Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Serious incoming call problems

Hi - I have a client that is suffering real frustration with regards to their phone system that we have installed and have got to the point of shouting about it, so its not good.

They have a SPA9000 with 2 SPA400's and 15 SPA942's. All configured by the wizard, connected to a Cisco 24port POE switch, with all connected voice ports designated as fast and basic DCSP enabled. Router is a Vigor 2820, with QOS disabled as it is a dedicated ADSL for the voip. There is NOTHING else on the network apart from these phones and the SPA9000/942.

All incoming calls (4 PSTN lines) come through one of the SPA400's and all outgoing calls go over the ITSP.

I have sorted out the phantom call problem by disabling call back on each phone, but they are still getting serious incoming call problems - and regularly. All of their incoming calls at some points fail completely and their is so much distortion that the people calling cannot be heard. Now this has GOT to be an internal network problem, as it is coming in over a PSTN line directly to the SPA400. They are also getting the 3rd call being dropped, so that the third call that is made is not getting through to them.

Everything was set up via the wizard 2-1-0-0, and has been configured as per installation guide.

I have checked with BT that there is no call waiting, the only service applied to the line is caller ID.

I will be doing a full factory reset and reinstall tomorrow, but if you have any ideas on this I would appreciate it as I have been struggling with this for weeks now.



Community Member

Re: Serious incoming call problems

No-one seems to have answered this so I will give you some info myself:

I have now spent hours with Cisco support in Bulgaria, and together we have discovered that the Wizard DOES NOT  set up  a spa9000/400/942 system up properly at all. Most especially the localisation settings. I was informed by Patrick Born that the localisation settings on the wizard were incorrect so he sent me a replacement XML file, which I used to reconfigure the system.

Unfortunately - no use whatsoever.

According to the Cisco SPA9000/400 setup manual at pages 160-163, the localisation settings for the SPA9000 and SPA 942's should be as follows:

Dial Tone                   350@-10;440@-10;*(*/0/1+2)
Outside Dial Tone       425@-16;10(*/0/1)
Prompt Tone              400@-19,620@-19;*(*/0/1+2)
Reorder Tone             400@-10;*(0.4/0.35/1,0.225/0.525/1)
Off Hook Warning Tone  425@-10;*(.2/.2/1,.2/.6/1)
Ring Back Tone         400@-10;(0.4/0.2/1,0.4/2/1)
Busy Tone                 400@-10;10(0.375/0.375/1)
Call Waiting Tone       400@-20;30(0.1/2/1)
Confirm Tone             400@-16;1(20/0/1)

and the tone settings in the SPA400 should be as follows:

SPA400 Call Disconnect Tones

Tone on Fraction: 44%(43%)
High Cutoff Frequency 460(460)
Low cutoff Frequency 340(340)

Call Process tone Detection

First Tone on  400
First Tone off  350
Second Tone on  225
Second Tone off  525
Repeat Count   2

NONE of either was set up by the wizard correctly. As a result of this, if I now need to reinstall the system using the wizard, I will completely wipe all of these settings and have to manually recreate them.

Anyway, I am still getting some phantom calls and call disconnects after all of this fine tuning. I have had BT round to check the lines and they have been confirmed as having no noise, and no call waiting on the line.

I have attached a wireshark capture file of a short time period during which there were 2 phantom calls (calls where the phoens rang and when they picked up, noone was there).

I'm sure you understand my frustration, but I am having a hell of a time working out why the I should suggest a Cisco solution when it is so troublesome, and there seems to be very few answers available to resolve specific problems. I have had to spend a lot of time getting the right configurations from about 5 different sources, and even the Cisco engineers are using web forums to find the information they need!

Anyway - I need some serious assistance to get this sorted out, so please see the attached configs and capture files for the info you will need. As soon as I have a confirmed call disconnect capture I will add it.



Community Member

Phantom call back after call completion

I have attached a minutes worth of a trace, during which an existing call terminated, and once the person put the phone down, the phone rang twice and then stopped.

In all this information, the following applies: = Dell PC (syslog) = SPA9000 = SPA400 (voicemail only) = SPA400 (4 x PSTN lines) = Vigor 2820 ADSL Router = Cisco SLMN224G4PS switch



Cisco Employee

Re: Phantom call back after call completion

Dear Simon;

Sorry for the delay getting back to you.

Unfortunately Syslog is not providing enough information...can you please provide the following:

(1) Configuration for SPA400, SPA9000 and one SPA phone. How to get these?

/docs/DOC-9865. I'm interested to know the values you have configured on the tone tab, tone disconnect



(2) Debug information on SPA400, SPA9000 and SPA phone. How to get these?




(3) Network traces (pcap) that includes the SIP signaling, at least between SPA9000 and the SPA phones, but prefer to have all three options.


Community Member

Re: Phantom call back after call completion

Hi Alberto,

1) The SPA400 tone info is on the second message in this thread, along with the SPA9000, SPA400 and SPA942 configurations as exported from the device via the wizard (I guess that is what you need)

2) I will try and get this done fo you today.



Community Member


Hi Alberto,

Right I have set the following information:

SPA9000 - syslog and debug level 3, SIP Debug Full

SPA400 - syslog errors only on all except SIP, which is All Info

SPA942 - syslog and debug level 3, SIP Debug Full

All going to a wireshark trace so that I will be able to provide you with a pcap to look at later today.

If there's anything else you need me to do, please let me know. As I said, this is extremely urgent, so your immediate attention as soon as I send you the pcap would be appreciated.



Community Member

2 dropped calls around 10.45

Hi Alberto,

Right - I have attached here a pcap of 10:40 to 10:47 during which there were 2 droppped calls which were picked up by extensions 201 and 202 (from the hunt group ring of 301).

I was not there, but when asked I was told that the drops were at around 10:45. If you cant find anything in this I will attach some later files, but from an intial scan there are several calls within this trace.

I will be back into the client on monday 9am and would really lke some good news to tell them!



Community Member

Re: 2 dropped calls around 10.45

2 additional pcaps of dropped calls

Cisco Employee

Re: 2 dropped calls around 10.45

Dear Simon;

Checked the traces. For some reason traces are always taking syslog, are you sniffing the LAN or just syslog communications? On syslog, SIP messages (because of its size) are normally truncated so difficult/not possible to see all the details. Please see my findings:

(1) There is an issue with the SPA400 used for voicemail, it seems the USB file structure is missing some components, please make sure USB file structure is complete. In this community there are instructions for rebuilding the USB.

(2) If you are using standard English for the autoattendant (on SPA9000) I suggest you remove the AA prompt download URL, It is giving errors for download. It should not affect operations but just in case.

Some additional questions.

- How would you rate the incoming call rate for the 4 FXO lines? Low, medium, high? If you know an approximate value for the call/hour ration on the peak hour, please let me know. I cannot see any log issue on the SPA400, but would like to see if the call rate is just too high.

- There is one case in the traces where there is an inconsistency found between SPA9000 and SPA400, not sure if there was a manual reboot, or something different, but this is definitively not normal, and this cause the port to hang/drop.


Community Member

Re: 2 dropped calls around 10.45

Thanks Alberto,

I will have a look at  1 and 2, but I think that error is coming from 31.152 which is not being used for VM.

We dont even use the AA so i can disable that.

-incoming call rate I would say is low-medium. There are 4 incoming PSTN lines and I would say that rarely 3 lines are in use at any one time. Normally it is only 1, sometimes 2, rarely 3 and never 4.

-could you please identify the part when there is an inconsistency between SPA400 and SPA9000, so I can look? thanks.

Further to our last conversation I am now in touch with the escalation team, who have looked at the setup and suggested the following due to the number of phones.

1) Change Force Media Proxy to disabled on SPA9000

2) Change Codec to g729 on SPA400

3) Change preferred codec to g729 on all SPA942's

4) Change call routing information to the oldest style (confirmed usage on older firmware)

5) Add router external IP to SIP nat support parameters on SPA9000 SIP NAT support parameters

6) Change NAT mapping and Nat keep alive to enabled on SPA9000 line 1 (ITSP connection)

So we will see how it goes and I will kepp you updated.

Many thanks


Cisco Employee

Re: 2 dropped calls around 10.45

Hi Simon;

Thanks for your quick feedback.

In the second trace there is a 481 message with Transaction does not exist. This typically happens when one of the ends has terminated the session but the other has not, it could be cause by a reboot or something similar.

I suggest you keep in touch with escalation support from now on. They can ensure a timely response that is required for this particular case.

Regards and thanks again;


Community Member

4 dropped outgoing calls 4.30

This is a trace of 4 outgoing calls that were each dropped after around 20-30 seconds



Community Member

Re: Serious incoming call problems

Some options have now presented themselves.

Phantom Calls:

We are using the ITSP for outgoing calls only so have therefore disabled the contact list for incoming calls.

We have opened the following ports on the router to the SPA9000

UDP  16384-16482  RTP,RTCP,VOICE 
(the range that is under SIP->RTP Parameters)

At the moment we have an odd situation where 0844xxxxxxx or 0871xxxxxxx numbers are one way audio (we can hear them but they can't hear us). I have attached a pcap of one of those coming from IP (ext 202).

We are also still getting phantom calls and I have attached a pcap of one of those as well.

I think the problems are getting less, we just need to nail these final few and we will be done!

There are some interesting entries on the phantom call:

100 13:45:50 Syslog 0046966929 - LSS: 2 fake in_use state, got an outgoing call request\r\n

and then lots of these

433 13:45:56 Syslog SIP/2.0 100 Trying\r\nTo: \r\nFrom: - Line2-;tag=981fa8c0-13c4-4addbf11-48d08480-51189f0\r\nCall-ID: 10195200-981fa8c0-13c4-4addbf11-48d08480-7e9835a2@localhost\r\nCSeq: 1 INVITE\r\nVia: SIP/2.0/UDP;branch=z9hG4bK-4addbf11-48d0848a-201f0b69\r\nServer: Linksys/SPA9000-6.1.5\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 0\r\n\r\n

463 13:45:56 Syslog SIP/2.0 100 Trying\r\nTo: <201>\r\nFrom: - Line2- ;tag=a37a3810faaab787o4\r\nCall-ID: 5bbef584-5825f8a3@localhost\r\nCSeq: 101 INVITE\r\nVia: SIP/2.0/UDP;branch=z9hG4bK-625fe67c\r\nServer: Linksys/SPA942-6.1.5(a)\r\nContent-Length: 0\r\n\r\n

601 13:45:56 Syslog SIP/2.0 180 Ringing\r\nTo: <201>;tag=5612cc211b3045eai0\r\nFrom: - Line2- ;tag=a37a3810faaab787o4\r\nCall-ID: 5bbef584-5825f8a3@localhost\r\nCSeq: 101 INVITE\r\nVia: SIP/2.0/UDP;branch=z9hG4bK-6eb4fc0b\r\nContact: "Jo" <202>\r\nServer: Linksys/SPA942-6.1.5(a)\r\nRemote-Party-ID: "Jo" <202>;screen=yes;party=called\r\nContent-Length: 0\r\nAllow-Events: dialog\r\n\r\n

then it seems to get picked up by ex 202

908 13:46:00 Syslog ACK sip:202@ SIP/2.0\r\nVia: SIP/2.0/UDP;branch=z9hG4bK-cf3328f1\r\nFrom: - Line2- ;tag=a37a3810faaab787o4\r\nTo: <201>;tag=5612cc211b3045eai0\r\nCall-ID: 5bbef584-5825f8a3@localhost\r\nCSeq: 101 ACK\r\nMax-Forwards: 70\r\nContact: Anonymous \r\nUser-Agent: Linksys/SPA9000-6.1.5\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 0\r\n\r\n

and then there are a load of these:

955 13:46:00 Syslog SIP/2.0 487 Request Terminated\r\nTo: <201>;tag=e1c60a82bdeab0e0i0\r\nFrom: - Line2- ;tag=a37a3810faaab787o4\r\nCall-ID: 5bbef584-5825f8a3@localhost\r\nCSeq: 101 INVITE\r\nVia: SIP/2.0/UDP;branch=z9hG4bK-d154679d\r\nServer: Linksys/SPA942-6.1.5(a)\r\nContent-Length: 0\r\n\r\n

All of which are unusual - but have a look and let me know.



CreatePlease to create content