Troubleshooting SIP

Troubleshooting SIP
with Cisco Unified

Communications
Paul Giralt (@PaulGiralt)
Distinguished Services Engineer
pgiralt@cisco.com
BRKUCC-2932
Cisco Spark
Questions?
Use Cisco Spark to communicate
with the speaker after the session
How
1. Find this session in the Cisco Live Mobile App
2. Click “Join the Discussion”
3. Install Spark or go directly to the space
4. Enter messages/questions in the space
Cisco Spark spaces will be cs.co/clus17/#BRKUCC-2932

available until July 3, 2017.
© 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public
Agenda
• Introduction
• Session Initiation Protocol (SIP) Overview
• Troubleshooting Tools
• Unified CM Tracing
• VCS / Expressway Tracing
• Cisco Unified Border Element (CUBE) Tracing
• Sample Call Flows / Case Studies
• Live Demos
SIP Protocol Overview
What is SIP?
• Signaling protocol used to establish, manage, and terminate sessions over an IP
network
• Core protocol defined in RFC 3261
• Relies heavily on RFC 3262, RFC 3263, RFC 3264, and RFC 3265
• Extended in many, many other RFCs
• ASCII-based messages
• Endpoints are referred to as User Agents
BRKUCC-2932 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
What is SIP?
• User Agents
• SIP Messages
• Requests and Responses
• Headers
• Media Negotiation
• Session Description Protocol
• Offer/Answer Model
• Early Offer vs. Delayed Offer
• Early Media
• DTMF Relay
User Agents
• User Agent Clients (UAC) send requests to User Agent Servers (UAS)
• User Agent Servers send responses to the requests
• Most SIP devices are both a UAC and a UAS (they both initiate and accept
requests)
• Unified CM and CUBE are both Back-to-Back User Agents (B2BUA) (as
opposed to Proxies)
• Cisco VCS and Cisco Expressway operate as both proxies and B2BUA’s
SIP Request Methods from RFC 3261
• INVITE - A user or service is being invited to participate in a multimedia session
• ACK - Confirms that a client has received a final response to an INVITE request
• BYE - Terminates an existing session; can be sent by any user agent (in a
multiparty session)
• CANCEL - Cancels pending requests; does not terminate sessions that have
been accepted
• OPTIONS - Queries the capabilities of servers (Also used as a keep alive)
• REGISTER - Registers the user agent with the registrar server of a domain
Additional SIP Request Methods
• INFO (RFC 2976) - to send more information within an established dialog
• PRACK (RFC 3262) - to acknowledge a provisional response
• SUBSCRIBE (RFC 3265) - to tell a remote node to look for a certain event
• NOTIFY (RFC 3265) - to respond when that certain event occurs
• UPDATE (RFC 3311) - to update parameters of a session set-up
• MESSAGE (RFC 3428) - SIP instant messaging
• REFER (RFC 3515) – to “refer” one UA to communicate with another UA
• PUBLISH (RFC 3903) - to push UA state information to a compositor/presence
server
SIP INVITE Method
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK1515b3154665
From: "Test User 1" <sip:9195551111@172.18.106.59>;tag=97903bc0-43adcd-45510543
To: <sip:+18775551234@172.18.159.231>
Call-ID: 7c0ca800-bb01baf9-1468e-3b6a12ac@172.18.106.59
Supported: timer,resource-priority,replaces
User-Agent: Cisco-CUCM11.5
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER
CSeq: 101 INVITE
Expires: 180
Allow-Events: presence, kpml
Session-ID: 52c41df700105000a00074a02fc0cf3b;remote=00000000000000000000000000000000
Supported: Geolocation
Call-Info: <sip:172.18.106.59:5060>;method="NOTIFY;Event=telephone-event;Duration=500"
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Session-Expires: 1800
P-Asserted-Identity: "Test User 1" <sip:9195551111@172.18.106.59>
Contact: <sip:9195551111@172.18.106.59:5060>;video;audio
Max-Forwards: 69
Content-Length: 864
Content-Type: application/sdp
SIP Request Line
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
To: <sip:+18775551234@172.18.159.231>
URI SIP Version
SIP Method
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 864
SIP Headers
INVITE sip:+18775551234@172.18.159.231:5060 SIP/2.0
To: <sip:+18775551234@172.18.159.231>
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 864
SIP Response
SIP/2.0 404 Not Found
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bKb5291d44b969a4
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Date: Mon, 16 Jan 2016 04:00:22 GMT
CSeq: 101 INVITE
Allow-Events: telephone-event
Session-ID: 747a0ead00105000a00074a02fc0cf3b;remote=52c41df700105000a00074a02fc0cf3b
Server: Cisco-SIPGateway/IOS-15.4.2.T
Reason: Q.850;cause=1
Content-Length: 0
SIP Response
SIP/2.0 404 Not Found Free-text Reason
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Response
Date: Mon, 16 Jan CodeGMT
2012 04:00:22
CSeq: 101 INVITE
Content-Length: 0
SIP Response
To: <sip:+18775551234@172.18.159.231>;tag=253488-726
Date: Mon, 16 Jan 2016 04:00:22 GMT
CSeq: 101 INVITE
Content-Length: 0
SIP Responses
Response Code Description Example
1xx Informational – Request Received and Continuing to Process 100 Trying

Request 180 Ringing
183 Session Progress
2xx Success – Action was successfully received, understood, and 200 OK
accepted 202 Acceptable
3xx Redirection – Another SIP Element needs to be contacted in order 300 Multiple Choices
to complete the request 301 Moved Permanently
302 Moved Temporarily
4xx Client Error – Request contains bad syntax or cannot be fulfilled at 401 Unauthorized
this server 404 Not Found
406 Not Acceptable
486 Busy Here
488 Not Acceptable Here
5xx Server Error – Server failed to fulfill an apparently valid request 503 Service Unavailable
6xx Global Failure – Request is invalid at any server 600 Busy Everywhere
603 Decline
Basic SIP Call Setup
Phone 1 Unified CM
INVITE
200 OK
ACK
Session Established
BYE
200 OK
Basic SIP Call Setup with B2BUA (Unified CM)
Phone 1 Unified CM Phone
SBC 2
(CUBE)
CUBE
INVITE
INVITE
200 OK
200 OK
ACK
ACK
Session Established
BYE
BYE
200 OK
200 OK
Basic SIP Call Setup with Unified CM and CUBE
SP SBC
Phone 1 Unified CM SBC (CUBE)
SIP
SP
CUBE SBC
INVITE
INVITE
INVITE
200 OK
200 OK
200 OK ACK
ACK
ACK
Session Established
BYE
BYE
BYE 200 OK
200 OK
200 OK
Media Negotiation
• SIP leverages the Session Description Protocol (SDP)
(RFC 4566/3266/2327) to communicate media information.
• SIP uses the offer/answer model described in RFC 3264 to negotiate media
using SDP
Offer/Answer Model (RFC 3264)
• One endpoint sends an offer SDP containing all the capabilities the endpoint
wishes to negotiate.
• SDP contains m lines for each media stream being negotiated (i.e. audio, video,
content channel, etc…)
• Receiving endpoint sends an answer SDP that contains the same or a subset of
capabilities received in the offer.
• Per RFC 3264, “For each "m=" line in the offer, there MUST be a corresponding
"m=“ line in the answer. The answer MUST contain exactly the same number of
"m=" lines as the offer.”
Session Description Protocol (SDP) - Offer
v=0
o=Cisco-SIPUA 26964 0 IN IP4 172.18.159.152
s=SIP Call
t=0 0
m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 172.18.159.152
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:102 L16/16000
a=rtpmap:9 G722/8000
a=rtpmap:116 iLBC/8000
a=fmtp:116 mode=20
a=rtpmap:124 ISAC/16000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv
m=video 25466 RTP/AVP 97
c=IN IP4 172.18.159.152
b=TIAS:1000000
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801E
a=recvonly
Session Description Protocol (SDP) - Answer
v=0
o=CiscoSystemsCCM-SIP 2000 1 IN IP4 172.18.106.59
s=SIP Call
c=IN IP4 172.18.159.152
t=0 0
m=audio 30308 RTP/AVP 0 101
a=ptime:20
a=fmtp:101 0-15
Media Negotiation – Early Offer and Delayed Offer
• Initiator of the call can send SDP offer in the INVITE – this is called an Early
Offer (EO)
• Receiving endpoint can send the SDP offer in a response if the INVITE did not
contain an offer – this is called a Delayed Offer (DO)
• For Early Offer, the answer is sent in a response (usually 200 OK).
• For Delayed Offer, the answer is typically sent in the ACK.
Early Offer
Phone 1 Unified CM
INVITE with SDP - Offer
200 OK with SDP - Answer
ACK (no SDP)
Session Established
BYE
200 OK
Delayed Offer
Phone 1 Unified CM
INVITE (no SDP)
200 OK with SDP - Offer
ACK with SDP - Answer
Session Established
BYE
200 OK
Early Media
• Delayed Offer calls do not set up media until the 200 OK (call is answered)
• If media is required prior to the call being connected, SIP has provisions for
Early Media
• With Early Media on a Delayed Offer call, the offer comes from the terminating
side in a provisional response (e.g. 183 Session Progress)
• Originating side sends SDP Answer in a PRACK message (defined in RFC
3262)
Early Media
Phone 1 Unified CM
INVITE (no SDP)
183 Session Progress with SDP - Offer
PRACK with SDP - Answer
Media Stream Established

200 OK (PRACK)
200 OK (INVITE) w/ SDP (should be same as answer)
ACK
Session Established
BYE
200 OK
Media Re-negotiation
Re-INVITE
• Either UA involved in a call can re-INVITE an existing dialog to re-negotiate
parameters for the call.
• Cannot re-INVITE until any previous INVITE messages have received a final
response.
• UPDATE method can also be used to re-negotiate prior to a final response.
Re-INVITE
INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901f9c72c19221
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=15462272~0d0d25d7-4931-4a07-83c6-b82e2c213ca7-45545776
To: <sip:89915644@172.18.106.59>;tag=0022bdd6843100702aae8e5b-4be253be
Date: Wed, 11 Jan 2016 03:08:51 GMT
Call-ID: 8c045780-f0c1fd34-8d838f-3b6a12ac@172.18.106.59
Min-SE: 1800
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY
CSeq: 104 INVITE
Max-Forwards: 70
Expires: 180
Allow-Events: presence
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= Authenticated; orientation= from; gci= 2-231448; call-instance= 2
Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=calling;screen=yes;privacy=off
Contact: <sip:89915644@172.18.106.59:5061;transport=tls>
Content-Length: 489
Re-INVITE – Stopping a Media Session
v=0
s=SIP Call
c=IN IP4 0.0.0.0
t=0 0
m=audio 19594 RTP/SAVP 9 101
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=ptime:20
a=inactive
a=fmtp:101 0-15
b=TIAS:1000000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=inactive
a=mid:227796888
Re-INVITE – Delayed Offer to Re-establish Media Stream
INVITE sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
Date: Wed, 11 Jan 2016 03:08:52 GMT
Min-SE: 1800
CSeq: 106 INVITE
Max-Forwards: 70
Expires: 180
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= from; gci= 2-231448; call-instance= 2
Content-Length: 0
Re-INVITE – Offer in 200 OK
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fac34c0fb1b
Date: Wed, 11 Jan 2016 03:08:52 GMT
CSeq: 106 INVITE
Server: Cisco-8865/11.5.1
Contact: <sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "Paul Giralt" <sip:89915644@172.18.106.59>;party=called;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-
control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.2.0,X-cisco-xsi-8.5.1
Allow-Events: kpml,dialog
Recv-Info: conference
Recv-Info: x-cisco-conference
Content-Length: 788
Content-Disposition: session;handling=optional
Re-INVITE – Offer in 200 OK
v=0
s=SIP Call
t=0 0
m=audio 32518 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 10.116.101.41
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:18 G729/8000
a=rtpmap:102 L16/16000
a=fmtp:101 0-15
a=sendrecv
m=video 17614 RTP/AVP 126 97
c=IN IP4 10.116.101.41
b=TIAS:2500000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801F;packetization-mode=1;level-asymmetry-allowed=1
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801F;packetization-mode=0;level-asymmetry-allowed=1
a=sendrecv
Re-INVITE – Answer in ACK
ACK sip:dbe40e44-0dfe-45f1-bd7f-e652098ca344@10.116.101.41:49833;transport=tls SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK901fb064465a06
Date: Wed, 11 Jan 2016 03:08:52 GMT
Max-Forwards: 70
CSeq: 106 ACK
Content-Length: 446
Re-INVITE – Answer in ACK – Decline Video Support
v=0
s=SIP Call
t=0 0
m=audio 4000 RTP/SAVP 0
c=IN IP4 172.18.106.58
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=ptime:20
a=sendonly
c=IN IP4 10.116.101.50
b=TIAS:1000000
a=rtpmap:126 H264/90000
a=fmtp:126 profile-level-id=42801E;packetization-mode=1;level-asymmetry-allowed=1
a=mid:227796888
DTMF Relay
• 3 Methods for passing DTMF digits over a SIP network:
• RFC 2833
• SIP NOTIFY
• SIP Keypad Markup Language (KPML)
DTMF Relay
RFC 2833
• Digits are passed in the RTP stream with a unique payload type
• Capability is negotiated in SDP like any other codec
Offer Answer
m=audio 30414 RTP/AVP 0 8 116 18 100 101 m=audio 17236 RTP/AVP 0 101
c=IN IP4 172.18.106.231 a=rtpmap:0 PCMU/8000
a=rtpmap:0 PCMU/8000 a=ptime:20
a=rtpmap:8 PCMA/8000 a=rtpmap:101 telephone-event/8000
a=rtpmap:116 iLBC/8000 a=fmtp:101 0-15
a=fmtp:116 mode=20
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:100 X-NSE/800
a=fmtp:100 192-194
a=fmtp:101 0-16
DTMF Relay
SIP NOTIFY
• Passes DTMF information in a SIP NOTIFY message telephone-event Event
• Negotiated in Call-Info header
“Offer”
INVITE sip:+19195553333@172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434
From: "Paul Giralt" <sip:9195551234@172.18.106.59>;tag=14902469~0d0d25d7-4931-4a07-83c6
To: <sip:+19195553333@172.18.106.231>
Date: Mon, 13 May 2016 14:48:00 GMT
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
... snip ...
Call-Info: <urn:x-cisco-remotecc:callinfo>;x-cisco-video-traffic-class=DESKTOP
... snip ...
Max-Forwards: 69
Content-Length: 0
DTMF Relay
SIP NOTIFY
“Answer”
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK9843c455840434
To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
... snip ...
Call-Info: <sip:172.18.106.231:5060>;method="NOTIFY;Event=telephone-event;Duration=500”
... snip ...
Content-Length: 601
DTMF Relay
SIP NOTIFY
• Digits passed in payload of a NOTIFY message
NOTIFY sip:172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK98443140152a0a
To: <sip:+19195553333@172.18.106.231>;tag=4363A830-17FC
Call-ID: 1a189580-1901fd20-962c99-3b6a12ac@172.18.106.59
CSeq: 104 NOTIFY
Max-Forwards: 70
Date: Mon, 13 May 2016 14:48:11 GMT
Event: telephone-event
Subscription-State: active
Contact: <sip:172.18.106.59:5060>
P-Asserted-Identity: "Paul Giralt" <sip:9195551234@172.18.106.59>
Content-Type: audio/telephone-event
Content-Length: 4
.d
DTMF Relay
SIP KPML
• Passes DTMF information in a SIP NOTIFY message kpml Event
• Capability advertised in Allow-Events – uses SUBSCRIBE message to subscribe

“Offer”
INVITE sip:+19195554444@172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4
To: <sip:+19195554444@172.18.106.231>
Date: Mon, 13 May 2016 15:05:24 GMT
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
... snip ...
... snip ...
Max-Forwards: 69
Content-Length: 0
DTMF Relay
SIP KPML
“Answer”
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986efd6c4e51e4
To: <sip:+19195554444@172.18.106.231>;tag=437394E8-2E1
Date: Mon, 13 May 2016 15:05:26 GMT
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO
Allow-Events: kpml, telephone-event
Remote-Party-ID: <sip:9196247285@172.18.106.231>;party=called;screen=no;privacy=off
Contact: <sip:+19196247285@172.18.106.231:5060>
Supported: replaces
Require: timer
Session-Expires: 18000;refresher=uac
Content-Type: multipart/mixed;boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 600
DTMF Relay
SIP KPML
Subscribe to KPML
SUBSCRIBE sip:9195554444@172.18.106.59:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.231:5060;branch=z9hG4bKBAE27139E
From: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1
To: "Paul Giralt" <sip:9195554444@172.18.106.59>;tag=14918970~0d0d25d7-4931-4a07-83c6
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 101 SUBSCRIBE
Max-Forwards: 70
User-Agent: Cisco-SIPGateway/IOS-15.2.4.M3
Event: kpml
Expires: 7200
Contact: <sip:172.18.106.231:5060>
Content-Type: application/kpml-request+xml
Content-Length: 327
<?xml version="1.0" encoding="UTF-8"?><kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request
kpml-request.xsd" version="1.0"><pattern persist="persist"><regex tag="dtmf">[x*#ABCD]</regex></pattern></kpml-
request>
DTMF Relay
SIP KPML
Send a Digit
NOTIFY sip:172.18.106.231:5060 SIP/2.0
Via: SIP/2.0/UDP 172.18.106.59:5060;branch=z9hG4bK986f73662cca3b
To: <sip:+19195551234@172.18.106.231>;tag=437394E8-2E1
Call-ID: 885e5780-19110134-96567f-3b6a12ac@172.18.106.59
CSeq: 104 NOTIFY
Max-Forwards: 70
Event: kpml
Subscription-State: active;expires=7197
Contact: <sip:9195554444@172.18.106.59:5060>
Content-Type: application/kpml-response+xml
Content-Length: 336
<?xml version="1.0" encoding="UTF-8" ?>

<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" xmlns:xsi="http://www.w3.org/2001/XMLSchema-
instance" xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-response kpml-response.xsd" code="200" digits="1"
forced_flush="false" suppressed="false" tag="dtmf" text="Success" version="1.0"/>
SIP Session-ID (RFC 7989)
• Session-ID Header carries an end-to-end session identifier
• Allows you to track a call as it traverses through various SIP systems
Session-ID: 65596d4800105000a00074a02fc0d796;remote=747a0ead00105000a00074a02fc0cf3b
Local UUID Remote UUID
• Session Identifier represented as {A,B} referring to {local,remote} UUIDs

• {A,B} is equivalent to {B,A}
SIP Call with Session-ID Headers
Phone 1 Unified CM Phone 2 Phone 3
INVITE {A,N}
INVITE {A,N}
100 Trying {N,A}
100 Trying {B,A}
200 OK {B,A}
200 OK {B,A}
ACK {A,B}
ACK {A,B}
Session Established
REFER {B,A}
200 OK {A,B}
SIP Call with Session-ID Headers
Phone 1 Unified CM Phone 2 Phone 3
INVITE {A,N}
200 OK {C,A}
re-INVITE {C,A}
200 OK {A,C}
ACK {A,C}
Session Established
BYE {A,B}
200 OK {B,A}
SIP Session-ID Support
• Current Support:
• Unified CM 11.0 and later
• Jabber 11.5 and later
• 78XX/88XX Endpoints 11.0 and later
• DX-series 10.2(5) and later (not CE-software )
• CUBE 15.6(2)T
• CVP 11.5
• Planned Upcoming Support
• VCS / Expressway – X8.10
• DX & MX-series on CE software
• Cisco Spark
Troubleshooting Tools
SIP Troubleshooting Tools
• Unified CM / SME Tools:
• Real Time Monitoring Tool / Session Trace
• TranslatorX
• IOS (CUBE) and VCS Troubleshooting Tool:

• TranslatorX
• Wireshark
RTMT Session Trace Tool
Session Trace Features
• Allows you to search for a call based on calling or called number
• Does not depend on Call Detail Records (uses calllogs file)
• Session trace only traces SIP sessions (no SCCP, H.323, or MGCP)
• Can display raw SIP messages
• Uses correlation tags to include all call legs related to the call selected
Call Flow Diagram
Click on the message in the call flow diagram to see the actual message
TranslatorX Tool
Features
• Parses through Unified CM SDI/SDL Trace Files (and CUBE, CUSP, VCS/Expressway,
Jabber 10.x+)
• Drag-and-Drop support for .txt as well as .gz files.
• Decodes SIP, SCCP, H.323, MGCP, Q.Sig, and ISDN Q.931 messages
• Call List based on CDR information in the Traces
• Can generate multi-protocol ladder diagrams
• Sophisticated filtering capabilities (including Session-ID Support)
• Download for Windows, Mac OS X, and Linux from: http://translatorx.org/
• NOTE: Do not call TAC for support on TranslatorX (although many TAC engineers use it
so feel free to mention you’re using it)
TranslatorX Tool
TranslatorX Tool – Call List Window
TranslatorX Tool – Call List Filtering
Double-click for complete

Call Detail Record
TranslatorX Tool – CDR View
TranslatorX Tool – CDR View
TranslatorX Tool – Generating Filters
Select a Call and click

“Generate Filter” button
TranslatorX Tool - Filters
TranslatorX Tool – Call Flow Diagram
TranslatorX Tool – Call Flow Diagram
Wireshark
Open Source network packet capture and analysis tool
Available at http://www.wireshark.org
Available for Windows, Mac OS X, and UNIX/Linux
Provides VoIP Call and SIP analysis
Wireshark
Wireshark
VoIP Call Analysis
Wireshark
VoIP Call Ladder Diagram
Wireshark
How to Gather a Trace?
• Unified CM, VCS, and IOS provide a mechanism to gather a packet capture
• Will be covered later
Unified CM Tracing Configuration
Unified CM Trace Configuration
• SIP messaging in Unified CM is written to the SDL trace file when appropriate
trace levels are set (SDI trace in for pre-9.0)
• Configured from Cisco Unified Serviceability > Trace > Configuration or by
using Analysis Manager
• Unified CM 9.0 and later combines SDI and SDL traces into the SDL traces
• Unified CM 9.0 and later fresh install and later default to detailed tracing – no
need to configure traces.
Select the
Server
Select Service
Group
Select the Service on

Which Trace Needs to
Be Enabled
1. Press Set Default
Updates All Servers in

this cluster with
these settings
2. Set to Detailed
Trace Collection
Various Ways to Collect Trace Files
• RTMT Collect Files Recommended
• RTMT Analysis Manager

• RTMT Remote Browse
• RTMT Query Wizard
• OS CLI (file get or file tail)
• file tail activelog cm/trace/ccm/sdl recent
Gathering a Packet Capture from Unified CM
Use the Platform CLI command ‘utils network capture’
admin:utils network capture ?
Syntax:
utils network capture [options]
options optional page, numeric, file fname, count num, size bytes, src addr, dest
addr, port num, host protocol addr
admin:utils network capture file capturefile count 100000 size ALL host ip 10.1.1.1
Executing command with options:
size=ALL count=100000 interface=eth0
src= dest= port=
ip=10.1.1.1
admin:file list activelog platform/cli

capturefile.cap
dir count = 0, file count = 1
admin:file get activelog platform/cli/capturefile.cap

Please wait while the system is gathering files info ...done.
Sub-directories were not traversed.
Number of files affected: 1
Total size in Bytes: 24
Total size in Kbytes: 0.0234375
Would you like to proceed [y/n]? y
VCS / Expressway Tracing
Configuration
VCS / Expressway Trace Configuration
• VCS Control / VCS Expressway / Expressway-C / Expressway-E can log SIP
messages to a diagnostic log file.
• To enable, navigate to Maintenance >
Diagnostics > Diagnostic logging
Select this if you want

to get a Wireshark
capture
Click Start new log

Click OK to Confirm
Click Stop logging after

reproducing your problem
Click to Download the log

and tcpdump (for Wireshark)
Cisco Unified Border Element
(CUBE) Trace Configuration
CUBE Debugging
• CUBE / IOS Tools:
• IOS debugs
• IOS show commands
• Event Trace
• Packet export
CUBE Debugging
• When debugging in IOS, configure logging buffered to a fairly large value (based
on available memory)
• Disable logging to the console with command ‘no logging console’
• Enable timestamps for debugs
• Make sure router has NTP enabled
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
logging buffered 10000000

no logging console
clock timezone EST -5 0

clock summer-time EDT recurring
ntp server 10.14.1.1
CUBE Debugging
Various SIP debugs available
CUBE#debug ccsip ?
all Enable all SIP debugging traces
calls Enable CCSIP SPI calls debugging trace
dhcp Enable SIP-DHCP debugging trace
error Enable SIP error debugging trace
events Enable SIP events debugging trace
function Enable SIP function debugging trace
info Enable SIP info debugging trace
media Enable SIP media debugging trace
messages Enable CCSIP SPI messages debugging trace
non-call Enable Non-Call-Context trace (OPTIONS, SUBSCRIBE etc)
preauth Enable SIP preauth debugging traces
states Enable CCSIP SPI states debugging trace
translate Enable SIP translation debugging trace
transport Enable SIP transport debugging traces
verbose Enable verbose mode
CUBE Debugging
Sample ‘debug ccsip messages’
Jan 12 03:14:43.102: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:+19193922900@10.14.1.10:5060 SIP/2.0
Via: SIP/2.0/TCP 172.18.106.59:5060;branch=z9hG4bK978d2e8df73dc
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=16218435~-b82e2c213ca7-45552048
To: <sip:+19193922900@10.14.1.10>
Date: Thu, 12 Jan 2012 03:09:42 GMT
Call-ID: ddc4e480-f0e14ef6-94ca5c-3b6a12ac@172.18.106.59
Supported: 100rel,timer,resource-priority,replaces
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Supported: X-cisco-srtp-fallback
Cisco-Guid: 3720668288-0000065536-0000015564-0996807340
Contact: <sip:89915644@172.18.106.59:5060;transport=tcp>;video;audio
Max-Forwards: 69
Content-Length: 0
CUBE Debugging
• Other generic voice debugs can be useful as well:
• debug voice ccapi inout
• debug voice dialpeer
• debug voice rtp session dtmf-relay
• debug voice rtp session named-event (for any RFC 2833 packets)
Cisco Unified Border Element Basic Call Flow
• Incoming VoIP setup message from originating endpoint
• This matches inbound VoIP dial peer 1 for characteristics such as codec, VAD, DTMF
method, protocol, etc.
• Match the called number to outbound VoIP dial peer 2
voice service voip
• Outgoing VoIP setup message allow-connections sip to sip
Originating Terminating
Endpoint Endpoint
Incoming VoIP Call Outgoing VoIP Call
CUBE
dial-peer voice 1 voip dial-peer voice 2 voip

destination-pattern 1000 destination-pattern 2000
incoming called-number .T session protocol sipv2
session protocol sipv2 session target ipv4:192.168.12.25
session target ipv4:192.168.10.50 dtmf-relay rtp-nte
dtmf-relay rtp-nte sip-kpml codec g711ulaw
codec g711ulaw
CUBE show Commands
• show call active voice [brief] shows state of currently active calls
0 : 2807 92135710ms.1 (23:55:20.115 EST Mon Jan 16 2016) +1770 pid:1 Answer 89915644 active
dur 00:00:14 tx:743/14860 rx:718/14360 dscp:0 media:0 audio tos:0xB8 video tos:0x0
IP 10.116.101.41:23412 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g729r8 TextRelay: off
media inactive detected:n media contrl rcvd:n/a timestamp:n/a
long duration call detected:n long duration call duration:n/a timestamp:n/a
0 : 2808 92135720ms.1 (23:55:20.125 EST Mon Jan 16 2016) +1750 pid:100 Originate 9193922900 active
dur 00:00:14 tx:718/14360 rx:755/15100 dscp:0 media:0 audio tos:0xB8 video tos:0x0
IP 172.30.206.164:10076 SRTP: off rtt:0ms pl:0/0ms lost:0/0/0 delay:0/0/0ms g729r8 TextRelay: off
media inactive detected:n media contrl rcvd:n/a timestamp:n/a
long duration call detected:n long duration call duration:n/a timestamp:n/a
Telephony call-legs: 0
SIP call-legs: 2
H323 call-legs: 0
Call agent controlled call-legs: 0
SCCP call-legs: 0
Multicast call-legs: 0
Total call-legs: 2
CUBE show Commands
• show cube calls shows more specific CUBE-related call information and allows filtering
CUBE# show cube calls all ?
callID Display information matches callID
called-number Display information matches called number
calling-number Display information matches calling number
conf-id Display information matches conference ID
detail Display detail level information
fpi-cor Display information matches FPI Correlator
peer-callID Display information matches peer callID
peer-rtp-port Display information matches peer rtp-port number
rtp-port Display information matches rtp-port number
| Output modifiers
CUBE show Commands
CUBE#show cube calls all called-number 8008001180
called number: 8008001180 info are as the following:
=============================================================
=============================================================
Phone number 8008001180 has the following callID associated to it:
=============================================================
CallID: 1730781, calling number: 9195551234
============================================================
A total of 1 call legs associated to number: 8008001180
============================================================
CUBE show Commands
CUBE#show cube calls all callID 1730781
callid: 1730781 info are as the following:
=============================================================
SIP call leg info:
=============================================================
SIP CALL INFO of CCAPI callid 1730781
Call 1
SIP Call ID : 41669A03-D5611E5-8A6384B0-5DED4CDB@64.102.250.104
State of the call : STATE_ACTIVE (7)
Substate of the call : SUBSTATE_NONE (0)
Calling Number : 9195551234
Called Number : 8008001180
Called URI : sip:8008001180@208.70.21.21:5060
Bit Flags : 0xE04018 0x90000100 0x0
CC Call ID : 1730781
Source IP Address (Sig ): 64.102.250.104
Destn SIP Req Addr:Port : [208.70.21.21]:5060
Destn SIP Resp Addr:Port: [208.70.21.21]:5060
CUBE SIP Event Trace
• All events related to a call are put into buffers
• Can search for calls based on calling number, called number, or call ID
• Buffers can be automatically dumped to an FTP/TFTP server when calls end
• Available on CUBE(Ent) ASR release XE3.10 and later
• Available on CUBE(Ent) ISR release 15.3(3)M and later
1. Define events to be traced
CUBE(config)# monitor event-trace voip ccsip msg size 50
2. Enable event trace (will enable automatically on a reload)

CUBE# monitor event-trace voip ccsip msg ?
clear Clear the trace
disable Disable tracing
dump Dumps the event buffer into a file
enable Enable tracing
3. Configure automatic file uploads (optional)

CUBE(config)# monitor event-trace voip ccsip dump-file ftp://user:password@<ipaddr>/path/cube.txt
CUBE(config)# monitor event-trace voip ccsip dump all
Viewing event trace information
CUBE# monitor event-trace voip ccsip [msg | history] dump filter ? [pretty]
call-id Filter traces based on Internal Call Id
called-num Filter traces based on Called Number
calling-num Filter traces based on Calling Number
sip-call-id Filter traces based on SIP Call Id
CUBE# show monitor event-trace voip ccsip [msg | history] ?

all Show all the traces in current buffer
back Show trace from this far back in the past
clock Show trace from a specific clock time/date
filter Show Trace filter Options
from-boot Show trace from this many seconds after booting
latest Show latest trace events since last display
Viewing event trace information
CUBE# show monitor event-trace voip ccsip history filter calling-num 9195551234 latest
--------Cover buff----------
buffer-id = 2828 ccCallId = 305319 PeerCallId = 305320
Called-Number = +18045553456 Calling-Number = 9195551234 Sip-Call-Id =
20842180-2e012f98-167c899-3b6a12ac@172.18.106.59
sip_msgs: Enabled.. Total Traces logged = 18
--------------------------------
--------Cover buff----------
buffer-id = 2829 ccCallId = 305320 PeerCallId = 305319
Called-Number = 8045553456 Calling-Number = 9195551234 Sip-Call-Id = BC182C11-
82D611E3-BAACD07D-93FD9A72@64.102.250.104
sip_msgs: Enabled.. Total Traces logged = 12
--------------------------------
CUBE – IP Traffic Capture
Export Packet Data in PCAP Format
 IP Traffic Export feature allows export of packets on an interface
 Configuration:
ip traffic-export profile CUBE_Debug mode capture
bidirectional
incoming access-list 101
outgoing access-list 101
interface GigabitEthernet0/0
ip traffic-export apply CUBE_Debug size 10000000
• Usage:
traffic-export interface g0/0 start
traffic-export interface g0/0 stop
traffic-export interface g0/0 copy scp://10.1.1.1/capture.pcap
Case Studies
Case Study 1: Unable to Place a Call
Problem Description
• A user reports that every time they call (919) 555-1212, they get a message that
the call could not be completed as dialed
Use RTMT Session Trace
• Enter *5551212 into Called Number/URI field
• Set time and duration appropriately
• Search Finds two calls
• Double-click to see
message diagram
• Clearly shows the far-
end sends back a
404 Not Found
Troubleshoot Call on CUBE
• Enable SIP message debugs – debug ccsip messages
Jan 16 04:00:22.679: //-1/xxxxxxxxxxxx/SIP/Msg/ccsipDisplayMsg:
Received:
INVITE sip:+19195551212@10.14.1.10:5060 SIP/2.0
To: <sip:+19195551212@10.14.1.10>
Date: Mon, 16 Jan 2012 03:55:17 GMT
Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 3852191232-0000065536-0000018595-0996807340
Contact: <sip:89915644@172.18.106.59:5060>
Max-Forwards: 69
Content-Length: 0
Troubleshoot Call on CUBE
• Check to see if the number matches a valid dial peer
Jan 16 04:00:22.687: //98/E59BC6000000/SIP/Msg/ccsipDisplayMsg:
Sent:
From: "Paul Giralt" <sip:89915644@172.18.106.59>;tag=19210128~0d0d25d7-4931-4a07-83c6 b82e2c213ca7-45568313
To: <sip:+19195551212@10.14.1.10>;tag=253488-726
Date: Mon, 16 Jan 2012 04:00:22 GMT
Call-ID: e59bc600-f1319fa5-b1ea4a-3b6a12ac@172.18.106.59
CSeq: 101 INVITE
Content-Length: 0
CUBE#show dialplan number +19195551212
Macro Exp.: +19195551212
No match, result=-1
Case Study 2: Unable to Place a Call #2
Problem Description
• A user reports that every time they call 80010001, they get reorder (fast busy)
tone
• Enter *80010001 into Called Number/URI field
• Set time and duration appropriately

• Search Finds one call
• Trace shows
signaling from
both phone and to
destination SIP
trunk
• Receiving a 503
Service
Unavailable from
destination
SIP/2.0 503 Service Unavailable
Via: SIP/2.0/UDP 172.18.106.58:5060;branch=z9hG4bK34a0915e2c7a20
From: "Paul Giralt" <sip:89915644@172.18.106.58>;tag=5964355~0d0d25d7-4931-
4a07-83c6-b82e2c213ca7-44286097
To: <sip:80010001@10.81.98.203>;tag=932088316
Date: Sun, 07 Jun 2015 16:02:18 GMT
Call-ID: 9126a680-57416b0a-349ed0-3a6a12ac@172.18.106.58
CSeq: 101 INVITE
Warning: 399 collab-ccie-cm1a "Unable to find a device handler for the request
received on port 5060 from 172.18.106.58"
Content-Length: 0
Case Study 3: No One Answers the Phone
Problem Description
• A user reports that every time they call a specific phone number, no one
answers the call, but if they call from their cell phone, the call is answered
immediately every time.
• Calling phone is extension 89919236
• Called number is 1 877 288-8362
Collect Traces
• Problem is reproducible, so generate a test call and then collect traces.
Use TranslatorX to Analyze Traces
• Problem is reproducible, so generate a test call and then collect traces. Drag
and Drop folder into TranslatorX
• Try to find call in Call List
• Search for called party number
• Disable Filters
• Select the INVITE
• Filter by SIP Call ID (control/command – S)
03/29/2010 10:36:41.497 |//SIP/SIPUdp/wait_SdlSPISignal: Outgoing SIP UDP message to 172.18.159.231:[5060]:
INVITE sip:+18772888362@172.18.159.231:5060 SIP/2.0
From: "Test User 1" <sip:9194769236@172.18.106.59>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510543
To: <sip:+18772888362@172.18.159.231>
Date: Mon, 29 Mar 2010 14:36:41 GMT
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 0
• Where did the call originate? Try searching for the calling party number
• Select the INVITE
• Create New Filter (control/command-N)
• Filter by IP Address (control/command – I)
• Re-enable Filters
INVITE from IP Phone w/ SDP
03/29/2010 10:36:33.771 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index
2321 with 1717 bytes:
INVITE sip:9@172.18.106.59;user=phone SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1636ab61
From: "Test User 1" <sip:89919236@172.18.106.59>;tag=00260bd9669e07147bcb3aac-3cda8f0c
To: <sip:9@172.18.106.59;user=phone>
Call-ID: 00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152
Max-Forwards: 70
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
User-Agent: Cisco-CP9951/9.0.1
Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=tls>
Expires: 180
Accept: application/sdp
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "Test User 1" <sip:89919236@172.18.106.59>;party=calling;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-
service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-5.0.0,X-cisco-xsi-9.0.1
Allow-Events: kpml,dialog
Content-Length: 632
Content-Disposition: session;handling=optional
INVITE from IP Phone w/ SDP (continued)
v=0
s=SIP Call
t=0 0
m=audio 29254 RTP/SAVP 0 8 18 102 9 116 124 101
c=IN IP4 172.18.159.152
a=crypto:XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:102 L16/16000
a=fmtp:116 mode=20
a=fmtp:101 0-15
a=sendrecv
c=IN IP4 172.18.159.152
b=TIAS:1000000
a=rtpmap:97 H264/90000
a=fmtp:97 profile-level-id=42801E
a=recvonly
Unified CM Sends a 100 Trying
03/29/2010 10:36:33.773 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682 index 2321
SIP/2.0 100 Trying
To: <sip:9@172.18.106.59;user=phone>
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
Content-Length: 0
Unified CM Sends a REFER to Play Outside Dialtone
REFER sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf
From: <sip:89919236@172.18.106.59>;tag=2144536187
To: <sip:89919236@172.18.159.152>
Call-ID: 7747f400-bb01baf1-14685-3b6a12ac@172.18.106.59
CSeq: 101 REFER
Max-Forwards: 70
Expires: 0
Refer-To: cid:1234567890@172.18.106.59
Content-Id: <1234567890@172.18.106.59>
Require: norefersub
Content-Type: application/x-cisco-remotecc-request+xml
Referred-By: <sip:89919236@172.18.106.59>
Content-Length: 409
Unified CM Sends a REFER to play Outside Dialtone (continued)
<x-cisco-remotecc-request>
<playtonereq>
<dialogid>
<callid>00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152</callid>
<localtag>97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542</localtag>
<remotetag>00260bd9669e07147bcb3aac-3cda8f0c</remotetag>
</dialogid>
<tonetype>DtOutsideDialTone</tonetype>
<direction>user</direction>
</playtonereq>
</x-cisco-remotecc-request>
Unified CM Sends a SUBSCRIBE for KPML
SUBSCRIBE sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f
From: <sip:9@172.18.106.59>;tag=1976165806
To: <sip:89919236@172.18.159.152>
CSeq: 101 SUBSCRIBE
Date: Mon, 29 Mar 2010 14:36:33 GMT
Event: kpml; call-id=00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152; from-tag=00260bd9669e07147bcb3aac-3cda8f0c
Expires: 7200
Accept: application/kpml-response+xml
Max-Forwards: 70
Content-Type: application/kpml-request+xml
Content-Length: 424
<?xml version="1.0" encoding="UTF-8" ?>
<kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:ietf:params:xml:ns:kpml-request kpml-request.xsd" version="1.0">
<pattern criticaldigittimer="1000" extradigittimer="500" interdigittimer="10000" persist="persist">
<regex tag="Backspace OK">[x#*+]|bs</regex>
</pattern>
</kpml-request>
Phone Sends 200 OK for the REFER and SUBSCRIBE
03/29/2010 10:36:33.802 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321 with 453 bytes:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151511c5f04bf
From: <sip:89919236@172.18.106.59>;tag=2144536187
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07167c743311-343ee3af
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 REFER
Server: Cisco-CP9951/9.0.1
Contact: <sip:4a8a8f91-609e-d655-19ea-44eedcd7b0d6@172.18.159.152:51682;transport=TLS>
Content-Length: 0
03/29/2010 10:36:33.843 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index 2321 with 465 bytes:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK1515232b4e84f
From: <sip:9@172.18.106.59>;tag=1976165806
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 SUBSCRIBE
Expires: 7200
Content-Length: 0
IP Phone Unified CM CUBE
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
User Dials a ‘1’
03/29/2010 10:36:34.350 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682
index 2321 with 896 bytes:
NOTIFY sip:9@172.18.106.59:5061 SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK1cd529ba
To: <sip:9@172.18.106.59>;tag=1976165806
From: <sip:89919236@172.18.159.152>;tag=00260bd9669e07177ee0d51d-14f56f89
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 1001 NOTIFY
Event: kpml
Subscription-State: active; expires=7200
Max-Forwards: 70
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 209
Content-Disposition: session;handling=required
<?xml version="1.0" encoding="UTF-8"?>
<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" version="1.0" code="200" text="OK" suppressed="false"
forced_flush="false" digits="1" tag="Backspace OK"/>
Unified CM Replies to NOTIFY With a 200 OK
03/29/2010 10:36:34.352 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682 index
2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1001 NOTIFY
Content-Length: 0
Unified CM Replies Sends a REFER to Disable Outside Dialtone
03/29/2010 10:36:34.353 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port 51682
REFER sip:89919236@172.18.159.152:51682 SIP/2.0
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0
From: <sip:89919236@172.18.106.59>;tag=1574166193
To: <sip:89919236@172.18.159.152>
Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59
CSeq: 101 REFER
Max-Forwards: 70
Expires: 0
Refer-To: cid:1234567890@172.18.106.59
Content-Id: <1234567890@172.18.106.59>
Require: norefersub
Content-Type: application/x-cisco-remotecc-request+xml
Referred-By: <sip:89919236@172.18.106.59>
Content-Length: 401
<x-cisco-remotecc-request>
<playtonereq>
<dialogid>
<callid>00260bd9-669e000b-588c0c2b-2193e2a3@172.18.159.152</callid>
<localtag>97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542</localtag>
<remotetag>00260bd9669e07147bcb3aac-3cda8f0c</remotetag>
</dialogid>
<tonetype>Dt_NoTone</tonetype>
<direction>user</direction>
</playtonereq>
</x-cisco-remotecc-request>
Phone Replies With 200 OK to REFER
03/29/2010 10:36:34.402 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682 index
2321 with 453 bytes:
SIP/2.0 200 OK
Via: SIP/2.0/TLS 172.18.106.59:5061;branch=z9hG4bK151536ea86ab0
From: <sip:89919236@172.18.106.59>;tag=1574166193
To: <sip:89919236@172.18.159.152>;tag=00260bd9669e07184b08b96b-796ab86f
Call-ID: 77e08a80-bb01baf2-14687-3b6a12ac@172.18.106.59
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 REFER
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
User Dials a ‘8’
03/29/2010 10:36:34.944 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on port 51682
index 2321 with 896 bytes:
NOTIFY sip:9@172.18.106.59:5061 SIP/2.0
Via: SIP/2.0/TLS 172.18.159.152:51682;branch=z9hG4bK647d03c1
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1002 NOTIFY
Event: kpml
Subscription-State: active; expires=7195
Max-Forwards: 70
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE
Content-Length: 209
<?xml version="1.0" encoding="UTF-8"?>
<kpml-response xmlns="urn:ietf:params:xml:ns:kpml-response" version="1.0" code="200" text="OK" suppressed="false"
forced_flush="false" digits="8" tag="Backspace OK"/>
Unified CM Replies to NOTIFY With a 200 OK
2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59>;tag=1976165806
Date: Mon, 29 Mar 2010 14:36:34 GMT
CSeq: 1001 NOTIFY
Content-Length: 0
User Dials Remaining Digits
Case Study 3:
IP Phone
No One Answers
Unified CM
the Phone
CUBE
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
CUCM Sends an INVITE to the CUBE
03/29/2010 10:36:41.497 |//SIP/SIPUdp/wait_SdlSPISignal: Outgoing SIP UDP message to 172.18.159.231:[5060]:
INVITE sip:+18772888362@172.18.159.231:5060 SIP/2.0
To: <sip:+18772888362@172.18.159.231>
Date: Mon, 29 Mar 2010 14:36:41 GMT
Min-SE: 1800
CSeq: 101 INVITE
Expires: 180
Cisco-Guid: 2081204224-3137452793-0000000466-0996807340
Max-Forwards: 69
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
200 OK (SUBSCRIBE) INVITE
CUBE Replies With a 183 Session Progress W/ SDP
03/29/2010 10:36:42.324 |//SIP/SIPUdp/wait_UdpDataInd: Incoming SIP UDP message size 1568 from 172.18.159.231:[5060]:
SIP/2.0 183 Session Progress
To: <sip:+18772888362@172.18.159.231>;tag=DE1EFF8-0
Date: Mon, 29 Mar 2010 14:37:23 GMT
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO, REGISTER
Remote-Party-ID: <sip:+18772888362@172.18.159.231>;party=called;screen=no;privacy=off
Contact: <sip:+18772888362@172.18.159.231:5060>
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-12.x
Content-Type: multipart/mixed;boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 788
--uniqueBoundary
CUBE Replies With a 183 Session Progress W/ SDP
v=0
o=CiscoSystemsSIP-GW-UserAgent 0 7954 IN IP4 172.18.159.231
s=SIP Call
c=IN IP4 172.18.159.231
t=0 0
m=audio 27980 RTP/AVP 0 8 116 18 100 101
c=IN IP4 172.18.159.231
a=fmtp:116 mode=20
a=rtpmap:18 G729/8000
a=fmtp:18 annexb=no
a=rtpmap:100 X-NSE/8000
a=fmtp:100 192-194
a=fmtp:101 0-16
--uniqueBoundary
Content-Type: application/x-q931
Content-Disposition: signal;handling=optional
Content-Length: 11
Unified CM Sends a 180 Ringing to the IP Phone
2321
SIP/2.0 180 Ringing
To: <sip:9@172.18.106.59;user=phone>;tag=97903bc0-a3de-4a15-ba27-44c81fe3adcd-45510542
Date: Mon, 29 Mar 2010 14:36:33 GMT
CSeq: 101 INVITE
Call-Info: <urn:x-cisco-remotecc:callinfo>; security= NotAuthenticated; orientation= to; ui-state= ringout; gci= 2-305505; call-
instance= 1
Send-Info: conference
Remote-Party-ID: <sip:+18772888362@172.18.106.59>;party=called;screen=no;privacy=off
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
100 Trying
180 Ringing
• Phone Keeps Ringing
• Timestamps Jump from 10:36:42 to 10:37:32
• No SIP Signaling for 50 seconds
Phone Sends a CANCEL
03/29/2010 10:37:32.934 |//SIP/SIPTcp/wait_SdlReadRsp: Incoming SIP TCP message from 172.18.159.152 on
port 51682 index 2321 with 422 bytes:
CANCEL sip:9@172.18.106.59;user=phone SIP/2.0
To: <sip:9@172.18.106.59;user=phone>
Max-Forwards: 70
Date: Mon, 29 Mar 2010 14:37:32 GMT
CSeq: 101 CANCEL
User-Agent: Cisco-CP9951/9.0.1
Content-Length: 0
Unified CM Sends a 200 OK for the CANCEL
03/29/2010 10:37:32.935 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port

51682 index 2321
SIP/2.0 200 OK
To: <sip:9@172.18.106.59;user=phone>
Date: Mon, 29 Mar 2010 14:37:32 GMT
CSeq: 101 CANCEL
Content-Length: 0
(172.18.159.152) (172.18.106.59) (172.18.159.231)
NOTIFY
200 OK (NOTIFY)
CANCEL
200 OK (CANCEL)
CANCEL
487 Request Cancelled
200 OK (CANCEL)
487 Request Cancelled
ACK
ACK
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER
183 Session Progress (w/ ANSWER)

183 Session Progress (w/ OFFER)
180 Ringing (no SDP)
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER

??? (w/ ANSWER) ??? (w/ ANSWER)
SP SBC
SIP
SP
CUBE SBC
INVITE (w/ OFFER)
INVITE (no SDP)
INVITE w/ OFFER

183 Session Progress (w/ ANSWER) PRACK (w/ ANSWER)
• How do we get the gateway to cut through audio on the 183 Session Progress message?
• RFC 3262: Reliability of Provisional Responses in the Session Initiation Protocol (SIP)
• Provides a way to acknowledge the 183 Session Progress message – PRACK
• Unified CM parameter “SIP Rel1XX Options” Disabled
•Send PRACK for all 1xx Messages
•Send PRACK if 1xx Contains SDP
cube(conf-serv-sip)#rel1xx ?
disable Disables reliable-provisional responses
require Requires reliable-provisional responses
supported Supports reliable-provisional responses
Unified CM SIP Profile Configuration
(172.18.159.152) (172.18.106.59) (172.18.159.231)
INVITE
100 Trying
REFER
SUBSCRIBE
200 OK (REFER)
200 OK (SUBSCRIBE)
NOTIFY
200 OK (NOTIFY)
REFER
200 OK (REFER)
NOTIFY
200 OK (NOTIFY)
NOTIFY / 200 OK
Repeats 10 Times
SUBSCRIBE
100 Trying
183 Session Progress PRACK
Case Study 4: Calls to Lync Clients Fail
• When a user dials a Lync client from a video-enabled Cisco 9951 phone, the
call fails. Call is from 58574 to 60051.
Case Study 4: Live Demo
M = {}
function M.outbound_INVITE(msg)
local contactHeader = msg:getHeader("Contact”)
if contactHeader then
local newContactHeader = string.gsub(contactHeader, ";video;audio;video", "")
msg:modifyHeader("Contact", newContactHeader)
end
end
return M
• For more information:
• Visit http://developer.cisco.com/web/sip/documentation to download the SIP
Normalization and Transparency Developer Guide
Case Study 5: Live Demo
Complete Your Online
Session Evaluation
• Give us your feedback to be
entered into a Daily Survey
Drawing. A daily winner will
receive a $750 gift card.
• Complete your session surveys
through the Cisco Live mobile
app or on www.CiscoLive.com/us.
Don’t forget: Cisco Live sessions will be

available for viewing on demand after the
event at www.CiscoLive.com/Online.
Continue Your Education
• Demos in the Cisco campus
• Walk-in Self-Paced Labs
• Lunch & Learn
• Meet the Engineer 1:1 meetings
• Related sessions
Q&A
Thank you
Collaboration Cisco Education Offerings
Course Description Cisco Certification
CCIE Collaboration Advanced Workshop (CIEC) Gain expert-level skills to integrate, configure, and troubleshoot complex CCIE® Collaboration
collaboration networks
Implementing Cisco Collaboration Applications Understand how to implement the full suite of Cisco collaboration CCNP® Collaboration
(CAPPS) applications including Jabber, Cisco Unified IM and Presence, and Cisco
Unity Connection.
Implementing Cisco IP Telephony and Video Learn how to implement Cisco Unified Communications Manager, CUBE, CCNP® Collaboration
Part 1 (CIPTV1) and audio and videoconferences in a single-site voice and video network.
Implementing Cisco IP Telephony and Video Obtain the skills to implement Cisco Unified Communications Manager in a
Part 2 (CIPTV2) modern, multisite collaboration environment.
Troubleshooting Cisco IP Telephony and Video Troubleshoot complex integrated voice and video infrastructures
(CTCOLLAB)
Implementing Cisco Collaboration Devices Acquire a basic understanding of collaboration technologies like Cisco Call CCNA® Collaboration
(CICD) Manager and Cisco Unified Communications Manager.
Implementing Cisco Video Network Devices Learn how to evaluate requirements for video deployments, and implement
(CIVND) Cisco Collaboration endpoints in converged Cisco infrastructures.
For more details, please visit: http://learningnetwork.cisco.com

Questions? Visit the Learning@Cisco Booth

Troubleshooting SIP - Paul Giralt (v1)

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Troubleshooting SIP - Paul Giralt (v1)

Uploaded by

Copyright:

Available Formats

with Cisco Unified

Cisco Spark spaces will be cs.co/clus17/#BRKUCC-2932

1xx Informational – Request Received and Continuing to Process 100 Trying

INVITE with SDP - Offer

200 OK with SDP - Answer

ACK (no SDP)

INVITE (no SDP)

200 OK with SDP - Offer

ACK with SDP - Answer

INVITE (no SDP)

183 Session Progress with SDP - Offer

PRACK with SDP - Answer

Media Stream Established

200 OK (INVITE) w/ SDP (should be same as answer)

• Capability advertised in Allow-Events – uses SUBSCRIBE message to subscribe

<?xml version="1.0" encoding="UTF-8"?><kpml-request xmlns="urn:ietf:params:xml:ns:kpml-request"

<?xml version="1.0" encoding="UTF-8" ?>

• Session Identifier represented as {A,B} referring to {local,remote} UUIDs

• IOS (CUBE) and VCS Troubleshooting Tool:

Double-click for complete

Select a Call and click

Select the Service on

1. Press Set Default

Updates All Servers in

• RTMT Analysis Manager

admin:file list activelog platform/cli

admin:file get activelog platform/cli/capturefile.cap

Select this if you want

Click Start new log

Click Stop logging after

Click to Download the log

logging buffered 10000000

clock timezone EST -5 0

ntp server 10.14.1.1

dial-peer voice 1 voip dial-peer voice 2 voip

2. Enable event trace (will enable automatically on a reload)

3. Configure automatic file uploads (optional)

CUBE# show monitor event-trace voip ccsip [msg | history] ?

• Set time and duration appropriately

03/29/2010 10:37:32.935 |//SIP/SIPTcp/wait_SdlSPISignal: Outgoing SIP TCP message to 172.18.159.152 on port

183 Session Progress (w/ ANSWER)

183 Session Progress (w/ ANSWER)

??? (w/ ANSWER) ??? (w/ ANSWER)

183 Session Progress (w/ ANSWER)

183 Session Progress (w/ ANSWER) PRACK (w/ ANSWER)

Don’t forget: Cisco Live sessions will be

For more details, please visit: http://learningnetwork.cisco.com

You might also like