf
From: <sip:89919236@172.18.106.59>;tag=2144536187
To: <sip:89919236@172.18.159.152>
Call-ID: 7747f400-bb01baf1-14685-3b6a12ac@172.18.106.59
CSeq: 101 REFER
Max-Forwards: 70
Expires: 0
Refer-To: cid:1234567890@172.18.106.59
Content-Id: <1234567890@172.18.106.59>
Require: norefersub
Content-Type: application/x-cisco-remotecc-request+xml
Referred-By: <sip:89919236@172.18.106.59>
Content-Length: 409
Unified CM Sends a REFER to play Outside Dialtone (continued)
<x-cisco-remotecc-request>
<playtonereq>
<dialogid>
<callid>00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152</callid>
<localtag>97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542</localtag>
<remotetag>00260bd9669e07147bcb3aac-3cda8f0c</remotetag>
</dialogid>
<tonetype>DtOutsideDialTone</tonetype>
<direction>user</direction>
</playtonereq>
</x-cisco-remotecc-request>
Unified CM Sends a SUBSCRIBE for KPML
SUBSCRIBE sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f
From: <sip:9@172.18.106.59>;tag=1976165806
To: <sip:89919236@172.18.159.152>
CSeq: 101 SUBSCRIBE
Date: Mon, 29 Mar 2010 14:36:33 GMT
Event: kpml; call-id=00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152; from-tag=00260bd9669e07147bcb3aac-3cda8f0c
Expires: 7200
Accept: application/kpml-response+xml
Max-Forwards: 70
Content-Type: application/kpml-request+xml
Content-Length: 424
<?xml version="1.0" encoding="UTF-8" ?>
<kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request kpml-request.xsd" version="1.0">
<pattern criticaldigittimer="1000" extradigittimer="500" interdigittimer="10000" persist="persist">
<regex tag="Backspace OK">[x#*+]|bs</regex>
</pattern>
</kpml-request>
Phone Sends 200 OK for the REFER and SUBSCRIBE
03/29/2010 10:36:33.802 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf
From: <sip:89919236@172.18.106.59>;tag=2144536187
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07167c743311-343ee3af
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 REFER
Server: Cisco-CP9951/9.0.1
Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS>
Content-Length: 0
03/29/2010 10:36:33.843 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f
From: <sip:9@172.18.106.59>;tag=1976165806
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 SUBSCRIBE
Expires: 7200
Content-Length: 0
IP Phone Unified CM CUBE
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
User Dials a ‘1’
03/29/2010 10:36:34.350 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port
51682 index 2321 with 896 bytes:
NOTIFY sip:9@172.18.106.59:5061 SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1cd529ba
To: <sip:9@172.18.106.59>;tag=1976165806
From: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 1001 NOTIFY
Event: kpml
Subscription-State: active; expires=7200
Max-Forwards: 70
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 209
Content-Disposition: session;handling=required
<?xml version="1.0" encoding="UTF-8"?>
<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" version="1.0" code="200" text="OK" suppressed="false"
forced_flush="false" digits="1" tag="Backspace OK"/>
Unified CM Replies to NOTIFY With a 200 OK
03/29/2010 10:36:34.352 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682
index 2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1001 NOTIFY
Content-Length: 0
Unified CM Replies Sends a REFER to Disable Outside Dialtone
03/29/2010 10:36:34.353 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682
REFER sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0
From: <sip:89919236@172.18.106.59>;tag=1574166193
To: <sip:89919236@172.18.159.152>
Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59
CSeq: 101 REFER
Max-Forwards: 70
Expires: 0
Refer-To: cid:1234567890@172.18.106.59
Content-Id: <1234567890@172.18.106.59>
Require: norefersub
Content-Type: application/x-cisco-remotecc-request+xml
Referred-By: <sip:89919236@172.18.106.59>
Content-Length: 401
<x-cisco-remotecc-request>
<playtonereq>
<dialogid>
<callid>00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152</callid>
<localtag>97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542</localtag>
<remotetag>00260bd9669e07147bcb3aac-3cda8f0c</remotetag>
</dialogid>
<tonetype>Dt_NoTone</tonetype>
<direction>user</direction>
</playtonereq>
</x-cisco-remotecc-request>
Phone Replies With 200 OK to REFER
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0
From: <sip:89919236@172.18.106.59>;tag=1574166193
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07184b08b96b-796ab86f
Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 REFER
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
User Dials a ‘8’
NOTIFY sip:9@172.18.106.59:5061 SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK647d03c1
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1002 NOTIFY
Event: kpml
Subscription-State: active; expires=7195
Max-Forwards: 70
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 209
Content-Disposition: session;handling=required
<?xml version="1.0" encoding="UTF-8"?>
<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" version="1.0" code="200" text="OK" suppressed="false"
forced_flush="false" digits="8" tag="Backspace OK"/>
Unified CM Replies to NOTIFY With a 200 OK
03/29/2010 10:36:34.352 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port
51682 index 2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1001 NOTIFY
Content-Length: 0
User Dials Remaining Digits
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
CUCM Sends an INVITE to the CUBE
03/29/2010 10:36:41.497 |//SIP/SIPUdp/wait_SdlSPISignal: Outgoing SIP UDP message to 172.18.159.231:[5060]:
INVITE sip:+18772888362@172.18.159.231:5060 SIP/2.0
From: "Test User 1" <sip:9194769236@172.18.106.59>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510543
To: <sip:+18772888362@172.18.159.231>
Date: Mon, 29 Mar 2010 14:36:41 GMT
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Supported: X-cisco-srtp-fallback
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
200 OK (SUBSCRIBE) INVITE
CUBE Replies With a 183 Session Progress W/ SDP
03/29/2010 10:36:42.324 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 1568 from
172.18.159.231:[5060]:
SIP/2.0 183 Session Progress
From: "Test User 1" <sip:9194769236@172.18.106.59>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510543
To: <sip:+18772888362@172.18.159.231>;tag=DE1EFF8-0
Date: Mon, 29 Mar 2010 14:37:23 GMT
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Remote-Party-ID: <sip:+18772888362@172.18.159.231>;party=called;screen=no;privacy=off
Contact: <sip:+18772888362@172.18.159.231:5060>
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-12.x
Content-Length: 772
CUBE Replies With a 183 Session Progress W/ SDP
v=0
o=CiscoSystemsSIP-GW-UserAgent 0 7954 IN IP4 172.18.159.231
s=SIP Call
c=IN IP4 172.18.159.231
t=0 0
m=audio 27980 RTP/AVP 0 8 116 18 100 101
c=IN IP4 172.18.159.231
a=fmtp:116 mode=20
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:100 X-NSE/8000
a=fmtp:100 192-194
a=fmtp:101 0-16
Unified CM Sends a 180 Ringing to the IP Phone
03/29/2010 10:36:42.330 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port
51682 index 2321
SIP/2.0 180 Ringing
To: <sip:9@172.18.106.59;user=phone>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= to; ui-state= ringout; gci= 2-
305505; call-instance=1
Send-Info: conference
Remote-Party-ID: <sip:+18772888362@172.18.106.59>;party=called;screen=no;privacy=off
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
100 Trying
180 Ringing
• Phone Keeps Ringing
• Timestamps Jump from 10:36:42 to 10:37:32
• No SIP Signaling for 50 seconds
Phone Sends a CANCEL
03/29/2010 10:37:32.934 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152

on port 51682 index 2321 with 422 bytes:
CANCEL sip:9@172.18.106.59;user=phone SIP/2.0
To: <sip:9@172.18.106.59;user=phone>
Max-Forwards: 70
Date: Mon, 29 Mar 2010 14:37:32 GMT
CSeq: 101 CANCEL
User-Agent: Cisco-CP9951/9.0.1
Content-Length: 0
Unified CM Sends a 200 OK for the CANCEL
03/29/2010 10:37:32.935 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on

port 51682 index 2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59;user=phone>
Date: Mon, 29 Mar 2010 14:37:32 GMT
CSeq: 101 CANCEL
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
NOTIFY
200 OK (NOTIFY)
CANCEL
200 OK (CANCEL)
CANCEL
487 Request Cancelled
200 OK (CANCEL)
487 Request Cancelled
ACK
ACK
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER
183 Session Progress (w/ ANSWER)

183 Session Progress (w/ OFFER)
180 Ringing (no SDP)
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER

??? (w/ ANSWER) ??? (w/ ANSWER)
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER

183 Session Progress (w/ ANSWER) PRACK (w/ ANSWER)
• How do we get the gateway to cut through audio on the 183 Session Progress message?
• RFC 3262: Reliability of Provisional Responses in the Session Initiation Protocol (SIP)
• Provides a way to acknowledge the 183 Session Progress message – PRACK
• Unified CM parameter “SIP Rel1XX Options” Disabled
•Send PRACK for all 1xx Messages
•Send PRACK if 1xx Contains SDP
cube(conf-serv-sip)#rel1xx ?
disable Disables reliable-provisional responses
require Requires reliable-provisional responses
supported Supports reliable-provisional responses
Unified CM SIP Profile Configuration
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
100 Trying
183 Session Progress PRACK
Case Study 4: Calls to S4B Clients Fail
• When a user dials a S4B client from a video-enabled Cisco phone,
the call fails. Call is from 58574 to 60051.
Case Study 4: Live Demo
M = {}
function M.outbound_INVITE(msg)
local contactHeader = msg:getHeader("Contact”)
if contactHeader then
local newContactHeader = string.gsub(contactHeader, ";video;audio;video", "")
msg:modifyHeader("Contact", newContactHeader)
end
end
return M
• For more information:
• Visit http://developer.cisco.com/web/sip/documentation to download the
SIP Normalization and Transparency Developer Guide
Case Study 5: Live Demo
Cisco Webex Teams
Questions?
Use Cisco Webex Teams to chat
with the speaker after the session
How
1 Find this session in the Cisco Live Mobile App
2 Click “Join the Discussion”
3 Install Webex Teams or go directly to the team space
4 Enter messages/questions in the team space
Webex Teams will be moderated cs.co/ciscolivebot#BRKUCC-2932

by the speaker until June 16, 2019.
#CLUS © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 158
Complete your
online session • Please complete your session survey
evaluation after each session. Your feedback
is very important.
• Complete a minimum of 4 session
surveys and the Overall Conference
survey (starting on Thursday) to
receive your Cisco Live water bottle.
• All surveys can be taken in the Cisco Live
Mobile App or by logging in to the Session
Catalog on ciscolive.cisco.com/us.
Cisco Live sessions will be available for viewing
on demand after the event at ciscolive.cisco.com.
Continue your education
Demos in the
Walk-in labs
Cisco campus
Meet the engineer

Related sessions
1:1 meetings
Thank you
#CLUS
#CLUS

Sip T&S PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sip T&S PDF

Uploaded by

Copyright:

Available Formats

#CLUS

1xx Informational – Request Received and Continuing to Process 100 Trying

• m: The header field is mandatory. Allow r - o - o o o

INVITE with SDP - Offer

200 OK with SDP - Answer

ACK (no SDP)

INVITE (no SDP)

200 OK with SDP - Offer

ACK with SDP - Answer

INVITE (no SDP)

183 Session Progress with SDP - Offer

PRACK with SDP - Answer

Media Stream Established

INVITE with SDP - Offer

183 Session Progress with SDP - Answer

Media Stream Established

200 OK (INVITE) with SDP (same as Answer in 183)

• Capability is negotiated in SDP like any other codec

• Negotiated in Call-Info header

• Capability advertised in Allow-Events – uses SUBSCRIBE message to subscribe

<?xml version="1.0" encoding="UTF-8"?><kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request"

<?xml version="1.0" encoding="UTF-8" ?>

• Session Identifier represented as {A,B} referring to {local,remote} UUIDs

• IOS (CUBE) and VCS Troubleshooting Tool:

Select a Call and click

Select the Server

Select Service Group

Select the Service on

Updates All Servers

admin:file list activelog platform/cli

admin:file get activelog platform/cli/capturefile.cap

Select this if you want to

Click Start new log

Click Stop logging after

Click to Collect the log and

Click to Download the log and

logging buffered 10000000 debugging

clock timezone EST -5 0

ntp server 10.14.1.1

223 -rw- 5239168 Sep 27 2013 11:31:16 -04:00 log_20170927-112427

dial-peer voice 1 voip dial-peer voice 2 voip

CUBE – IOS-XE Embedded Traffic Capture

• Configuration (From Enable mode, not Config mode):

monitor capture capture-name start

CUBE – IOS IP Traffic Capture

• Set time and duration appropriately

• Search Finds two calls

• Set time and duration appropriately

• Search Finds one call

• Select the INVITE

• Filter by SIP Call ID (control/command – S)

• Create New Filter (control/command-N)

• Filter by IP Address (control/command – I)

03/29/2010 10:37:32.934 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152

03/29/2010 10:37:32.935 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on

183 Session Progress (w/ ANSWER)

183 Session Progress (w/ ANSWER)

??? (w/ ANSWER) ??? (w/ ANSWER)

183 Session Progress (w/ ANSWER)

183 Session Progress (w/ ANSWER) PRACK (w/ ANSWER)

Webex Teams will be moderated cs.co/ciscolivebot#BRKUCC-2932

Meet the engineer

You might also like