Third-Party SIP phone re-registration issue

[ayyoubira]

hi community ,

we have an issue with Cotell-hospitality third-party sip phone .

the phone is unregistering and re-registring every 2 min

please help me to fix this issue 

[Slavik Bialik]

Can you please provide us some Wireshark capture of the SIP messages of this phone? Try to capture for 3-4 whole minutes to see the phone registers, and how it looses registration. 

For now, I can only guess that it has something to do with the 'Expires' header of the re-registration messages, guessing that this sip phone doing something that is not standard by Cisco, or at all.

[ayyoubira]

attached the wireshark file ,

thank you for you help 

[Slavik Bialik]

Hi, I cannot see any Wireshark files attached.

[ayyoubira]

attached the requested file 

[Slavik Bialik]

Hi, the capture is from the CUCM I'm guessing... so it sees all the traffic from other extension as well. Please tell me which IP address (of the hotel phone) I need to filter on.

Thanks.

[ayyoubira]

this  is a cotell phone ip add 10.49.21.102

thank you for your help

[Slavik Bialik]

Great. I filtered on this IP, but I cannot see any RE-REGISTERs.

I see only one register on this phone. What will actually help is to see a capture that this phone lost it's registration and re-registered back. So I will see 2 REGISTER messages, and their timings.

From what I saw now, the CUCM response on the registration message is to expire after 120 seconds. Therefore, I want to see if the phone acts correctly and do it a little bit before the 120 seconds, if not, that's our problem and I think the issue is with the end devices.

[ayyoubira]

yes , that's what is happen ,after 120 seconds the phone become unregistered then it repeats the same thing frequently 

registered 120 s -----> unregistered --------> registered 120 s -------> unregistered ...

[Slavik Bialik]

Yeah, but I'm trying to see the behavior of the phone exactly in the timings in the Wireshark. Because as I explained, if the phone got from the CUCM that the Expires header is 120 seconds, and the phone tried to re-register EXACTLY after 120 seconds, so this is your issue. Means, the behavior of the phone is incorrect. Because when a phone gets the "Expires" header, and the value is 120. The correct behavior is to try and re-register before the 120 seconds, each vendor is changing a bit the behavior, there are phones that if they get from the CUCM 120 seconds, they'll try to re-register after 60 seconds (half of the time specified), there are phones that are randomly take down few seconds from the 120 seconds, and etc.

That's why it is very important to see it in the Wireshark, and I cannot see it in your trace, because the phone your mentioned (10.49.21.102) sent only one REGISTER SIP message in the time period you captured. Try maybe to capture for longer time and attach it for me to review.

But anyway, I already suspect that the issue is with 3rd party end device, with it's behavior when trying to re-register, but I want to be sure.

[ayyoubira]

This another wireshark file 

[Slavik Bialik · Accepted solution]

OK, now we can clearly see the issue.

The phone is sending the REGISTER message with "Expires: 180", the CUCM authenticates the phone, but in it's negotiation it return to him a new "Expires" header with a value of 120 seconds. 

Therefore, the phone should know that his new SIP registration expiration time should be a maximum of 120 seconds. But as you can see in the Wireshark capture, the phone ignores the response it got from the CUCM (in the 200 OK SIP message after the REGISTER) and is trying to re-register only after 150 seconds. That's why you're loosing registration after 120 seconds, and only after 30 more seconds it registers back.

The issue is clearly with the 3rd party SIP phone. Please contact them and show them this evidence, maybe they have some new firmware that you can install on those phones that'll sort this incorrect behavior.

[ayyoubira]

thank Salvik for your help