Ascom Troubleshooting Info
Ascom Troubleshooting Info
Troubleshooting Guide
Ascom i62 VoWiFi Handset
This guide describes how to investigate and remedy Quality of Service problems experienced
by handset users when accessing a WLAN and making calls using the Voice over IP Protocol
(VoIP).
Throughout this document you will find cross-references in the text which indicate further
details that can be found in other sections of this document. The cross-references are
colored blue and linked to the relevant place in the document. For example: see chapter 9.
Document History on page 61. Positioning your cursor over the cross-reference text and
clicking the left mouse button will take you to the relevant section.
To return to the original page after viewing a cross-referred page in Adobe Acrobat or Adobe
Reader, click on the “Previous View” arrow ( or ).
Contents
1. Introduction ................................................................................................................... 3
1.1 Target Group ........................................................................................................... 3
1.2 Prerequisite ............................................................................................................. 3
1.3 Material Needed ...................................................................................................... 3
1.4 Software Version ..................................................................................................... 4
1.5 Abbreviations and Glossary .................................................................................... 4
1.6 Information Required by TAC .................................................................................. 5
1. Introduction
This guide describes procedures to validate and perform troubleshooting on a WLAN that
supports a VoWiFi system. It identifies some of the more common problem areas associated
with the operation of VoWiFi networks and suggests approaches to troubleshooting and the
use of internal and external tools for investigating these problems. The guide contains
detailed information about the behavior of the Ascom i62 VoWiFi Handset under faulty or
problematic conditions. This behavior may be different for different hardware and software
versions of the handset.
1.2 Prerequisite
To gain the maximum benefit from this guide, readers should have experience in and
knowledge of the following areas:
• Configuring a factory delivered handset and performing a handset software upgrade.
• How WLAN networks function up to the level of Certified Wireless Network
Administrator (CWNA) certification or similar level.
• Sufficient knowledge in networking concepts and an understanding of the TCP/IP
protocol suite.
• A basic understanding of Voice over Internet Protocol (VoIP) and the VoIP Session
Initiation Protocol (SIP).
• Have read the configuration manual for the corresponding handset.
• Have read other documents related to the installation, for example WLAN specification
and documents pertaining to the interoperability of the handset with the WLAN
infrastructure.
• An air trace tool or protocol analyzer such as Omnipeek or Wireshark for capturing traces
on the LAN and WLAN. These require a WLAN adapter and network card respectively.
• A spectrum analyzer for detecting non 802.11 RF interference.
2. WLAN Overview
A WLAN enables various devices, or WLAN clients, to communicate across RF channels
through Access Points (APs). APs provide RF coverage throughout the site covered by the
WLAN and this enables users, and their devices, to move around the site without being
disconnected from the network. Each AP is identified by a hard-coded MAC address.
Initially, WLANs were designed to allow users to send and receive data from devices such as
laptop computers but increasingly WLANs are being required to support different and more
demanding types of traffic such as voice and multimedia. A VoWiFi system is illustrated in
figure 1:
VoWiFi Handsets
Controller
Location Server
IMS3 / Unite CM
LAN
Presence
Management
System
Unite System
IP-PBX
required equipment
optional equipment
required parameter settings of the devices supporting the WiFi system should also be
documented.
The following table lists some of the topics that should be included in an assessment
document:
Topic Comments
Are voice settings correctly set in the Voice packet must have precedence over
infrastructure, both LAN and WLAN other types of traffic.
devices?
The assessment must check for the ability to
create an QoS solution across the entire
network.
If a pre-site survey was performed in the traditional way, it should be followed up with a
post-site survey after a network is deployed. This can be done by an installer requesting the
site survey report and using the report to check that the installation is optimized for voice
and that AP configurations are consistent and compliant with the vendors
recommendations.
If the support engineer is subsequently required to visit a site to troubleshoot problems, he
or she should initially verify that the content of the site survey still is accurate when it
comes to AP placements, traffic load, and channel plans, etcetera. Special attention should
be paid to areas where the layout of the building or concentration of VoWiFi clients may
cause problems. The site survey features built into the handset described later in this guide
are very useful in verifying the accuracy of the coverage predicted in the site survey and can,
in some situations, quickly identify holes in the RF coverage.
• Site maps and floor plans can indicate insufficient deployment and hence insufficient RF
coverage
• Floor plans, as long as they are regularly updated to accurately represent the actual
physical layout of the site, can indicate problems and disturbances to the RF
environment that were not previously apparent.
The BSSID of the AP that the handset is associated with can be read from the handset
display as described in section 5.2.1 Show RSSI on page 33.
The name of a WLAN to which devices connect to is specified by a Service Set Identifier
(SSID). All wireless devices connected to a WLAN must employ the same SSID to
communicate with each other. The SSID is set on the AP and broadcast to all wireless devices
in range. The SSID that a handset is connected to can be read from the handset display as
described in section 5.2.1 Show RSSI on page 33.
Link layer MAC sub 802.11 frames The handset uses the IEEE
layer (Management, control and 802.11 WLAN standard
data frames) protocol suit to get access
to the media and to send
packets to the AP
Physical sub RF signals, digitized bit
layer streams
The physical sub layer and MAC sub layer, in the context of the TCP/IP model, replaces the
data link and physical layers of the OSI model with a single link layer. This means that the
link layer:
• Controls how data in the form of bit streams, is transmitted through the network on
standard RF channels. The layer is about the interfaces between the RF channel and
network devices such as the APs, controllers, if used, and handsets. The notion of the
physical layer also defines the protocols that define the characteristics of the channels
conveying data. The handset uses the standard RF channel on either the 2.4 GHZ band or
the 5GHz band as defined by the 802.11a/b/g/n amendments.
• Manages the raw bit stream data received by the AP or controller from the handset
radio, and packages the bits into 802.11 frames. 802.11 defines three kinds of frame for
WLANS, one for management, one for control and one for data. The handset uses
management and control frames for AP association and authentication.
• The MAC sub layer manages the physical MAC addressing scheme by encapsulating layer
2 PDUs in a MAC sub layer PDU. The MAC sub layer uses Address Resolution Protocol
(ARP) to maintain logical IP to physical MAC address mapping of SIP servers in the call
path.
Internet Level
The Internet level responds to UDP and TCP service requests from the transport layer and
provides network to network routing.
Transport Layer
The transport layer provides the TCP/IP address used by network devices. TCP packets are
routed using the IP addresses of WLAN network devices that may interwork with other
networks such as the internet or Public Switched Telephone Network (PSTN). In the context
of the VoWiFi system this is likely to be a VoIP gateway or IP-PBX
The transport layer also provides congestion throttling to maximize data throughput
without overwhelming the resources of the network.
Application Level
The application layer includes the functions of OSI Application, Presentation Layer and
Session Layer, which are often referred to as a user services. TCP/IP sockets and ports are
used to describe the path over which applications communicate. Most application level
protocols are associated with one or more port number.
The SIP protocol is an Application Layer protocol designed to be independent of the
underlying Transport Layer.
Understanding the layers in the TCP/IP protocol stack and how they communicate with each
other is important because it provides the support engineer with a consistent, structured
and methodological approach to troubleshooting network issues. It enables the support
engineer to adopt either a top down approach or a bottom up approach to troubleshooting
and reconciling network issues.
With top-down troubleshooting, the support engineer starts with the layer 4, the
application layer or user services level.
Bottom-up troubleshooting involves checking the device for physical problems such as no
power, a bad cable or other physical problems. A positive response would confirm that
network connectivity had been established, in which case it is safe to conclude that
connectivity up to the Network layer was successful. The focus can now be turned to
troubleshooting the upper four layers of the OSI.
8 The handset displays the idle screen with signal strength indicator, the current time,
battery status, date, user name, user number and license type. In this state, the
handset is described as being in idle mode.
3.4 AP Scanning
When a handset is powered on or on the move, it needs to associate with an AP to be able to
connect to the wired LAN. The scanning process checks the air for the available APs to
associate with and, based on this information, the handset creates a linked list of candidate
APs. The handset will then usually try and associate with the AP with the strongest RF
signal.
Active scanning occurs when a handset actively seeks to associate with an AP and
ultimately connect to a network by transmitting 802.11 probe requests frames to APs on
each of the channels the handset is configured to use. The probe request frames contain the
SSID of the network that the handset wishes to connect to and all APs that are configured
with the same SSID return a probe response to the handset. A handset with a null SSID, that
is, it is not currently configured with a SSID, may also transmits probe requests. If an AP
exists with no security settings at all, the handset may be able to associate with that AP.
If the handset receives probe responses from more than one AP, it can use a number of
criteria to decide which AP too associate with. Although these criteria are vendor specific, a
handset will usually select the AP with the strongest RF signal.
If no suitable AP is selected the “No Network” message is displayed in the handset after
about 5 seconds. For each subsequent 5 second intervals, the handset continues to perform
actives probe for suitable APs using alternate broadcast and unicast probe requests. The
process will not be interrupted until the handset either successfully associates with an AP or
the battery runs out.
When a handset becomes associated with an AP but is not used to make a call, it will
normally go into power save mode and start to perform passive, as opposed to active
scanning. When the handset performs passive scanning it listens, on each channel it is
configured to use and at specific intervals, for beacon frames transmitted by APs. When
passively scanning for beacons, the handset transmits no frames itself.
Beacon frames are similar to the probe response frames transmitted by an APs when a
handset is actively scanning, except that they contain additional information about traffic
pending for the handset. For additional information about how passive scanning works
when the handset is conserving power, see the section 3.5 Power Management on page 14.
When a handset is started from power off mode the procedure to find an AP to associate
with depends on the parameter and protocol settings in the handset.
One of the default protocols that are used by the handset is 802.11d. This protocol
transports regulatory domain information based on country information stored in the AP
which is sent out in the beacon.
The handset needs to know this information before it can start to scan for APs so it can
adapt to the country rules for channels to use, power level, etcetera. It therefore needs to
use passive scanning to grab a beacon that contains that information. Thereafter the
handset can start to use active probing, where it will send out a probe request packet with
its configured SSID on each configured channel for the configured band. It will stay around
20ms on each channel waiting for replies.
The WLAN settings that are default are those for “Network A”, which uses the 2.4 GHz band
with the default channels 1.6 and 11.
Note: The handset will not change from 2.4 GHz channels to 5 GHz channels during the
probing session, unless the handset has been configured to automatically switch between
available networks. This capability is managed by setting the Auto-switch network
parameter in the PDM as described in the Configuration Manual, Ascom i62 VoWiFi Handset,
Handset Configuration chapter.
The correct channel set up in a WLAN is quite important. The channels set up to be used by
the handset on any of the 2.4 GHz or 5GHz has impact on the performance of the handset.
To be able to detect APs when in passive scanning mode the handset must listen to each
channel slightly longer than the beacon interval, to be sure not to miss any beacon. The
handset then has to switch the radio channel and starts to listen again on the new channel.
By default the channels used in any scanning process, including site survey, is for the 2.4
GHZ band channel 1.6.11 and for the 5 GHz radio all channels for the domain.
Tip: For performance reasons when scanning, the amount of channels should be minimized
and only include the channels that are used in the WLAN.
Active scanning of the 5 GHz UNII-2 and UNII-2e, the DFS-channels are not permitted in the
802.11 standard, so those channels will only be scanned in passive mode.
Note: The handset can use the DFS channels, but the Voice quality may be distorted. For
additional information, see section 3.7 DFS Channel Probing on page 19.
3.5.1 Overview
Power Save Battery conservation is supported through the use of the WMM standard Power
Save mode (PS-mode) operation. The operation differs when the handset is idle or in call.
Idle
When the VoWiFi Handset is idle, it is in PS-mode and listens for broadcasts, multicasts and
unicasts at a beacon interval, which is configurable at the AP.
Call
When in call, one of two different modes are used depending on how the handset has been
configured and what functions are supported by the WLAN infrastructure:
• The handset parameter Voice power save mode is set to "none". The handset stays
active during the call, only signaling PS-mode when scanning different channels in case
of roaming. When the call is ended, it returns to idle (PS-mode).
• The handset parameter Voice power save mode is set to "U-APSD". In U-APSD the
handset is in PS-mode also during the call. The U-APSD functionality is negotiated with
the AP during association and provides the automatic release of buffered packets
immediately after an uplink packet. U-APSD maximizes battery lifetime and
performance. U-APSD must be supported by the WLAN infrastructure for a handset to be
able to use it.
Beacons
A beacon is broadcast from an AP to all handsets in the BSS at a predefined beacon interval,
which is normally 100 Time Units (TUs) of 1.024ms or 102.4ms. A handset wakes up at
intervals determined by a Delivery Traffic Indication Message (DTIM) period, which is an
elapsed time based on a number of beacons. Normally the DTIM set to 5 beacons, which
means the handset wakes up every 512ms, that is, approximately twice a second. If, at that
point, the beacon Traffic Indicator Map (TIM) announces it contains buffered data, the
handset transmits a QoS Null data frame as a polling frame to the AP. The QoS Null frame
releases the buffered frame and the AP proceeds to transmit the frame. The handset keeps
it’s receiver turned on until the frame is received. These concepts are illustrated in figure 2:
Figure 2. Handset
Beacon Interval Operating in PS-mode.
Broadcasts
Buffered frame DTIM Broadcasts
Buffered frame is
to the handset
TIM DTIM sent to the handset
AP
Beacons
HS
Handset Handset
active receiver active receiver QoS Null Data
Battery Life
Roaming Implications
When the handset hears a beacon and the signal level is below -70dBm, roaming is initiated
and the scanning process starts. The handset will continue the scan process every 4 seconds
as long as the RSSI value is less than -70dBm. For additional information about roaming
periods and thresholds, see the section 3.6 Roaming on page 17.
The handset may be configured for U-APSD if the VoWiFi system manufactured by a product
partner supports Unscheduled Automatic Power Save Delivery (U-APSD). The two power
management modes are valid also in U-APSD mode and the AP buffers downlink frames
only if the station is in PS-mode.
U-APSD is basically a polling scheme, like 802.11e PS management, but in U-APSD mode,
QoS Null data frame acts as a polling frame and is called a “trigger frame”.
An AP capable of supporting U-APSD indicates this capability through the QoS parameters
found in the WLAN management system. If the supported U-APSD capability is only present
in the type of WMM Power Save used, the capability is indicated in the QoS information field
in the WMM parameter or information elements.
This information is present in Beacon, Probe Response, and (Re) Association Response
management frames.
On association, the handset negotiates with the AP and trigger-enables all four Enhanced
Distributed Channel Access (EDCA) categories. These are:
For additional information about U-APSD and how to inspect and troubleshoot U-APSD
setup, see section 7.2 U-APSD Troubleshooting on page 55.
The example is based on a voice call with bi-directional flow and symmetric codec speech
frames.
A call is established between two parties. In this the parties are assumed to be a VoWiFi
handset and a fixed line phone that resides somewhere on the LAN.
1 In the AP, a voice packet from the fixed phone is received from the wired LAN. The
packet is destined to the handset and the AP intends to transmit the packet on the
RF interface immediately.
However, the destination, that is, the handset for the packet is in PS-mode and since
the AP keeps track of all associated stations PS management mode, this is recognized
and the packet is buffered in the AP.
2 After a short while, the handset transmits a voice packet, as is done every 20 ms with
default settings. This packet is transmitted within the EDCA Access Category “Voice”,
which means that it is highly prioritized.
3 The AP receives the packet from the handset, forwards the packet to the wired LAN
and recognizes that the sending station has a buffered packet. The AP releases the
packet and transmits the packet immediately to the VoWiFi handset that now is
awaiting a packet.
The procedure when an AP transmits a buffered packet due to a trigger frame is
called an “Unscheduled Service Period”
4 The end of an unscheduled service period is when all of the buffered data has been
released and there are no more frames to transmit. The event is indicated by the
transmission of a QoS Null data frame.
Figure 3. Handset Operating in U-APSD PS Mode
1. The AP buffers a packet 3. The AP receives the uplink
destined for the handset packet and immediately transmits
the buffered packet.
AP
HS
2. The handset transmits The sequence is repeated each
a speech packet with 20 ms
EDCA “Voice”
t=0 t=20 ms
A low DTIM value will cause the handset to wake up and check for incoming data more
frequently. A normal value is a beacon Interval of 100 TUs and a DTIM of 5, which causes a
wake up approximately 2 times per second.
Note: The DTIM value should normally be set to 5. Values lower than 5 reduce the handset
sleep period and shorten the battery life.
For additional information, always check the Application Partner Program, Ascom Inter-
Operability Reports for specific recommendations applicable to the particular vendor
equipment.
The handset LCD display also consumes a lot of power. Unnecessary use or browsing of the
handset display can therefore consume battery power quickly. A Screen saver parameter
setting exists in the handset configuration, which may be set to “black” in the PDM as an
additional power saving measure.
3.6 Roaming
One of the most important design criteria for good functionality in a voice system is to
deploy sufficient APs to create adequate RF coverage throughout a site. In addition, the
coverage areas provided by the individual APs must be deployed in such a way as to allow a
user to roam throughout the site without any deterioration in the quality of an ongoing call.
The user must also remain connected to the network at all times even when the handset is
in idle mode. Failure to adequately support roaming may result in audible clicks and other
disturbances in a voice call.
Roaming can be described as disconnecting from the current AP as the user moves away
from it and the signal attenuates. The user then connects to a new AP that offers an
increasingly stronger signal as the handset is carried towards it. As a user moves away from
an AP of decreasing received signal strength and towards one of increasing signal strength,
it is predictable enough to be able to apply a roaming algorithm based on the measurement
of received signal strength at fixed time intervals, for example, every 4 seconds. The
algorithm then decides where and when a handset disconnects from one AP and connects to
a different AP.
An additional factor that must be included in any roaming algorithm is to provision for
sudden, large and often unpredictable reductions in received signal strength due to some
dynamic event that is introduced into the physical environment, such as the closing of a
heavily clad steel door or the handset user enters an elevator. These events can occur
between the scans performed at the fixed time intervals and cause additional scans to be
performed. The trigger for an additional scan is when a 6dBm or greater received signal
strength reduction is detected since the last scan.
To ensure that unnecessary extra scans are not initiated between scheduled measurement
periods, the reduction in received signal strengths is calculated accordingly:
reduction in dBm = 75% of scheduled AP RSSI measurement + 25% of beacon RSSI.
Note: Only beacons are used for RSSI calculations in the handset when the handset is not
roaming. When roaming, probe responses are also used in the RSSI calculations.
For example, consider a doorway between an associated AP and a handset, with a metal
door in the open position. if the door was momentarily closed and then opened, there might
be a sudden 16bB reduction in received signal strength and a rapid loss in communication.
However, this would be largely restored once the door was opened again and make an extra
scan unnecessary and a waste of network resources. However, if the door was left closed,
the loss in received signal strength would be sustained and probably worsen as the user
moved away from the AP. An extra scan would therefore be justified.
Roaming is implemented differently depending on whether the handset is in idle mode or in
a call. Different roaming algorithms apply to these modes.
In idle mode, it is not so important to consider received signal strength and roaming as voice
quality is not an issue. The following roaming algorithms are deemed sufficient for ensuring
the handset is able to perform TIM discovery as the user moves between AP:
An additional scan is triggered in idle mode when scanning is being performed and when a
reduction of >= 6dBm is detected in a beacon being sent by the AP at the regular beacon
interval.
In call mode, received signal strength is very important for ensuring voice quality,
particularly if the user is moving around the site. The following roaming requirements are
deemed sufficient for ensuring the handset is able to support adequate voice quality
between APs:
An additional scan is triggered in call mode when a reduction of >= 6dBm is detected in a
beacon being sent by the AP at the regular beacon interval.
When the handset operates in a WLAN where the system is responsible for roaming, use the
PDM to set the handset to system aided roaming. From the menu Network, select the active
network (A, B, C or D) and then select the parameter Roaming methodology. Set the value to
“System-aided roaming”. The handset will then only perform a scan when the RSSI drops
below -70dBm both in call and in idle mode.
Band Channel
UNII-1 36, 40, 44, 48
UNII-2 52, 56, 60, 64
UNII-2e 100, 104, 108, 112, 116, 132, 136, 140
UNII-3 149, 153, 157, 161
ISM 165
The radio channels in the UNII-2 and UNII-2e bands are DFS-channels, which may be used by
civilian and military radar such as aviation and weather radar. Because radar always has a
higher priority than a WLAN, additional procedures must be employed to prevent LAN
devices from interfering with radar when the radar is using the DFS channels. This can
increase latency and degrade the performance in a WLAN.
A client that does not support radar detection is not allowed to actively scan for APs in the
DFS channels. The client is only allowed to perform passive scanning, which means that it
can only listen for beacons. For a voice client, this will affect an ongoing call to some degree
by introducing a slight increase in jitter in the voice stream.
The handset can use the Dynamic Frequency Selection (DFS) channels in a voice enabled
WLAN, but the voice quality can be distorted as the DFS channels must be treated
differently in the scanning process.
The probing process above is repeated each time the handset needs to find roaming
candidates, that means, when the signal quality on its current associated AP decreases.
Another reason that the use of DFS channels is not recommended in areas where radar may
be operating, is the requirement of automatic switching of channels and the non-service
time gap that occurs. Note that radar can be airborne, for example, used by aircraft for
navigational purposes.
The regulations for using 5 GHz channels, generally known as DFS channels, in which radar
operates, is that the handset uses a different approach while scanning.
The DFS regulations require that WiFi devices should check for radar that is currently
operating before they initiate a session. This requires special software features and is
normally only included in APs, which are the devices that are set to use a specific channel. If
a radar signal is detected the AP should invoke a special procedure to automatically move to
another channel. During this transfer to another channel, which takes a while, the
transmission of packets in that cell is stopped and as a result the call can be lost.
Portable devices, like a handset, are not able to detect radar and thus are not allowed to
initiate a conversation. Active probing on the DFS channels is therefore prohibited until is
has been determined that no radar is present.
To detect an AP to roam to, the handset has to use passive scanning which means it has to
listen to beacons on every configured channel.
The default beacon period in most APs is set 102.4ms. Using a short scanning interval of
let's say 20ms on a channel the handset’s chances of hearing a beacon is about one in five.
To improve the chances of the handset picking up a beacon the listening time on a channel
can be extended or the beacon period made shorter.
For the DFS channels the passive listening time for the handset is set to 70ms, during which
the handset may or may not hear a beacon. If the handset hears a beacon during this period
or if the time period expires, it will immediately return to its currently working channel and
exchange packets with the current AP that was buffered during the scanning process.
If the handset did hear a beacon it will do active probing on that channel and add the APs it
hears to the roaming table. It will then go on with this process with the next channel it is set
up to use. When it gets to the current channel it can immediately do a probe request to find
any other APs on that channel to add to the roaming table.
Note: Since scanning for many channels takes a considerable time, it is important that the
channels used in the scanning process are only those channels that have been setup for use
in the WLAN system.
After finalizing the first round it will decide whether to roam or not, and which AP to use.
For optimal voice performance it is not recommended to use DFS channels. If they are used
limit the number of channels to 8 otherwise roaming will be further degraded.
3.8 SIP
Session Initiation Protocol (SIP) is an application layer signaling protocol defined in the IETF
standard RFC3261. It is used to setup, control and manage sessions between two or more
endpoints in an IP based network. These sessions include Internet telephone calls,
multimedia distribution, and multimedia conferences that use TCP, TLS/TCP or UDP for
transport.
SIP is a fairly loose standard and the implementation is up to the manufacturer of the
handset. Since each implementation may have some vendor specific code it is important
that the handset is used together with a SIP-Proxy (IP-PBX) that is tested by the
interoperability team. Only those solutions that have been tested are supported by Ascom
wireless.
When troubleshooting VoIP in a handset a solid understanding of how a SIP session is
established between two phones and where the voice packets are going will speed up the
troubleshooting process.
SIP servers receive requests from clients, process the requests and generate responses. A SIP
server is usually a proxy server acting on behalf of the client by receiving and forwarding the
requests to the recipient, receiving responses from the recipient and returning these to the
client. Because the address of the recipient is not initially known when a request is initiated,
a proxy server often contains a registrar server where location details of all the users
registered with the network are contained.
SIP Clients
In general the notion of clients refers to the end users of applications running at the
application layer of the TCP/IP protocol stack. The applications include softphone
applications and voice and messaging applications for IP handsets.
One of the most important functions of SIP servers is to detect the location of users in the
network and process requests from clients to register their current location. Users register
their IP addresses with a server by sending a REGISTER message to the server informing
them of their IP address. The server subsequently returns an acknowledgement in the form
of a 200 OK message when the user IP address is registered.
The server is connected to a location database where an up-to-date mapping between the
server, user and user IP address is maintained. The specific mapping is between the user
Address of Record (AOR) and the user IP address, for example sip:[email protected] ->
172.20.15.235. This mapping is refreshed on a periodical basis by REGISTER messages
according to a negotiated expiry value between the client and server.
SIP Addressing
SIP Ports
SIP provides the signaling part of a communication session. signaling information may be
encrypted or non encrypted.
SIP clients send and receive non-encrypted signaling information in UDP or TCP packets to
and from other SIP servers and SIP endpoints on the default port 5060.
Port 5061 is typically used for traffic encrypted with Transport Layer Security (TLS).
The Session Description Protocol (SDP) is used to initiate a media session and support the
flow of RTP packets between SIP endpoints. An SDP message contains information about
the SIP entity, such as an INVITE message, that created it. Such information describes the
codecs that may be negotiated between the SIP endpoints, the transport protocol to be
used, and the ports and IP addresses that RTP packets are to be sent to.
Codec negotiation is about selecting which codec to use on each leg of a call and SDP
supports this negotiation. A handset that initiates a call announces to the called party
handset the codec that it wishes to use for the media session. The called party confirms
whether or not the desired codec is supported. In practice most SIP endpoints support
multiple codecs, so the SDP codec negotiation process sifts through the choices and settles
on a single codec to use.
To check the codecs supported by a handset, expand the message body associated with the
SIP entity specifying the call invitation and then expand SDP and Media Description. The
supported codecs are listed as Media Attributes followed by an ITU-T standard speech codec
extension.
As SDP is a text-based protocol embedded into SIP Messages it is relatively easy to display
and inspect the content of SDPs using a protocol analyzer such as WireShark. For example,
the SDP part of a SIP INVITE request viewable from a WireShark trace is shown in figure 4:
The supported codecs and their respective properties are listed under the Media Description
and Media Attribute followed by ITU-T standard speech codec extensions.
Media Description
In figure 5 the media descriptor identifies four payload types that a particular handset
supports. The first payload type “8” is the codec (G711 ALaw) preferred by this handset.
In this example, the handset initiating the invite is indicating to the called party handset
that the preferred codec for the media session is G.711 ALaw. If the called party handset
does not support this codec, try G.723 as the next preference, G.729 the third preference
and G.711MuLaw being the least preferred. In the unlikely event of the other handset not
supporting any of the codecs suggested by the call initiator, a SIP unsupported media type
message will be returned in response to the initial invitation to setup the call and the RTP
media session will not be established.
Media Attribute
It shows how the G.729 codec protocol is specified with it’s payload type annexa set to
“yes”, that is, silence suppression. Silence suppression is thus set if the SIP endpoints
negotiate this codec protocol for use in a connection.
An understanding of how the properties of a connection are expressed through SDP media
attributes can sometimes be of help in troubleshooting and resolving issues.
An attempt to establish a SIP session begins when a calling party, say user1, makes an
INVITE request to a called party, say user2. Because the call will be using IP, user1 ultimately
needs to discover the IP address of user2. User1 thus forwards the INVITE request to its SIP
proxy servera.com but ServerA realizes by the domain name part of the AOR (serverb.com)
that user2 is not registered with its own domain servera.com. ServerA therefore needs to
initiate a search for the proxy server in the network that is able to associate the AOR with an
IP address.
The first hop in this simplified example is to pass the INVITE request to serverB. ServerB
realizes by the domain name in the AOR (serverb.com) that user2 is connected to it and it
has no further need to forward the INVITE to any other servers in the network. Instead, it can
now forward the INVITE to user2. The start of the process is shown in figure 6:
Figure 6. Call Invite
Before the INVITE message reaches the phone of user2, the SIP proxy serverB uses its
registration server and location database to find the IP address of user2. ServerB performs a
SIP service lookup on the database to find a match for the AOR that it has received from SIP
proxy servera.com, as shown in figure 7:
Figure 7. Far End Lookup
The result of the lookup is an IP address (172.20.15.235) that serverB can now bind the
INVITE message to. Once the association is established, the INVITE message reaches user2,
as shown below:
Figure 8. Number Binding
At this point serverB sends a 180 RINGING message back to user1's SIP server serverA and in
turn serverA relays the message back to user1, as shown in figure 9:
Figure 9. Ringing
The user1 handset will now probably produce some kind of audible call pending tone that
confirms user1 that the called party has been reached and their handset is ringing. If user2
answers, an 200 OK message is generated by serverB and forwarded to user1 via serverA.
The call message flow as defined by the SIP standard is finally completed when the user1
handset sends the user2 handset an acknowledgement (ACK) as shown in figure 10.
• A media session is established whereby a flow of RTP voice packets between the user1
and user2 handsets is established as shown in figure 10. The voice session continues
until one of the parties terminates the call.
• A SIP dialog is established between user1 and user2. The SIP dialog is the critical
component in the media session because it is associated with all requests and responses
that are made and received during the session. The dialog is identified by a Call Identity,
a tag value associated with the user-1, the initiator of the call, and a tag value associated
with user-2, the recipient of the call and these values are used in all requests and
responses.
Figure 10. Call Acknowledgement and Voice Session Establishment
A redirect server generates 3xx responses to requests it receives, directing the client to retry
the request using one or more alternative Uniform Resource Identifiers (URIs), which are
presented in the 3xx response. 3xx is a SIP response class used to indicate that further
action needs to be taken in order to complete a the request.
In the following example, user1 places a call to user2 using a redirect server because user2
has temporarily moved to serverc. User2’s address has temporarily become
sip:[email protected]. The INVITE message is first sent to the redirect server, which returns
a 302 MOVED TEMPORARILY response containing a contact header with user2’s current SIP
address. User1 then generates a new INVITE message and sends it to user2 via the proxy
serverC:
Figure 11. Call Redirect
Note: A user attempting to call a recipient that has moved permanently to a new position
will receive a 301 MOVED PERMANENT message after the initial INVITE.
When one of the parties terminates the call, a final exchange of SIP messages occurs. The
party that initiates the termination sends a BYE message directly from one handset to the
other party, and the other party handset returns an 200 OK and that is the completion of
the call. For example:
Figure 12. Call Completion
Note: If the WLAN is using a controller based solution the SIP message flows in all of the
above illustrations should include the controller because all WLAN traffic is bridged between
wireless and wired network segments by the controller and not the APs. That means that
traffic goes back and forth on the LAN cable to the controller. Depending on the
configuration and functionality of the SIP proxy, the Real-time Transport Protocol (RTP)
stream may be passing through the SIP proxy or may be routed directly between the VoWiFi
Handsets when using a controller with thin APs.
Requests and responses may contain a message header and message body that the support
engineer can inspect using a protocol analyzer tool such as Wireshark. Traces of message
headers and responses can provide valuable troubleshooting information.
An INVITE message, for example, would generate a message header with the following kind
of content:
Field Description
Via Indicates the path taken by the request so far. The main purpose of the Via
header is to ensure that responses take the same path as the requests so
that responses can be routed back to the call initiator.
A Via field value is added after the transport that will be used to reach the
next hop has been selected. The entity that generates the header inserts its
address in the Via field and all subsequent proxies that fall in the path also
insert their own address as Via fields.
A response that replies to a request keeps all the Via values in same order as
they are received. Proxies that fall in the reply path then remove their own
Via address and forward the response back. Hence, when the response
reaches the call initiator it contains only the Via address of the call initiator.
The call initiator strips off this Via value and finding that there are no more
Via’s left, processes the response.
All requests must include a Via field. The protocol name and protocol version
in the header must be SIP and 2.0, respectively. The field must also include a
branch parameter. This parameter is used to identify the transaction created
by the request. This parameter is used by both the client and the server
Example 1: SIP/2.0/TCP servera.com:5060;branch=z9hG4bK74bf9
Example 2: (OK Response)
Via: SIP/2.0/TCP servera.com;branch=z9hG4bK721; received=192.0.2.222
Via: SIP/2.0/TCP serverb.com;branch=z9hG4bK2d4;received=192.0.2.111
Via: SIP/2.0/TCP serverc.com;branch=z9hG4bK74b;received=192.0.2.101
From The address of logical identity of the request initiator, possibly the user's
address-of-record. The field contains a URI and optionally a display name. It is
used by SIP elements to determine which processing rules to apply to a
request.
Note: The field must contain a new tag parameter, chosen by the call
initiator.
Example: "Freddy" <sips:[email protected]>;tag=a48s
To The address of the intended recipient of the request or the AOR of the user or
resource that is the target of this request.
Note: The field must contain a new tag parameter, chosen by the recipient.
Note: The field always contains a tag once the dialog is established.
Example: “Charlie”<sip:[email protected]>;tag=6t3r
Call-ID A unique identifier to group together a series of messages. It must be the
same for all requests and responses sent by the calling and called parties
within a dialog.
Example: [email protected]
Field Description
Contact Provides a single SIP URI that can be used to contact the sender of the INVITE
for subsequent requests. The Contact header field must be present and
contain exactly one SIP URI in an INVITE request that results in the
establishment of a dialog. For these requests, the scope of the Contact is
global. That is, the Contact header field value contains the URI at which the
call initiator is expecting to receive requests, and this URI must be valid even
if used in subsequent requests outside of any dialogs.
Example: sip:[email protected];transport=tcp
A support engineer needs to be aware of the route the signaling and VoIP packets take
through the network and which devices are involved.
If the problem with voice cannot be related to the correct settings of the SIP and VoIP
parameters and the configuration of the IP-PBX used then a trace of the traffic flow may
need to be done both on the wired LAN and the WLAN.
Tip: It can be very beneficial to use a fixed IP phone connected to the wired LAN as a
terminal and thus quickly eliminate if there is a PBX problem or a WiFi problem. In this case
there will also be just one AP and one VoWiFi Handset to troubleshoot.
RF loss is a decrease in the signal amplitude. There is always a clear and predictable loss as a
radio signal propagates through the air, even if the airspace is completely unobstructed. The
atmosphere causes the modulated signal to attenuate exponentially as the signal
propagates farther away from the antenna. Signal loss can occur when metal, concrete,
walls, or floors block transmission.
The physical site characteristics can considerably exacerbate signal loss because of
obstructions in the airspace such as walls, doors and ceilings. The material used to
manufacture and construct such obstructions can also affect the degree of signal loss.
Therefore, the signal must have enough power to reach the desired distance at a signal level
acceptable that the receiver needs.
Problem reported
Familiar Yes
1. Get the picture Apply known fix
problem?
No
3. Make hypothesis
Yes
Get support Stuck? 5. Test and check
No
4. Prioritize where to start
• Problem Reporting: Define the nature of the problems that users experience and the
circumstances in which the problems arise. Problem types usually involve interruptions in
the audio stream, disconnections, distortions such as echo and clicking noises, and
delays. The user experiences that small discrete parts of the conversation are missing.
• Get the Picture: Try and elicit additional information from the user to try and picture the
context and circumstances in which the problem occurs. For example, was the user
stationary or roaming or in the proximity of other non 802.11 devices generating RF
signals?
• Ascertain what is Working: In a complex installation like a VoWiFi system it is important
to rule out the devices that are functional at an early stage of the troubleshooting
process. Why a handset is not functioning when making a call depends on the correct
function of several other devices.
• Form a Hypothesis: Make a list of possible causes. The fault is maybe on a device not
primary a part of the solution, like a nonfunctional DHCP-server.
• Prioritize where to start. Eliminate causes that are quick to check first and do the more
time-consuming later. Also eliminate causes that make less impact for the users first.
Remember that whatever action you take may cause an interruption in the services.
Make one change at a time and if problem is not solved unroll your new settings.
Document what changes were done.
• Test and check: Make sure the appropriate tools are available for testing a proposed
solution. If modifications to the LAN or WLAN are needed, liaise closely with those
responsible for managing and administering the network. Do not make unauthorized
modifications.
Note: Do not change any security settings that will jeopardize the WLAN.
The Show RSSI menu item displays information in the handset LCD about the received signal
strength, the current and previously associated APs and whether the handset is in power
save or active mode during the association. To show RSSI information directly in the handset
display without navigating through the Site Survey tool menu, use the shortcut **#76#.
The RSSI information is displayed directly in the handset display as shown in figure 13:
Figure 13. Handset SSID DIsplay
Note: In the example display above, the handset is in power save mode as indicated by the
“P” following the RSSI and channel number of the associated and previously associated AP.
A handset is in active mode is denoted by “A”.
To turn off the RSSI display, reenter the shortcut *#76#.
As a part of a troubleshooting procedure, it can be very useful to use the site survey tool to
help create a graphical representation, or heatmap, of RF signal strengths surrounding an
AP. The handset can be used to create a heatmap by sampling RF signal strengths in the
vicinity of an AP and then superimposing these values on to a building plan where the exact
location of the AP is shown. Several values can be selected for the handset Beep range and a
heatmap of signal strengths can be drawn by repeated sampling. For additional information,
see section 5.2.4 Range Beep on page 35.
This section describes how to use the Site survey tool to evaluate the VoWiFi system RF
environment.
1 When performing a site survey on the 2.4GHz band make sure that parameter
802.11b/g/n channels are set to “All”. The default is “1,6,11”.
2 Set the World mode regulatory domain setting parameter to USA, ETSI or other listed
countries.
Note: To scan channel 1-11, set the World mode regulatory domain setting
parameter to “USA”. If the scanning of channels 12-13 is also of interest, set the
parameter to “ETSI”.
3 Open the handset Site survey tool using the shortcut *#77#.
4 Perform a site survey by selecting the following options from the site survey tool
menu:
“Scan all channels”: Returns a list of APs discovered for all available ESSIDs.
“Scan selected channel”: Enter the required channel. This option returns a list of all
the APs found on that channel regardless of ESSID.
Note: Be sure to walk slowly. Since the value is filtered sudden drops in field strength
caused by the environment, for example walking through a door into a room, will be
delayed. Thus it is important to walk slowly through the site to cover all weak spots.
Note: See also the section 5.2.2 Creating Heatmaps on page 34.
Note: It is important to remember to restore the handset to the channel and
regulatory domain settings previously used if these were modified in steps 1 and 2 of
this procedure.
A quick an easy way to check system coverage is to use the Range beep function. A beep is
played in the handset whenever the handset measures a filtered field strength of below the
configured value (default -70 dBm) from the currently associated AP.
To use the function, perform the following steps:
1 Open the handset Site survey tool using the shortcut *#77#.
2 From the Site survey tool menu, select the menu item Range beep and press the
handset Select button
3 Enable the range beep function by selecting the On radio button. Press the handset
Back button.
4 From the Site survey tool menu, select the menu item Range beep level.
5 In the Level (-dBm) field, enter the roaming threshold that the system is planned for.
Ascom recommend -70dBm.
6 Walk through the site at a slow pace. If the RSSI for the handset drops below the
value of the range beep level from the currently associated AP, the handset beeps.
Note: Occasional single beeps with a long interval in between is fairly normal as the
handset moves through the edges of AP coverage areas. However, prolonged periods
of repeated beeps point to coverages issues that need to be investigated.
Note: The roaming behavior is different between idle and call modes as described in
the sections 3.6.1 Idle Mode on page 18 and 3.6.2 Call Mode on page 18 so the result
of the coverage test will most likely differ when used in call and not. If the beep level
is set to < -70dBm and the handset is in idle mode, the handset beeps at every roam
because the roam level is set at -70bBm in idle mode.
Note: Because the measured field strength the value is filtered, sudden drops in field
strength caused by the environment, for example walking through a door into a
room, can be delayed. It is therefore important to walk through the site slowly to
ensure that all weak spots are covered.
The purpose of the test is to verify that a handset is able to roam between different APs
without losing connectivity or experiencing interruptions or distortions to the voice quality.
The support engineer makes a call from a handset that can be physically moved around to
another handset in a fixed location and then physically moves through an Extended Service
Set (ESS).
1 Make a call from a handset that can be physically moved around to another handset
in a fixed location.
2 Place a radio or other audio source playing music next to the handset at the fixed
location.
Note: To be able to hear roaming delays, interruptions or distortions, a continuous
audio source from a radio or MP3 player is recommended. A conversation between
two people often consists of up to 50% of silent intervals and would not therefore be
suitable for the test.
3 Walk around the site to find spots with weak coverage.
Note: Make sure that the walk takes place both directions to ensure that the handset
has roaming options whenever the field strength drops low.
4 Make detailed notes of any areas where coverage is insufficient.
The Logs tab provides the following information from the links displayed to the left or the
panel:
• Info: General information about the Log tab function
• Syslog: Real-time information about the actions taken by the handset, like setting up a
call, WLAN changes and power level.
• Errorlog: The error log stored in the handset in case of a restart. Click the Download
button to download the error log to your PC.
Note: The syslog and error log may contain information requested by Ascom support when
responding to trouble reports.
The Statistics tab displays information about voice calls and WLAN connectivity:
Voice statistics can only be recorded for an active call. The statistics are collected from the
RTP module and from the jitter buffer and concern the receipt and transmission of data
frames containing RTP voice packets. The following statistics can be investigated by the
support engineer for any values that might be indicating poor voice quality:
Rx Voice Packet Loss The number of lost RTP frames relative to total number of
transmitted and received frames.
Rx Voice Packets The number of voice packets received during the call.
Tx Voice Packets The total number of voice packets sent during the call.
Rx Min Pkt Interarrival time The minimum time recorded during the call, in ms,
between the receipt of one RTP frame and the receipt of
the following frame.
Rx Max Pkt Interarrival time The maximum time recorded during the call, in ms,
between the receipt of one RTP frame and the receipt of
the following frame.
Rx RTP Avg Jitter The mean value of the RTP jitter over time. The value
given is provided from samples with a default sampling
rate of 8 kHz.
The following example illustrate how to use the handset web interface to check various
statistics that might give an indication as to why voice problems are being experienced:
1 Start the handset web interface as described in steps 1 to 5 in the section “Handset
Web Interface” on page 36.
2 Select the Statistics tab, Voice option. The Voice Statistics pane is displayed with the
message “No channel open” displayed.
3 Connect a call from one handset to another. One of the handsets must be the handset
with the IP address used to open the handset browser.
4 Complete the call but do not hang up.
5 From the Voice Statistics pane click the Refresh button and make a note of the voice
statistics. The call may now be hung up.
6 Inspect the values of the statistics displayed in respect of the test being conducted.
The following table illustrates some tests and conclusions that could be drawn from
the values returned:
Test Description
Jitter Verify that the Rx RTP Avg Jitter statistic is reasonable, that is,
less than ~100 samples per second, depending on codec used.
The default codec is G711. This codec can be sampled 8000
times per second, which equals 0.125 ms for one sample.
Note: During normal operation the “Max Jitter” may be quite
high (~300 ms) even though there is no problem with the
voice traffic.
Voice Packet Loss Inspect the Rx Voice Packet Loss statistic. A loss of up to 5% for
a WLAN is probably not noticeable if the packet loss is
distributed evenly throughout the call.
WLAN statistics are cumulative from boot or from the last time the statistics were reset. The
statistics return the following information about the number of transmitted and received
RTP packets:.
RX packets The number of RTP packets received.
RX bytes The total number of bytes in the received RTP packets
RX dropped The number of received RTP packets dropped.
TX packets The number of RTP packets sent.
TX bytes The total number of bytes in the sent RTP packets
TX dropped The number of sent RTP packets dropped.
The following example illustrate how to use the handset web interface to check various
statistics that might give an indication as to why WLAN problems are being experienced:
1 Start the handset web interface as described in steps 1 to 5 in the section 5.4
Handset Web Interface on page 36.
2 Select the Statistics tab, WLAN option. The WLAN Connectivity Statistics pane is
displayed.
Note: The statistics display cumulative totals. To reset the values to zeros, click the
Reset button.
3 Connect a call from one handset to another. One of the handsets must be the handset
with the IP address used to open the handset browser.
4 Complete the call but do not hang up.
5 From the Voice Statistics pane click the Refresh button and make a note of the WLAN
statistics. You may now hang up.
6 Inspect the values of the statistics displayed in respect of the test you are
performing. The following table illustrates some tests and conclusions that you could
make from the values returned:
Test Description
Voice Packet Loss Verify that the Rx Voice Packet Loss statistic is reasonable, that
is, less than ~5% for a LAN.
Ping
Ping is used to test whether or not a host on an IP network can be reached and to measure
the round-trip time for messages sent from the originating host to a destination such as an
IP PBX, Unite server, router or a handset.
To run Ping, select Ping from the Tools pane and enter the IP address of the destination. The
results of the ping is statistical summary of the response packet received and the round-trip
time taken for the packet in the message to be sent and received. For example:
Reply from ::ffff:10.30.32.166: bytes=32 time=28ms TTL=127
The destination IP is pinged ten times.
The following output indicates that the device has not been reached:
Traceroute
The traceroute utility is a network diagnostic tool for displaying the route and measuring
transit delays of packets between two devices across an IP network. One device is usually a
handset making a call and the other device is the device to be reached, such as a handset or
a PBX or Unite server.
To run traceroute, select Traceroute from the Tools pane and enter the IP address of the
device to be reached from the calling device. The result of the traceroute looks like this
Figure 14. Traceroute Result
It is important to perform a QoS test on all possible call scenarios such as calls between
handsets on the same APs or controller, on different APs or controller, between handsets
and fixed phones, and internal to external phones. QoS tests can be performed using
handset web interface in the following way:
1 Login to the web interface and open the Troubleshoot pane as described in the
section 5.4 Handset Web Interface on page 36.
2 Make a call from the handset.
3 On the left of the Troubleshooting panel, locate and select Syslog. A dump of the
syslog is displayed.
4 Locate the row in the log with an entry of Voice Rx. Check that the handset has
received voice data in the voice queue (UP 6) by verifying that the Syslog entry is as
follows:
Voice Rx IP DSCP: 0x2e UP: 6
5 Locate the row in the log with an entry of Voice Tx. Check that the handset has sent
voice data in the voice queue (UP 6) by verifying that the Syslog entry is as follows:
Voice Tx IP DSCP: 0x2e UP: 6
Note: The DSCP channel value is set in handset parameter IP DSCP for voice and
should be set to match the LAN/WLAN configuration. The handset parameter is
displayed from the PDM Edit parameters > Network > Active network.
Note: The UP value displayed in Syslog is from the first voice package at call startup.
To ensure that all voice data is sent in the voice queue perform an air trace such as
that described in Appendix A.
Note: The handset always sends voice data in the voice queue (UP 6) unless CAC/
TSpec settings in the WLAN system prevent it from doing so. Traffic Specification
(TSpec) lets a 802.11 client signal its traffic requirements to an AP.
6. Troubleshooting Scenarios
This section illustrates, through examples, how a support engineer might approach SIP call
problems by analysing the setup and flow of a call between two parties. The section focuses
upon how traces and logs of SIP signaling and RTP voice packet flows can be analyzed, the
kinds of information these sources provide, and how this information can be used by the
support engineer to identify problems. The section therefore suggests an approach to
troubleshooting issues rather than providing a single definitive method for resolving issues.
6.1 SIP
The following troubleshooting scenarios are described:
• Attended Transfer problem and one-way audio: user1 places a call to user2, and user2
transfers the call to user3. However, either user3 cannot hear user1 or user1 cannot hear
user3. In this scenario, user1 is the call transferee, user2 the call transferor and user3 the
call target.
• Name Presentation problem: user1 places a call to user2, but when user2 accepts the call,
user2’s number is not displayed on the handset of user1.
Depending on the configuration and functionality of the SIP proxy the RTP stream may be
passing through the SIP proxy or may be routed directly between the handsets.
A support engineer needs to be aware of the route the signaling and VoIP packets take
through the network and which devices are involved.
If the problem with voice cannot be related to the correct settings of the SIP and VoIP
parameters and the configuration of the IP-PBX used then a recording of the traffic flow
may need to be made on both the wired LAN and the WLAN.
Tip: It can be very beneficial to use a Fixed IP phone connected to the wired LAN as a
terminal and thus quickly eliminate if there is a PBX problem or a WiFi problem. In this case
there will also be just one AP and one handset to troubleshoot.
A call transfer happens when user2 transfers a call from user1 to another user, say user3.
The sequence of the transfer is as follows:
1 user1 (number, for example: 4111) dials user2's number 4112 and presses the
handset Call button.
2 user2 accepts the call by pressing the handset Accept button and begins a
conversation with user1. user1's number 4111 is displayed in user2's handset.
3 During the conversation the parties agree that user1 should be talking to user3
instead. user2 agrees to transfer the call to user3.
4 user2 presses the handset More button and selects the menu item Tranf. to new
5 user2 enters 4113, the number of user3, in the Transfer to input field, then clicks the
OK button. A Transferred message is displayed in user2’s handset.
6 user3’s phone rings with 4111, the number of user1, displayed in the handset.
7 user3 selects Accept and begins the conversation with user1. user3’s number 4113 is
displayed in user1’s handset.
8 The conversation between user1 and user2 is dropped and user2's handset reverts to
displaying the idle screen.
9 user1 and user3 continue the conversation until one of the parties hangs up.
The following sections describe the exchange of SIP requests and responses required to
support the transfer scenario described above. The scenario from a signaling perspective
occurs in three broad steps:
• RTP sessions are established between the users but are then put on hold pending the
transfer
• The signaling of the actual transfer takes place; existing RTP sessions are terminated
between the transferee (user1) and transferor (user2) and transferor and transfer
target (user3). A new RTP session is established between user1 and user3.
• One of the parties terminates the call, and a final exchange of SIP messages takes place
to signal the completion of the call.
The flow of SIP messages in the setup between user1 and user 2 analogous to any
conventional SIP call between two parties such as that depicted in Appendix 10. The initial
INVITE message creates a header that would contain the following kind of sample data:l
INVITE user1 -> user2
From: user1 <sip: [email protected]>;tag=u1
To: user2 <sip: [email protected]>
Call ID: u1-to-u2-cid
However, after the establishment of an RTP session between the parties, user2 initiates a
transfer of the call from the handset to user 3. This requires user2 to start the transfer by
putting user 1 on hold in the following way:
1 user2 sends user1 an INVITE to hold the current RTP exchange. The message header
contain the following sample data:
INVITE (hold) user2 -> user1
From: user2 <sip: [email protected]>;tag=u2
To: user1 <sip: [email protected]>;tag=u1
Call ID: u1-to-u2-cid
2 user1 responds with a 200 OK
3 user2 acknowledges with ACK
4 user1 indicates that it now neither wishes to send nor receive media from user2 by
marking the RTP stream as inactive through the SDP session attribute "a=inactive".
5 The RTP exchange stops and user1 is now on hold
user2 announces the transfer to user3 with a dialog of messages that is again identical to a
conventional SIP call, up to the establishment of an RTP exchange. The initial INVITE
message creates a header with the following sample data:
INVITE user2 -> user3
From: user2 <sip: [email protected]>;tag=u2-2
To: user3 <sip: [email protected]>
Call ID: u2-to-u3
Of significance is the new user 2 tag, u2-2, associated with the invite. A new user2 tag is
required to differentiate between the tag used with user1 and the tag used with user3.
The dialog with user3 must also indicate that there is a pending transfer and this is also
achieved through an INVITE to hold message from user2 to user3. user2 puts user3 on hold
with the following dialog:
1 user2 sends user3 an INVITE to hold the current RTP exchange between user2 and
user3:
INVITE (hold) user2 -> user3
From: user2 <sip: [email protected]>;tag=u2-2
In step 3 above, the 200 OK from user3 is also of significance as the OK message header now
holds the call id and the From and To SIP URIs are now tagged with values so that all
subsequent messages can now be associated with the previous INVITE message.
The next step is for user2 to refer user1 to user3 so that an RTP exchange can ultimately
take place between user1 and user3.
When the transferor user2 gets an indication that the target is ringing, it sends the
transferee a Refer request (RFC 3515) with a Replaces header in the Refer-to header. The
Refer-to header instructs the transferee user1 to issue a triggered SIP INVITE request to the
target user3, to transfer Call-ID u2-to-u3 from user2 to user1. The REFER message includes
the following information for achieving the referral, for example:
REFER user2 -> user1
From: user2 <sip: [email protected]>;tag=u2-2
To: user1 <sips:[email protected]>;tag u1
Call ID: u1-to-u2
Refer-to <sips:[email protected]?Replaces=u2-to-u3;
to tag=u3; from tag=u2-2; Require=replaces>
Referred-by <sip: [email protected]>
user2 puts user1 on hold then calls user3 to announce the transfer, then places user3 on
hold. user2 transfers user1 to user3, which replaces the session between user2 and user3.
user3 then disconnects the session with user2. user1 reports success of transfer to user2
with an ACCEPTED message and user2 now disconnects with user1. In this example, the
Replaces header [RFC3891] is copied into the Refer-To URI by user2. Note that the Refer-To
URI is the Contact URI returned by user3 in the 200 OK response. This ensures that only the
correct instance of user3 is reached.
The way is now clear for user1 to setup a signaling relationship with the final recipient user3
and replace the RTP session between user2 and user3. The Replaces header indicates that
the initial call leg identified by the Call-ID u2-to-u3 is to be shut down and replaced by the
incoming INVITE request:
INVITE user1 -> user3
From: user1 <sips:[email protected]>;tag=u1-2
To: user3 <sips:[email protected]>
Call ID: u1-to-u3
Replaces: u2-to-u3;to-tag=u3; from-tag=u2-2
Supported: replaces
During the signaling setup, user1 keeps user2 informed about the progress of the setup
through one or more NOTIFY requests.
The first NOTIFY request from user1 receives a provisional 180 response from user2 to
confirm that it’s INVITE to setup the call to user3 is proceeding and that the subscription
between user1 and user2 is active. During the user1 to user3 setup, user1 must wait, for up
to 60 seconds, until the setup is complete. The NOTIFY includes the following field indicating
this subscription state:
On expiry of 60 seconds, a further NOTIFY can be issued. This NOTIFY receives a 200 OK
response from user2 confirming user2’s release from both user1 and user3. The NOTIFY
includes the following kind of information to reflect this state:
A more common architecture than the RFC example described in section 6.1.1 Attended
Transfer Example on page 40 above is a network architecture that relays calls between two
or more parties via an IP-PBX, which may also be called a Back-to-Back User Agent (B2BUA).
It is this kind of scenario where a detailed knowledge of a call flow is required because a PBX
performs functions that a proxy does not perform, such as hiding the identity of the initiator
of the call from the destination, enabling header modification and SDP manipulation of
codecs, media IP and Port, and so on.
A B2BUA acts as an endpoint to the calling party and then creates a new call to the called
party. The B2BUA therefore is an intermediate point in the call between remote endpoints.
The PBX contains functions to manage and control the call between the remote endpoints.
Other SIP functions, for example when calls are transferred to an additional party using
REFER, involve additional PBX functionality.
A call established through a PBX requires that a signaling connection initially be established
by the calling party to the PBX and then for the PBX to establish a connection to the called
party. From a SIP perspective, there are two different calls established with two different
Call-IDs.
The following is a real-life example of a basic SIP call setup via a PBX where:
• The calling party has the extension of 9910.
• The called party has the extension 9920.
• A SIP server has the IP address of 10.11.24.244. The server functions as a registrar and
defines the locations of users registered with it, for example [email protected] and
[email protected].
• The first call has the Call-ID of **4af6 and the second call a Call-ID of **02fd.
To facilitate the analysis of the call flow, the handset needs to be setup to support Remote
Packet Capture (RPCAP) logging and a trace is taken using Wireshark. For additional
information, see Appendix D.2.
Note that for the sake of clarity in the following example, only the last four characters of the
call ids are used.The asterisks denote the excluded part of the respective Call-IDs.
After these calls have been setup, RTP streams are transmitted from Party 9910 to Party
9920 and vice versa via the PBX.
The first call setup is established with an INVITE from the calling party to the called party,
and the creation of the call ID **4af6 between the calling party and the PBX:
INVITE sip:[email protected]
From: "9910"<sip:[email protected]>;epid=00013e124af6;
tag=2363920757
To: <sip:[email protected];user=phone>
Call ID: [email protected]
P-Preferred-Identity: "9910" <sip:[email protected];user=phone>
Referred-by <sip: [email protected]>
The P-Preferred-Identity header field is used from a user agent to the PBX to carry the
identity the user sending the SIP message wishes to be used for the P-Asserted-Header field
value that the PBX will insert. Using this method the PBX can indicate what identity should
be presented to the called party and what identity should be used for authenticating the
call. This feature is also useful when the PBX redirects an incoming call to a PSTN number, for
example a cell phone, to preserve the original Caller ID.
In the next message, the PBX issues a Proxy-Authenticate header consisting of a challenge
that indicates the authentication scheme and parameters applicable to the proxy:
SIP/2.0 407 Proxy Authentication Required
From: <sip:[email protected]>;epid=00013e124af6;
tag=2363920757
To: <sip:[email protected];user=phone>;tag=3629151890
Call ID: [email protected]
Proxy-Authenticate: Digest realm="10.11.24.244",nonce="2af9fe71e909d311",
qop="auth",algorith
The INVITE is acknowledged as follows:
ACK sip:[email protected]
From: "9910" <sip:[email protected]>;epid=00013e124af6;
tag=2363920757
To: <sip:[email protected];user=phone; tag=3629151890>
Call ID: [email protected]
Contact: <sip:[email protected]:5060;transport=UDP>
The calling party 9910 now responds to the challenge contained in the 407 response for
required authentication by resending the initial INVITE request; however, this time the
INVITE request includes user 9910’s authorization credentials contained in a Proxy-
Authorization header:
INVITE sip:[email protected] (with proxy authentication)
Proxy-Authorization: Digest username="9910", realm="10.11.24.244",
nonce="2af9fe71e909d311",
response="245f23415f11432b3434341c022"
From: "9910" <sip:[email protected]>;epid=00013e124af6;
tag=2363920757
To: <sip:[email protected];user=phone>
Call ID: [email protected]
Contact: <sip:[email protected]:5060;transport=UDP>
P-Preferred-Identity: "9910" <sip:[email protected];user=phone>
The PBX now attempts to establish a connection with the called party. The PBX updates the
name information field with a P-Asserted-Identity of ”Charlie” to assert the identity of the
originator:
INVITE sip:[email protected]:2051
From: "Charlie" <sip:[email protected];user=phone>;
tag=3629151892
To: <sip:[email protected];user=phone>
Call ID: [email protected]
Contact: <sip:[email protected]:5060;user=phone;transport=TCP>
P-Asserted-Identity: "Charlie" <sip:[email protected];user=phone>
The calling party now responds to the PBX with the name “Charlie” that has been assigned
to it in a 180 RINGING response to the INVITE:
180 Ringing
From: "Charlie" <sip:[email protected];user=phone>;
tag=3629151892
To: <sip:[email protected];user=phone>;tag=4184284236
Call ID: [email protected]
Contact: <sip:[email protected]:2051;transport=TCP>
P-Preferred-Identity: <sip:[email protected];user=phone>
The PBX updates the 180 RINGING with the name "Freddy" in the P-Preferred-Identity, thus
asserting “Freddy” as the name of the called party. The 180 RINGING is sent back to the
originator of the call so that “Freddy” is presented to the originator before the call is
actually answered:
180 Ringing
From: "9910" <sip:[email protected]>;epid=00013e124af6;
tag=2363920757
To: "Freddy" <sip:[email protected];user=phone>;
tag=3629151891
Call ID: [email protected]
Contact: <sip:[email protected]:5060;user=phone;transport=UDP>
P-Preferred-Identity: "Freddy" <sip:[email protected];user=phone>
The final ACKS and 200 OK result in the RTP media session being established.
A problem that can occur is that one party cannot hear the other party. In this example
scenario, an analysis of the trace reveals that despite the problem, signaling has been
completed successfully. In this situation the support engineer should:
• Take a Wireshark trace and expand the message headers to check for errors in the SDP
negotiation, such as codecs or ports. To do this, the handset needs to be setup to support
RPCAP logging as described in Appendix D.2.
• Take a trace from the handset that is unable to hear the other party and establish
whether or not RTPs packets are being sent to the handset.
• Determine where RTPs are being sent, for example, are they being sent to the correct
port or the correct IP address.
There are a number of different SDP negotiations between endpoints that can be considered
and investigated in response to problems such as one way audio. The negotiations that
should be focused on and investigated through a trace from the wired LAN are:
• Port negotiation. Check that the correct port numbers are used for the RTP session.
• IP address negotiation: Check whether or not the other party has updated its SDP with its
IP address.
• Payload negotiation: Whether the correct codec has been configured.
• DTMF negotiation. DTMF may be generated inband or through SIP info.
• Packet interval negotiation: check whether the RTP packet interval between the
endpoints is too great. For example, one way audio may be the result of the receiving
end supporting a minimum packet interval of 30 ms while the sending end negotiates
that packets are sent every 20 ms.
Send the trace to Ascom for further analysis.
Make sure that the attributes of the SDP signaling on either side are correct and that the
RTP stream is bidirectional.
Check that one of the parties is not still on hold.
Refer to RFC 3665 for additional information. This describes the best common practice for
SIP calls.
Voice Activity Detection (VAD) detects if the speaker is silent. To save bandwidth, the
transmitting device refrains from transmitting RTP packets for the duration of the silent
period. However, total silence can also lead to problems such as a perception by the parties
that the call has been dropped, sudden jarring changes in noise levels as the conversation is
resumed, and a general choppiness to the overall conversation.
To ameliorate these effects, a synthetic background or so called comfort noise may be used
to fill the silent periods and make them sound more natural.
When troubleshooting one way or no audio problems, check if one of the parties is using
VAD and comfort noise. If, for example, the other end is not being heard, then turn off VAD
at that end to see if that resolves the issue.
User experience voice problems, both poor voice quality or audio gaps while moving through
the site.
Software
Check that the WLAN and handset have compatible software versions and are configured
properly:
1 Using the shortcut *#34# open the handset Device Information menu and select
Software. Note the value of the SW version parameter.
2 Obtain the Application Partner Program, Ascom Inter-Operability Reports for vendor
equipment from the Ascom Partner web site.
Analyze Result
3 Check that the WLAN and handset have compatible software versions and are
configured according to Ascom interoperability report. Are incorrect configurations or
software version incompatibilities found?
Yes: Perform a system upgrade or open the PDM to reconfigure parameters,
No: Go to the section Coverage.
Coverage
Roaming
Check if audio problems are present while moving through the site in call mode:
8 Make a call to another party and move through the site while holding a conversation
with the other party.
9 During a call, with the RSSI screen activated, monitor the RSSI value and see if the
audio problem is experienced during the handset roam.
Analyze Results
10 Are audio problems experienced?
Yes: Go to step 14.
No: Investigate possible problems caused by incorrect QoS settings, RF access
problems and internal interference described in steps 11 to 13.
QoS
11 Control QoS in the handset Syslog and confirm that both Rx and Tx have UP 6, if not
QoS needs to be corrected in the LAN/WLAN. For additional information, see section
Figure 14. Traceroute Result on page 39.
RF Access
External Interference
18 External interference may occur when VoWiFi devices are forced to share the RF
spectrum with other devices. Such devices often create interference for wireless LAN
users. Perform a site survey with a spectrum analyzer to identify sources of
interference.
19 Perform an air trace of a roam to determine whether or not RTP data is both sent and
received by the handset. If RTP data isn't received by the handset investigate that
the LAN switch is routing the RTP to the AP correctly. For additional information, see
Appendix A.
Security
If Extensible Authentication Protocol (EAP) security is used, check if the full EAP exchange is
performed during the roam with an air trace or log of the Radius server. Normally the key-
caching function in the WLAN system and handset prevent a full EAP exchange during roam.
A “No Network” message indicates a Layer 1 or layer2 fault. If there is no access to the
WLAN, there is no AP to associate with, which may be caused by the handset being out of
range or by incorrectly configured WLAN network parameters.
The signal strength bar graph indicates that no signal is being received and the handset
starts to beep once per minute. A vibrator may also be configured to indicate that no signal
is being received by accessing the parameter Device > General > No system warning. If the
parameter is set to “Sound repeatedly”, the vibrator is turned on and the handset vibrates
for up to 30 minutes.
Tip: To turn off the beep, press the mute button on the left side of the handset.
Examples of incorrect WLAN parameter settings include:
• Incorrect network profile selected
• Missing or incorrect SSID
• Incorrect security parameters
• Incorrect radio settings.
1 From the PDM, Edit parameters dialog, select Network > General and inspect the
value of the Active network parameter.
2 Check that the correct system (A, B, C or D) setting is selected. (The handset may be
configured for four different sets of WiFi parameters). This can be checked from the
Connections menu and the Device Manager, Network > General menu. If the
parameter Auto-switch network is “Enabled”, make sure that the Network is included
in the auto-switch network. To confirm this, check that the Network’s parameter
Include in auto-switch network is set to “Yes”. Note that this parameter is only visible
when Auto-switched network is enabled.
1 From the handset, select the PDM menu Network > Network or from the handset
display select Admin menu, Network setup > SSID.
Note: The SSID is case sensitive.
2 Inspect the value of the SSID in the handset display.
1 From the PDM, Edit parameters dialog, select Network and from the list of Network A,
B, C and D select the active network. Alternatively, from the handset display, select
Admin menu then Network setup > 802.11 protocol.
2 Inspect the value of the 802.11 parameter and make sure the correct protocol value
is configured.
3 Inspect the value of the 802.11<protocol> channels parameter and check what
channels are used.
Note: The handset uses by default the channels 1, 6 and 11 for the 2.4 GHz band. If
the infrastructure is configured to use any other channel, change it to use only 1, 6
and 11 as this is the recommended setting. If the WLAN is using another channel
scheme like 1, 7, 13 (not recommended because chances are higher for other-channel
interference) the channels must be set in the handset using the PDM.
Check that for the 5 GHz band, that the channels that are selected, are the same as
the network channels. The default value is “All”. A good choice is to use one of the
preset UNII band selections. It is also possible to manually enter the channel numbers,
to exactly meet the setup of the Voice WLAN.
Note: The handset can use the DFS channels in a Voice enabled WLAN, but the Voice
quality can be distorted as the DFS channels must be treated differently in the
scanning process. See section 3.7 DFS Channel Probing on page 19.
7.1.3 No Access
A “No access” message indicates a Layer 3 fault. The handset has successfully associated
with an AP but it cannot connect to either the IP-PBX or the Unite system. This may be
because the application services are not running or the services are running but the handset
is unable to connect to the services due to faulty IP address configuration.
Tip: A support engineer will often need to check for problems on the wired side of the
installation as well as the wireless side and should be equipped with adequate tools for
troubleshooting wired LANs.
1 Check IP address. From the handset Device info > Network info menu described in
Appendix B and inspect the value of the Phone IP parameter to see if the handset has
an IP address.
- If using static IP addresses: Check that the settings are correct and that there is no
IP conflict with another device. Pay special attention to the value of “Default
gateway” if the IP PBX is on another subnet or VLAN.
- If using DHCP-server delivered IP addresses: Check that there is connection to the
DHCP server.
2 DHCP problems may also be the case if the there is no access to the DCHP server in a
LAN that is segmented using subnets or VLANs.
To test DHCP problem perform one or more of the following steps:
- Try to set the IP-address parameters manually. If access is restored it clearly
indicates a DHCP problem.
Tip: To exclude TCP/IP stack problems in the handset, ping the handset from a laptop
and also browse to the handset's web interface.
- Use a laptop with a wireless card to see if the laptop receives an IP address.
- Use a wired connection to the same switched network/VLAN as the AP (or
controller) is connected to, to test if it receives an IP address over DHCP.
- It is also possible to take help of a network administrator and try to ping to or from
an AP or other device to the DHCP server. If this is successful the DHCP problem is in
the wireless part of the site.
Tip: If a wireless sniffer is available, configure it for the correct encryption key and try
to decode packets both from and to the handset.
If the handset initiates the DHCP handshake function, the problem is that the AP isn’t
forwarding DHCP offers or the wrong address is sent out. Check for the possibility
that the WLAN internal DHCP server does not work.
A common cause is that the VLAN/SSID/USER CLASS mapping is wrong and that the
DHCP server cannot be reached from the wireless side.
3 If the handset has an IP-address the problem is either in the Services setup, or the IP-
PBX and Unite services are not reachable.
Major causes can be:
• Wrong IP address parameter settings for VoIP and Unite.
• Login credentials to the services are wrong.
• The handset is not registered in the services.
• Services are on another (sub) network and routing to that LAN is not functioning.
Test the access for VoIP and Unite (for Messaging and Alarm functions) individually
as follows:
A test for Unite access is, for example, to login to the Central Device Manager and see
if it is successful. Check that the hardware the Unite service is installed on is running
by performing the following steps:
1 Ping the Unite hardware from the handset or a laptop.
2 Was the ping successfully echoed?
No: check the IP settings of the Unite module.
Yes: check if other handsets are listed as online in the Central Device Manager.
3 Check the Unite settings in the handset. The handset must have a User ID set.
Tip: Some of the Unite login parameters can be read from the Admin menu in the
handset but it is best to use the Device Manager in the PDM and Unite CM/IMS3.
4 Check the following parameters using the Device Manager in the PDM and Unite CM/
IMS3:
• The IP address to the Messaging gateway.
• If the correct password has been used at login.
Messaging Only
A “Messaging only” message indicates that the handset is configured to use both Voice and
Messaging, but has lost contact with the PBX.
1 Perform the same checks for Voice problems described in section Test for Voice
Access on page 53. Test for Voice access and then go to step 2.
2 Try to send a message. The idle connection check interval to the IMS3 is much longer
than to the gateway.
Note: Sometimes when all network connections are lost the handset will show
“Messaging only” for quite some time because it discovers it has lost connection to
the gateway much faster than it discovers loss of connection to the IMS3.
Voice Only
A “Voice only” message indicates that the handset is configured to use both a PBX and an
Unite Messaging gateway (like IMS3) but has lost contact with the Messaging gateway.
1 Perform the checks described in the section Test for Unite Access on page 53.
Note: When a handset is placed in the programming cradle that is connected to a PC
running PDM will it display “Voice only” and not receive SMSs.
2 If the Messaging function is not used in the system, verify that the IP-address to
Unite is set to the default value of “0.0.0.0”.
7.1.5 No Channel
A “No channel available” message indicates one or more of the following situations:
• The handset did not receive the expected answer from the PBX during call setup.
• The user attempts to make a call when the handset is displaying “Messaging only”.
If the battery level drops significantly faster than expected, two major causes are that the
battery is old and discharges rapidly or the handset is using its radio too often when not
making calls. Even when not making a call the handset needs to use its radio to perform
background tasks such listening for incoming calls, for performing scans at cell boundaries
and for collecting information for location services.
If the handset is unable to leave active status when performing background tasks, the
battery drains fast. The same problem arises if U-APSD has not been setup correctly and the
power save mode is not working correctly.
To investigate battery problems, perform the following checks:
1 Use a different battery to check if the problem reoccurs on one or more phones. <If
the problem reoccurs, check that the correct chargers are being used.
2 Check the production date of the battery and replace with a new one if necessary.
The battery has a minimum 80% capacity left after 400 charging cycles at 20±5°C.
3 Check Beacon interval and DTIM periods in the AP using the handset Device info >
WLAN info menu described in Appendix B.1. These values should be set to the
recommended value for the infrastructure according to Interoperability
documentation. For additional information, see Figure 3. Handset Operating in U-
APSD PS Mode on page 17.
Note: The settings are done in the WLAN infrastructure and not in the handset.
Incorrect settings will reduce battery time on all handsets in the cell.
4 If the system is setup to use U-APSD for voice calls, check the voice power save mode
parameter in the PDM. Pay special attention to the QoS settings and ensure that
these are set correctly.
5 Use a protocol analyzer on both the wired and wireless side, and check the amount of
broadcast traffic that is transmitted over the WLAN.
Broadcasts created in the LAN normally are conveyed over the WLAN as broadcast or
multiple unicast packets. A WLAN administrator may block this translation. Note that
broadcasts are sent at the lowest mandatory speed, and if changed to unicast, may
create copies for each client.
One example of a protocol that uses broadcasts is the ARP protocol. Blocking ARPs to
handsets can normally be set in the AP, that will act as an ARP proxy on behalf of the
handset, and send the ARP reply instead.
A handset will not be able to use U-APSD if the AP does not support U-APSD. U-APSD
support is indicated in the QoS information element.
To locate the QoS element, select the 802.11 Beacon from the Protocol column shown in the
Capture > Packets summary table in figure 17. Detail information for the selected beacon is
displayed in the text area under the summary table. The WMM tag of interest is present in
beacons and probe responses and is shown in the WMM parameter element. In the example
The handset advertises its use of U-APSD and negotiates the use of U-APSD during the
association process. An association process when U-APSD is enabled is illustrated in figure
18:
Figure 18. U-APSD Category Assignment
Section 3.5.2 U-APSD PS Mode Operation on page 15 describes the procedure where an AP
starts an unscheduled service period and delivers buffered frames when it receives a trigger
frame from the handset. A voice packet acts as the trigger.
This section describes how the an unscheduled service period may be interpreted in an
OmniPeek trace. In figure 19 an uplink trigger frame triggers buffered data and the correct
QoS settings are verified. These settings are UP 6 for both the voice queue and signaling
data.
1 The five packets that have been buffered by the AP for delivery to the handset.
2 The voice packet that acts as the trigger frame from the handset.
The transmissions by the AP in response to the trigger are shown in figure 20:
8
9
The third packet in the sequence is a PING request as shown in figure 21. Even though the
packet is not a voice packet, it is transmitted during the unscheduled service period.
10
11
12
13
14
15
16
17
18
19
20
8. Related Documents
9. Document History
For details in the latest version, see change bars in the document.
Version Date Description
A 28 June 2012 First released version
Note: If other air trace tools than Omnipeek are used, the traces must be saved in Packet
Capture (PCAP) format. This is a TAC requirement.
Prerequisite
• The support engineer should have already investigated and ruled out relatively easy to
identify causes such as incorrectly configured parameters and incompatible software
versions.
• Layer 1 problems, that is, RF problems, should also have been investigated and
eliminated as a cause of a problem through a site survey and by doing a site survey and
spectrum analysis. Problems like co-channel interference, under or over coverage, rogue
WLAN transmitters and analog interference sources should also have been addressed.
Requirements
To perform an air trace, the support engineer should be equipped with the following:
• A portable PC
• The Omnipeek Airtrace tool. This is used to take wireless sniffer traces of:
- The AP that is transmitting
- The handset that is transmitting
- Other air traffic
• 3 WLAN adapters for the g-radio band (dual band is recommended) and 4WLAN
adapters for the a-radio band
Note: If there is only one specific problem that is easy to reproduce, one WLAN adapter is
sufficient.
Prerequisites
Software
Parameter Remark
SW version: The current software version used by the handset.
Release date: The date when the software was released.
Release time: The time of the day when the software was released.
Hardware
Parameter Remark
S/N: Serial number. Use when ordering licenses and for handset inventory in
the Device Manager.
Tip: It is also possibly to scan the number from the label behind the
battery.
Unit ID: For information purpose only.
MAC: The sub layer 1 MAC address used in frames sent and received. Same
address is used independent of the frequency band selected.
Tip: The first six octets are useful in creating filters in air-log files to
remove other WLAN packets.
HW type: For information purpose only.
HW rev: For information purpose only.
Production date: For information purposes only. Identifies the year and week the handset
was produced.
License
WLAN info
Shows a combination of information retrieved from the associated AP's beacon and stored
information in the handset.
Parameter Remark
SSID (channel): The configured ESSID for the selected network profile and the
associated APs radio channel. The channel number whether the handset
is running in the 2.4 GHz or 5 GHz band.
Note: This value must be set for the intended WLAN. Check the spelling
if there is no access to the network as this value is case sensitive.
Tip: The SSID value can be configured from the Admin menu. For
additional information, see the section SSID on page 66.
Parameter Remark
Security mode: The current authentication and encryption selected in the association.
Beacon period: The beacon period value set in the associated AP.
DTIM: Shows the current DTIM period used by the AP. Possibility to, via the
handset, check that the value should be the same as the deployment
settings used by the APs and the recommended settings in the inter-
operability documents.
QoS: The current Quality of Service (QoS) used.
Privacy: If on, it shows if any kind of encryption is used.
Tx power: The current transmit power.
Network Info
The current IP address (and related information to it) received from the DHCP server, if used,
or if set manually.
Note: There is no indication if the IP addresses were set by a server or manually.
Parameter Remark
Phone IP: The current handset IP address.
Subnet mask: The current subnet mask.
Default gateway: The current default gateway IP address.
Primary DNS: The current DNS IP address.
Syslog server IP: The current Syslog server IP address used to transfer the Syslog
messages from the handset to a remote location.
Firmware TFTP IP: The current firmware Trivial File Transfer Protocol (TFTP) IP address.
Alternative way to upgrade the handset firmware using the boot
process.
User ID
The login ID used to login to the Unite CM/IMSis normally the same as the phone number.
The Endpoint number is also synchronized with this value.
Show RSSI
Parameter Remark
SSID: The identity of the currently associated SSID
Current AP: The handset displays the following information about the AP it
is currently associated with:
- The strength of the RF signal it is receiving from the AP,
expressed in dBm
- The channel the associated AP is using
- The power save mode where “P” denotes Power Save mode
and “A” denotes Active mode.
Current AP MAC: The MAC address of the AP, that is, its BSSID.
Previous AP: If the user has been roaming while the RSSI screen is active, the
handset displays the following information about the previous
AP that the handset was associated with:
- The strength of the RF signal, expressed in dBm, that is was
receiving as the user left that AP's coverage area.
- The channel that the previous AP used
- The power save mode where “P” denotes Power Save mode
and “A” denotes Active mode.
Previous MAC The radio MAC address of the previous AP, that is, its BSSID.
address:
Note: The Show RSSI display can be displayed without the rest of the Site Survey Tool
parameters by using the shortcut *#76#. For additional information, see section 5.2.1
Show RSSI on page 33.
Scans the channels defined in the handset to detect the access points, by default for 2.4
GHz: Channel 1,6,11 and for 5 GHz: All channels.
Note: Regulatory domain may further limit which channels that are used by the handset.
Scans selected channel in the handset to detect the AP on any channel. (The handset does
not need to be configured for the channel.)
Range Beep
A beep that is played whenever the handset measures a filtered field strength of below the
configured value (default -70 dBm) from the currently associated AP.
Note: Since the value is filtered, sudden drops in field strength caused by the environment,
for example walking through a door into a room, can be delayed. It is therefore important to
walk through the site slowly to ensure that all weak spots are covered.
Location Survey
Possibility to use Site survey mode for Ekahau that will cause location scanning to be
performed at shorter intervals: 1s.
Device Info
Network Setup
Note: The Network Setup function should only be used to check settings and modify
parameter values while troubleshooting problems. It should not be used as the main
method for setting up and configuring handsets. The PDM is provided for this purpose.
Option Remark
Network name Allows a user friendly name for the current Network profile used in the
handset. The network name is not the SSID but it can be set to
correspond to it.
IP addresses The default IP address set by DHCP. However, a static IP address may be
entered manually. If using a static IP address, the following parameters
can be set:
- Phone IP
- Subnet mask
- Default gateway
- Primary DNS IP-address
- TFTP server IP address
SSID Specifies the SSID setup in the WLAN.
Note: Entering a SSID with a complex combination of alphanumeric
characters may not easy from the keypad. The PDM provides an
alternative means of entering the SSID by selecting Network >
<network id> > SSID.
Tip: The SSID is also shown in Device info> WLAN info, as long as the
handset is associated with an AP.
802.11 protocol Configures the radio settings (802.11 b/g, 802.11 b/g/n, 802.11a or
802.11a/n.
Security mode Configures the various encryption and authentication schemes:
- Open (Default setting in handset with no security)
- WEP (64 or 128 bits)
- WPA-PSK/WPA2-PSK (If both are supported by the AP the handset
selects the stronger WPA2.)
Unite
IP address If using any Unite based services like Messaging or Alarm functions, the
IP address of the centralized management module Unite CM/IMS3 is set
here.
Password Used to protect the login to the Unite system.
Note: Password must match the password set in the Unite system. The
default value is an empty string.
VoIP
Endpoint ID Many PBXs allow a handset to register with an Endpoint ID, for example,
a user name instead of the number. If used, this value must match the
value set in the PBX. For example this can be used for SIP registration.
Note: To use the Endpoint ID for registration, use the PDM and access
the parameter VoIP > SIP > Registration identity and change the value
of the parameter from the default “Endpoint number” to “Endpoint ID”.
Note: If both Endpoint ID and Endpoint number are configured, some
PBXs require that both numbers must match.
Protocol H.323 or SIP may be selected. Click the handset Edit button to access the
parameters associated with the respective protocol and then check with
a systems or PBX administrator for the required values.
For H.323 the following values are required:
- Gatekeeper IP address or Gatekeeper ID
- Gatekeeper password
For SIP the following values are required:
- SIP proxy IP address or SIP proxy ID
- SIP proxy password
Syslog
Logging
Logging mode The handset can be configured to one of the following logging modes:
- Trace: Used together with the Portable Device Logger (PDL)
troubleshooting tool. Note: This mode must only be used if requested by
TAC.
- RPCAP: Used with Wireshark or similar tools when WLAN access to the
handset is functional.
- PCAP over USB: Used with the PDL (version 1.6.0 or later)
troubleshooting tool when WLAN access to the handset is not working.
Note: May sometimes produce a corrupt PCAP file that cannot be fully
opened in WireShark.
Extended logging A handset configured to one of the above logging modes may also be
configured to include one or more of the following types of traffic:
- Phone: Internal signal debugging traces
- SIP: Logs including SIP traffic
- H.323: Logs including H.323 traffic.
- Network Traffic: Logs all WLAN traffic application frames, for example
SIP, H.323, ARP, DHCP, RTP etcetera.
For additional information about the handset PCAP log function when setting up Wireshark
Troubleshooting
Used for extended authentication of WLAN. When the function is enabled, one of the
following dialogs is displayed in response to the particular problem:
Dialog Description
"WLAN authentication failed" Authentication to RADIUS server failed, possibly due to
wrong user or password.
"WLAN authentication timed out" Authentication to RADIUS server timed out. Possibly
due to incorrectly configured RADIUS server or
connection to the RADIUS server (wrong IP address).
Also shown if supplicant times out during key
negotiation for WPA(2)-PSK (Pre Shared Key).
License keys can be obtained from the handset supplier. Use this manual entry feature if
access to any Device Manager is missing.
Factory Reset
Erases all settings back to the default values except for the License key setting.
Public Key Certificates are used for key exchange and authentication. They are simply
electronic documents (files) that incorporate a digital signature to bind together a public
key with an identity (information such as the name or a person or organization, their
address, and so forth).
The signature may be signed by a trusted entity called a Certificate Authority or
Certification Authority (CA), see Appendix C.1.2.
The most common use of public key certificates is for TLS certificates (https websites).
A CA is a trusted entity which issues public key certificates. The certificates contain a public
key and the identity of the owner. The CA asserts that the public key belongs to the owner,
so that users and relying parties can trust the information in the certificate.
A Certificate Signing Request (CSR) or Certification Request is a message that is generated
and sent to a CA to apply for a TLS certificate. Before the CSR is created a key pair is
generated, the private key kept secret. The CSR will contain the corresponding public key
and information identifying the applicant (such as distinguished name). The private key is
not part of the CSR but is used to digitally sign the entire request. Other credentials may
accompany the CSR.
If the request is successful, the CA will send back an identity certificate that has been
digitally signed with the CA’s private key.
A CSR is valid for the server where the certificate will be installed.
C.2 Cryptography
Cryptography is the encoding of messages to render them unreadable by anyone other than
their intended recipient(s). Modern cryptography uses complex algorithms implemented on
modern computer systems.
Cryptography tasks can be divided into the two general categories Encryption and
Authentication.
C.2.1 Encryption
the correct key, converts the ciphertext back into plaintext. Public key algorithms use paired
keys, one for encryption and another for decryption.
C.2.2 Authentication
General Practices
• Always try to capture as much data as possible. If filtering options exists try to filter the
result after the capture is saved. Applying a filter to the capture itself may exclude
interesting packets and ultimately render the capture useless.
• When capturing wireless bear in mind that the capture device has the same limitations
as other wireless devices, that is, it will miss packets, be subjected to disturbances and
can be out of range. To ensure the best possible wireless capture try to place the capture
device in between the monitored devices, that is, between the handset and the AP. Do
not place the capture device too close to another wireless device and keep at least 0.5 m
between the capture device and monitored devices. If placed too close, traffic may be
overheard on the wrong channels, for example packets on channel 6 will appear on
channel 11, or not heard at all due to saturated receivers.
• A result without knowing what happened during the capture is of little use. Try to make
note of what the capture is designed to capture and what devices are involved, what
devices are present and what was expected to happen but did not.
• Try not to influence the monitored system. For example, if capturing wired traffic with
Wireshark or OmniPeek, consider disabling name resolution because each IP/name
lookup will generate traffic from your PC to the DNS server.
• If data on one channel is to be recorded the WLAN adapter can only be set to listen to
one channel. If roaming is going to be monitored, two or more channels need to be
monitored, in which case one adapter per channel is required.
1 With the handset in idle mode, enter Menu > Settings > 40022. The Admin menu is
displayed.
2 Select Logging. The Logging menu is displayed.
3 Is the first menu item Logging mode RPCAP?
Yes: The handset is already setup for RPCAP logging. Go to step 7.
No: Go to step 4.
4 Select Logging mode <xxx> where xxx is one of the available alternative logging
modes. The Logging mode xxx menu is displayed.
5 Deselect the radio button associated with the alternative logging mode and select
the RPCAP radio button.
6 Return to the Logging menu by pressing the handset Back button.
7 Select Extended logging. The Extended logging options are displayed.
8 Tick the SIP checkbox. Ensure that the other checkboxes are not ticked.The handset is
now configured to provide Wireshark with the required traffic logs for the analysis.
To run a Wireshark session, you require the IP address of the handset. perform the following
steps:
1 With your handset still in Administrative mode, return to the Admin menu.
2 Select Device info. The Device info menu is displayed.
3 Select Network info. The Network info menu is displayed.
4 Make a note of the value of the Phone IP address.
To analyze a call from the handset using Wireshark, perform the following steps:
1 Start Wireshark from the Wireshark icon on your desktop, taskbar or Start Programs
menu. The Wireshark Network Analyzer window is displayed.
2 Click Capture Options. The Wireshark: Capture Options window is opened.
3 Click the Add Remote Interfaces button. The Wireshark: Remote Interfaces dialog is
opened.
4 In the Host: field, enter the IP address of the handset that you noted down in step 4
of the previous procedure followed by /trace. For example: 172.20.15.139/trace.
5 Click the OK button. The Wireshark: Capture Options, Capture pane is updated with
the details of the trace you have specified for the handset.
6 Tick the Capture checkbox next to the new trace and click the Start button. The
Capturing from Network adapter ’TRACE’ on remote node <ip address> pane is
displayed, where IP address is the address of the handset from step 4. Wireshark is
now ready to trace a call from the handset.
7 Initiate a call from the handset. Try to reproduce exactly the conditions as described
in the issue or ticket that describes the problems that the user or users have
reported.
8 On the termination of the call, halt the Wireshark trace by clicking the Stop the live
capture icon from the toolbar.
9 Packets captured in a Wireshark trace are displayed in the Network Adapter TRACE
on remote node >handset IP address> pane.
Note: The setup described in the above example may vary depending on the Wireshark
function being used.
For additional information about Wireshark, see http://www.wireshark.org.
E.1 Signaling
E.1.1 SIP
E.1.2 H.323
MAC................................................................................. 5
address resolution............................................. 12
AP ............................................................................. 6
physical sublayers ............................................. 10
N
No Access message in handset ............................ 52
No Channel message in handset .......................... 54
P
Ping utility ................................................................. 38