In certain situations and timings of SIP traffic to an SPA504G running any released firmware from 7.4.8a to 7.5.6a, the phone enters an endless Ringing state if the following sequence of SIP messages is received and responded to.
PBXIP -> PHONE INVITE
PBXIP <- PHONE 100 Trying
PBXIP -> PHONE CANCEL
If the CANCEL gets sent before the 180 Ringing is received, the phone enters this state after reporting a 481 Call Leg/Transaction Does Not Exist.
So this causes problems like so:
PBXIP -> PHONE INVITE
PBXIP <- PHONE 100 Trying
PBXIP -> PHONE CANCEL
PBXIP <- PHONE 481 Call Leg/Transaction Does Not Exist
PBXIP <- PHONE 180 Ringing
... and then the endless ringing starts which you can end by either answering the call or ignoring it, but since the call has already been cancelled no matter what you do the case will not be resolved.
If the CANCEL gets sent AFTER the 180 Ringing we get normal call termination like this (the SIP RFC is nice and vague and as such the 487 and 200 can be the other way around on different phones)
PBXIP -> PHONE INVITE
PBXIP <- PHONE 100 Trying
PBXIP <- PHONE 180 Ringing
PBXIP -> PHONE CANCEL
PBXIP <- PHONE 487 Request Terminated
PBXIP <- PHONE 200 OK
PBXIP -> PHONE ACK
The attached ZIP file contains the test results PCAPs, SIPp scripts for testing the behaviour with, and the logs of the tests.
(I'm currently dealing with 421 of these devices that have been deployed).
