Understanding Sip Packets
Table of Contents
Scope:
The is document will give you a better understanding of some of the Sip Packets you can encounter in a Packet Capture.
BLF and MWI
Busy Lamp Field (BLF) is used to determine if another Subscribed extension is available, busy, or ringing. Message Waiting Indicator (MWI) lets a user know if they have a voicemail. This article will describe how BLF and MWI function, and how to troubleshoot some common issues.
SUBSCRIBE and NOTIFY
Both of these features work off of SIP SUBSCRIBE and SIP NOTIFY.
After a phone REGISTERs, it sends a SIP SUBSCRIBE request for the resources it wants to watch. Most phones will SUBSCRIBE for MWI by default, but if you are manually configuring a phone you may have to enable this functionality.
The Subscription will be defined by the Event or accept header in the SUBSCRIBE message and will last a set amount of time that is based on the 200 OK response to the SIP SUBSCRIBE message, typically 1 hour. For the duration of this Subscription period, the PBX will send SIP NOTIFY messages informing the subscribing endpoint of status changes to Voicemail or Monitored extensions. The NOTIFY's receive 200 OK responses from the Endpoint.
Each message, the SIP SUBSCRIBE (sent from the phone) and the SIP NOTIFY (sent by the PBX) should get a 200 OK SIP Response from the recipient of the message.
MWI SUBSCRIBE/NOTIFY
When your device sends a SUBSCRIBE for MWI, it will use its own extension in the To and From headers of the SIP Message. The Event header and Accept header of the message will have some indications that the SUBSCRIBE is specifically looking for information about Voicemail. The packet data can vary by the phone manufacturer, but will typically look something like the image below.
The PBX will response to the SUBSCRIBE with a 200 OK, which defines the length of the subscription and immediately send a SIP NOTIFY.
In the body of the SIP NOTIFY response from the PBX, you can clearly see the number of New and Saved Voicemails in the body of the Packet. Again the data will vary according to the phone manufacturer. In the Body of the image below, 'Message-Waiting: no' is indicating there are no messages, and Voice-Message: 0/0 represents new/saved.
If the phone received the SIP NOTIFY request, it will respond with a 200 OK that confirms receipt of the NOTIFY.
Any time there is a change to voicemail status, in the course of the subscription, the PBX will send a new SIP NOTIFY message and the phone will respond with a 200 OK.
When the subscription gets close to its timeout, the phone should send a new SIP SUBSCRIBE message that renews the subscription for the next hour.
BLF SUBSCRIBE/NOTIFY
When your device sends a SUBSCRIBE for BLF, it will use its own extension in the From header and the extension fo the targeted resource in the To header of the SIP Message. The Event header and Accept header of the message will have some indications that the SUBSCRIBE is looking for information about the status of the extension (in the below case dialog and dialog-info). The packet data can vary by the phone manufacturer, but will typically look something like the image below.
The PBX will respond to the SUBSCRIBE with a 200 OK, which defines the length of the subscription and immediately send a SIP NOTIFY.
In the body of the SIP NOTIFY response from the PBX, you should see one of three states indicating the status of that endpoint; these three states can be written in plain English through XML or may have a specific language to define the status (Commonly 'Confirmed' as red or busy BLF, 'Early' and flashing or ringing BLF, 'Terminated' as available or Green BLF). Again the data will vary according to the phone manufacturer.
If the phone received the SIP NOTIFY request, it will respond with a 200 OK that confirms receipt of the NOTIFY.
Any time there is a change to monitored resources status, in the course of the subscription, the PBX will send a new SIP NOTIFY message and the phone will respond with a 200 OK.
When the subscription gets close to its timeout, the phone should send a new SIP SUBSCRIBE message that renews the subscription for the next hour.
Common reasons that BLF or MWI might have problems
- SIP ALG or Poor NAT Translation on the Firewall or Router
- Firewall blocking
- Firewall or Network queueing these messages because it believes they are 'less important'
- Bad states in Network equipment causing the packets to not be delivered or dropped
- Malformed headers in the SIP Subscribe message
How do I troubleshoot BLF or MWI issues?
Rebooting the phones is a good place to start, this will force them to re-SUBSCRIBE. If the issue persists after a phone reboot you may want to reboot the customer's Network equipment (Firewall, Modem, Switches). If rebooting the phone did not help, but rebooting the Network equipment did and the issue happens repeatedly, you may want to reboot one Network device at a time (the next time it happens) to determine which is causing the issue.
Beyond rebooting, troubleshooting problems with BLF or MWI will typically require packet captures from the phone, Firewall, and/or packet captures from our PBX by our Support Team to your customer's Network. The packet capture may need to run for a longer period of time. In these situations, it's important to catch the failure at the time that it starts happening.
Our support team can help you read the packet captures if you are not familiar with them.
What does Force Notify do?
Force Notify is a feature that can be enabled by our Support team, but it is typically not necessary. Force NOTIFY periodically sends MWI updates, even in the case the phone isn't sending SUBSCRIBE messages for MWI. Force Notify will NOT change BLF notification.
This increases the amount of network traffic for each device. It should typically only be used when the devices do not send Subscription messages for voicemail. If the Network is set up to allow traffic and can handle Voice Traffic properly, this should never be needed. However, it can act as a bandaid in some situations where the firewall isn't VoIP friendly.