We are using multiple phone models within our environment. We use SCCP as our signalling method. We are using Call Manager version: 7.1.3.33039-1. We were experiencing dropped calls in one of our remote offices and started to troubleshoot using Wireshark and VQManager from ManageEngine. Neither tool is recognizing the VoIP calls properly due to the SCCP packets. For some reason the header on the packets to this office are not the same as the headers to other offices. An example SCCP packet (only the SCCP payload, no tcp, IP or MAC headers inclulded) looks like this:
14:00:00:00:12:00:00:00:85:00:00:00:01:00:00:00:01:00:00:00:00:00:00:00:00:00:00:00
The problem appears to be the 5th byte. This looks to be the start of the reserved portion of the SCCP header and in most of our other traffic, it's all zeros. For some reason, this one (and all similar packets to this site) starts with Hex 12, which causes wireshark and other tools to not recognize the packet properly as SCCP signalling, although looking at it I can see it's a set ringer packet due to the hex 85 starting the SCCP data part of the packet.
Is this a new implementation of SCCP? Is there a CallManager setting to set the reserved section to all zeros? Because this is defintely causing troubleshooting issues, and might even be the cause of our dropped calls.
This packet with the 12 in the reserved field is between Call Manager and a 7942G phone running SCCP42.9-0-3S. It would appear that all packets we have going tot he 7942G phones have this change in the reserved field.
