I was doing some sniffing of phone and switch packets being send using various vlan option (vvid, untagged, none, dot1p). Looking at the CDP exchanged I noticed that when using the untagged option (switchport voice vlan untagged) the switch sends VOIP VLAN Reply 4095 (reserved vlan) while the phone sends out VOIP VLAN Query 512 (then 2130). Why does the switch tell the phone to use 802.1q vlan tag 4095 and what is the Query 512 and 2130 coming from the phone?
During my traffic captures i didn't see the phone traffic being tagged in either vlan 4095 or 512. Could this be a driver issue sniffing it? I did see traffic using the VVID option with the vlan set there encapsulated with 802.1q tags so I don't think it is.