Hello, I would recommend taking a packet capture from the back of the phone and then ripping out the RTP stream and listening to it. Assuming its G.711 you can use the Wireshark tool to listen to it. If its G.729 audio then you might have to open a  TAC case to get it analyzed. This analyzation will give you exactly what is happening from an IP phone perspective and then will guide you on the path that the RTP travels. This path will eventually guide you to the offending device and then you will know where your problem is. This is very handy instead of guessing where the issue is. That is the quickest and easiest way to work problems like this. Ryan ... View more

You can only get the alarm event from the phone after its registered. The event will be generated from the phone and sent to the CUCM for later review. You can pick it out of the RTMT events. Honestly they aren't that helpful and will just point you to a general network issue. The reason for this is because the phone is on one end and the CUCM on another, so they don't know any of the devices in between and don't know where the actual connection dropped out. Quickest way to resolve the issue: Get a packet capture from the back of the phone and some other points in between right up to the CUCM server. The quicker you get this in place the quicker TAC will be able to help you in troubleshooting what the offending device is. Without those we won't be able to tell you exactly where you issue lies within the network. We would only be able to take detailed CCM traces for minutes before/during/after the issue and tell you that we didn't receive a keepalive on the CUCM so we dropped the TCP connection and un-registered the phone just like it should be done. Ryan ... View more