Samuel,
It's not easy to answer this kind of question.
If I remember well, Cybertech is sniffing the SCCP to find information about the specific call.
1) Playing tone only at the beginning of the call.
This is not possible. You can configure CUCM not to play any tone or to play at tone at regular interval.
2) SCCP "StartToneMessage" message
StationStartToneMessage
Cisco Unified Communications Manager uses this message to command the SCCP client to play a specified tone. If the SCCP client is currently playing a tone, the indicated tone takes precedence. If the tone definition is continuous, the SCCP client plays the tone until it receives a StationStopTone message. If the tone definition contains a duration value, the SCCP client stops playing the tone at the expiration of the specified time. If streaming is in progress, however, continuous tones get ignored on the phone and, potentially, on other devices.
This message is used to play tones within and outside the context of a call. When used outside the context of a call, the callReference filed value is set to 0. When used within the context of a call, the callReference field value contains the call reference value corresponding to the call in question.
This starttonemessage is not only used when you record a call, it's also used for example when you start a phone call:
Lifting the Phone from the Cradle The first thing that happens in the trace once we lift the
phone off the cradle is a Skinny OffHookMessage is sent in packet 7 to the CallManager.
This, in turn, triggers a flurry of Skinny messages (packets 8–17) from the CallManger to
the phone, ending on the Skinny StartToneMessage message, which tells the phone to
play a standard dial tone.
This is only a partial answer to your question.
Good luck,
Pierre.
