TryLearn More

Use SIP trunks, WebRTC & Apps

Slash your Phone Bill by 80%

Analyzing a SIP Call

This document describes how a SIP call is established in 3CX Phone System, and what events will be written to the “Server Activity Log” page in the 3CX Management console. Using this call flow description, and by analyzing the events, you will be able to better understand what’s going on and troubleshoot potential problems. Note that the call flow below is identical for both incoming and outgoing calls.

Step 1: Identifying the source of the caller

A call is initiated by a caller by picking up the phone and sending a SIP INVITE. When 3CX Phone System receives a SIP INVITE from a caller, a Call History event “Incoming” is written to the server status log:

12:03:20.734| Log(2): | Incoming | c1 | “232” <sip:232@> | <sip:900@> | Incoming call (before routing)

The entry “232” <sip:232@> is the SIP address of the caller. The address can be interpreted as follows:

  1. “232” is the “display name” of the caller;
  2. 232 (after <sip:… ) is its “user name” (extension number);
  3. < number); (extension name’ ‘user its is )>IP address or domain name is the host or domain where it is registered.

The entry <sip:900@…> is the SIP address of the destination of the call.

Note that the event is called incoming, even though it could be both an inbound or an outbound call. Incoming refers to the fact that the PBX server is receiving a request from a caller – which could be an incoming or an outbound call.

Step 2: Verifying the source of the caller

3CX Phone System will now try resolve the source of the caller:

  1. If the call originates from a line configured on the 3CX Phone System (i.e the call is being received from a PSTN or VOIP Provider line), the following event will be logged:12:03:20.734| Log (2): | Call is incoming from line [#1234578 @Dlink]If the source’s host/IP matches one of the known gateways, but the given line number is not found among lines defined for the gateway, the call will be rejected and the following warning message will appear:12:03:20.734| Warning( 1): | Incoming call appears to be from gateway DLink, but line number #12345678 is unknown to phone system
  2. VOIP provider and VOIP Gateway lines do not need to be registered. To allow for wider support of gateways and providers (which work differently sometimes), 3CX Phone System will place or receive the call, even if the source is not registered.
  3. Now, 3CX Phone System will check if the call is made from an extension registered with 3CX Phone System. If it is found, the following event is written to the log:12:03:20.734| Log (2): | Registrar resolved as <addr> as <addr>If the extension is not found or is not registered the following message appears:12:03:20.734| Log (2): | Registrar can not resolve <addr>
  4. If the source of the caller can not be resolved, the Call History event ‘Rejected’ is generated:12:03:20.781| Log(2): | Rejected | c1 | “232” <sip:232@> | <sip:900@> | Attempt to call from an extension/line that is not registered/known to the phone systemIn this case the call initiator gets a SIP response ‘403 Forbidden’. This will be displayed on his/her SIP phone. At this point the call is terminated and a corresponding Call History event is generated:12:03:20.781| Log (2): | Terminated | c1 | “232” <sip:232@> | <sip:900@> | Call ended

Step 3: Finding the destination of the call

If the source of the call has been determined, the next step is to find the destination for the call.

  1. If the caller is from a PSTN or VOIP provider line, the associated inbound rule is used to find the extension number to forward the call to. The system checks whether the extension is registered with the system. If the extension is known and is registered, the following event is logged:……… Found destination <dest> for caller <caller>Now the phone system checks if the call is from an extension for an outbound number. It does this by applying outbound rules to the dialled number. If a rule matches the number it is an outbound call (for example it finds a prefix 0)If no outbound rule can been matched it is assumed that the destination is an internal number (extension, ring group, IVR, etc.) and the system will try to find it in systems database. If it is an extension, but this extension is not registered, the following warning is written to the log:
  2. Destination <dest> has been found for <caller>, but it hasn’t been registered! Unable to complete call.
  3. If the number is not found in the systems database it may be a Ring Group, Queue* or Conference* call. If it is, we proceed to the next point.
  4. If the dialed number is completely unknown to the phone system, the call is rejected and the following event is written to the server status log.14:21:58.840| Warn (1): | Dialed number 79306288 is not known to the phone system

After both source and destination have been resolved, the following Call History event is issued:

14:20:42.762| Log (2): | Routed | c2 | “103” <sip:103@> | <sip:079306288@> | From: Ext:103; To: [#25405292]

Step 4: 3CX Phone System returns the invite

Now that both source and destination are known, 3CX Phone System returns the invite:

  1. 3CX Phone System sends an INVITE to the resolved destination address and writes the following Call History event to the server status log:14:20:49.575| Log(2): | Calling | c2 | “103” <sip:103@> | <sip:079306288@>| Send INVITE to [#25405292]
  2. If a response does not arrive within 30 seconds, the call fails and the following Call history event is written to the log:14:21:29.903| Log (2): | Failed | c2 | “103” <sip:103@> | <sip:079306288@>| Call failed, reason: Request Timeout
  3. If a response is received the following Call History event is logged:14:19:46.403| Log(2): | Got response from | <sip:101@;cid=0>;tag=b6edc8bfc47cda77 on invite from <sip:103@;cid=0>;tag=766caf3f. Response line: SIP/2.0 180 Ringing
  4. Now the call will be either established – callee picks up the phone – , or terminated – caller hangs up the phone before answering. If the call is terminated, the terminated event in the Call History is as follows:14:19:52.059| Log (2): | Terminated | c1 | “103”<sip:103@> | <sip:101@> | Call ended
  5. If the call is established the following Call History event is written to the log:15:55:39.371| Log(2): | Established | c6 | “103”<sip:103@> | <sip:101@> | Call is established
  6. When the call is terminated – i.e caller or callee hangs up his phone – another Call History event is issued.
By |August 4th, 2009|Comments Off on Analyzing a SIP Call

Free for up to 1 year! Select preferred deployment:


for Linux on a $200 appliance or as a VM

Get the ISO


for Windows as a VM

Download the setup file

On the cloud

In your Google, Amazon, Azure account

Take the PBX Express