Help identifying how a call ended up at its destination (BL Viewer Edition)

[Alphabetic]

Hi all,

I have to figure out how a call ended up at EXT 624 from Queue 808.

624 is not in this queue.

Call Report log shows that inbound CID -> Trunk -> was transferred to 624

Im going through Bin Log Viewer searching CallID and the DN (please let me know if i can better use tags)

I'm going to paste some entries I find relevant In the hope someone can help identify what happened.

At the moment, my suspicion is that ext 441 (Q manager) blind transferred the call to 624 - need to figure out how if so.

09/07/2026 14:07:38:301 | 10 | Call(C:281): Transfer request: Incoming params:

CA_active_connection_id = 1627 (i32)

CA_to = '624'

CA_dn = '441'

CA_divert_reason = 0 (i32)

CA_call_id = 281 (i32)

CA_leg_id = 3 (i32)

CA_transaction_id = '3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18'

09/07/2026 14:07:38:301 | 10 | CARefer: L:281.3[Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f}], is referring to=624
09/07/2026 14:07:38:301 | 10 | CARefer: transferor is overriden: Extn:441{}
09/07/2026 14:07:38:301 | 13 | C:281 Transfer request from L:281.3[Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f}] by Extn:441{}
09/07/2026 14:07:38:301 | 13 | C:281 Referred leg : L:281.1[Line:10009<<+<CallerID>{00000000-01dd-0fa0-0710-7c290000063d}]
09/07/2026 14:07:38:301 | 13 | L:281.1[Line:10009<<+<CallerID>{00000000-01dd-0fa0-0710-7c290000063d}] build target endpoint to Extn.624 on behalf of Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f} using source "+<CallerID>"<sip:+<CallerID>@<3CXFQDN>:5060;nf=e>
09/07/2026 14:07:38:301 | 13 | Extn:624 display name: '+<CallerID>'
09/07/2026 14:07:38:301 | 13 | Extn:624{}: is not busy
09/07/2026 14:07:38:301 | 13 | C:281 % TargetAdded Extn:624{}
09/07/2026 14:07:38:301 | 13 | L:281.3[Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f}] accepting REFER
09/07/2026 14:07:38:301 | 13 | [BxfRR](C:281): ctor, ref L:281.1[Line:10009<<+<CallerID>{00000000-01dd-0fa0-0710-7c290000063d}] -> Route:ROUTER@{}624{}
09/07/2026 14:07:38:301 | 13 | C:281 Ready to start blind transfer
09/07/2026 14:07:38:301 | 13 | [BxfRR](C:281): Starting blind transfer to SingleDest(669306472):  referred party: L:281.1[Line:10009<<+<CallerID>{00000000-01dd-0fa0-0710-7c290000063d}], return to Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f}
09/07/2026 14:07:38:301 | 13 | [BxfRR](C:281): Referred-By info: refbydn 441, refby header: <sip:441@<3CXFQDN>:5060>
09/07/2026 14:07:38:301 | 13 | [CDR] Call(C:281): transfer init: referred L:281.1[Line:10009<<+<CallerID>{00000000-01dd-0fa0-0710-7c290000063d}], transferor Queue:808{00000000-01dd-0fa0-0714-ff2d0000063f}, target Extn:624{}, reason none
09/07/2026 14:07:38:302 | 13 | [BxfRR](C:281):  Party changed (ringing): L:281.4[Route:ROUTER@{}624{00000000-01dd-0fa3-eab8-539f000006c0}]
09/07/2026 14:07:48:873 | 13 | [BxfRR](C:281):  dtor

any help appreciated

 

[NikosT_3CX]

@Alphabetic check the Management Console log, if there is a transfer from the Panel, you will see the request there

 

[Alphabetic]

@Alphabetic check the Management Console log, if there is a transfer from the Panel, you will see the request there

Hi Nikos

thanks for the quick reply.

im having a look through the logs and I am seeing stuff, but not quite sure what it means (3CX terminology I guess)

Hopefully this is relevant?

2026-07-09 14:07:38.038|0098|Trace| [_3CX.Http] [10]+<3CX_WAN_IP> POST /MyPhone/MPWebService.asmx - application/octet-stream 8
2026-07-09 14:07:38.048|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000006)
2026-07-09 14:07:38.048|0098|Debug| [MyPhone.ServerMessageFactory] Incoming request: messageID=124. (traceid=0HNMT58MCFPRU:00000006). Current requests: 1.
2026-07-09 14:07:38.058|0098|Debug| [MyPhone.ServerMessageFactory] ([124 RequestConnectionAccessRights]) - 00:00:00.0097146 - from 441[49254f82-a0e8-0ae8***]@<3CX_WAN_IP>. Requests:1 -> 0 (traceid=0HNMT58MCFPRU:00000006)
2026-07-09 14:07:38.063|0098| Info| [_3CX.Http] [9]-<3CX_WAN_IP> POST /MyPhone/MPWebService.asmx - 200 8 application/octet-stream 24.5220ms
2026-07-09 14:07:38.274|0033|Trace| [_3CX.Http] [10]+<3CX_WAN_IP> POST /MyPhone/MPWebService.asmx - application/octet-stream 8
2026-07-09 14:07:38.275|0033|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000007)
2026-07-09 14:07:38.275|0033|Debug| [MyPhone.ServerMessageFactory] Incoming request: messageID=124. (traceid=0HNMT58MCFPRU:00000007). Current requests: 1.
2026-07-09 14:07:38.275|0033|Debug| [MyPhone.ServerMessageFactory] ([124 RequestConnectionAccessRights]) - 00:00:00.0001491 - from 441[49254f82-a0e8-0ae8***]@<3CX_WAN_IP>. Requests:1 -> 0 (traceid=0HNMT58MCFPRU:00000007)
2026-07-09 14:07:38.275|0033| Info| [_3CX.Http] [9]-<3CX_WAN_IP> POST /MyPhone/MPWebService.asmx - 200 8 application/octet-stream 0.9103ms
2026-07-09 14:07:38.290|0098|Trace| [_3CX.Http] [10]+<3CX_WAN_IP> POST /MyPhone/MPWebService.asmx - application/octet-stream 17
2026-07-09 14:07:38.295|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000008)
2026-07-09 14:07:38.295|0098|Debug| [MyPhone.ServerMessageFactory] Incoming request: messageID=118. (traceid=0HNMT58MCFPRU:00000008). Current requests: 1.
2026-07-09 14:07:38.300|0098|Trace| Starting SLOT_CA_TRANSFER_CALL.3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 (without notification)
2026-07-09 14:07:38.303|0060|Trace| Call control transaction 3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 has completed by response(no notifications):
Success(NotSpecified:):
 00:00:00.0012032
2026-07-09 14:07:38.303|0060|Trace| Pending CallControlRequests:0
2026-07-09 14:07:38.303|0005|Debug| [_3CX.QualityMonitor.CallMonitor] ACUpdated 281.4 -> (null)
2026-07-09 14:07:38.303|0005|Debug| [_3CX.QualityMonitor.CallMonitor] Wconnection.1760
AttachedData=System.Collections.Generic.Dictionary`2[System.String,System.String]
LastChangeStatus=09/07/2026 13:07:38
IsOutbound=False
IsInbound=True
DialedNumber=
ExternalParty=+<CallerID>
InternalParty=Wexternalline.566: 10009 on Wprovider.12: <SIP URL>
Status=Ringing
HistoryIDOfTheCall=00000000-01dd-0fa0-0710-4fd100000119
OriginatedBy=
ReferredBy=3
CallConnectionID=4
CallID=281
OnBehalfOf=
DN=Wroutepoint.20: ROUTER
OtherCallParties=TCX.Configuration.Interop.Wconnection[]
RecordingState=Stop
PartyConnectionID=1625
ReferredByDN=Wdn.257: 441
OfferProvided=False
RouteTarget=Wdn.158: 624
ID=1760
HasAttached=False
    AttachedData:
        chid=00000000-01dd-0fa0-0710-4fd100000119
        prevCall=0
        prevLeg=0
        sip_dialog_set_id=F42-mrbmFf2gtDY9Jx8PcA..081fba402
        extnumber=+<CallerID>
        devcontact=sip:[email protected]:5483
        public_push_callerid=+<CallerID>
        public_push_callername=+<CallerID>
        participant_uid=00000000-01dd-0fa3-eab8-539f000006c0
2026-07-09 14:07:38.303|0023|Debug| [MyPhone.ClientManager] Connection: Wconnection.1760

 

[Charles_3CX]

Hi, so this part tells you who did the transfer:

ReferredByDN=Wdn.257: 441
OfferProvided=False
RouteTarget=Wdn.158: 624

 

[Alphabetic]

Hi, so this part tells you who did the transfer:

ReferredByDN=Wdn.257: 441
OfferProvided=False
RouteTarget=Wdn.158: 624

Hi Charles,

is there any indication as to the how?

I believe MyPhone.Client must be the 3CX app?

a blind transfer must have been from a drag and drop in the panel view - this is the conclusion im at.

 

[Charles_3CX]

This would have been done from a webclient or app, likely drag and drop, yes.

 

[NikosT_3CX]

@Alphabetic lets break this down more for the Presence point of View

Request comes form extension 441 :

2026-07-09 14:07:38.048|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000006)


PBX checks the rights of this user ( ConnectionAccessRights ) :

2026-07-09 14:07:38.058|0098|Debug| [MyPhone.ServerMessageFactory] ([124 RequestConnectionAccessRights]) - 00:00:00.0097146 - from 441[49254f82-a0e8-0ae8***]@<3CX_WAN_IP>. Requests:1 -> 0 (traceid=0HNMT58MCFPRU:0000000


Transfer is performed from 441 ( you see the CA_TRANSFER_CALL )

2026-07-09 14:07:38.295|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000008)
2026-07-09 14:07:38.300|0098|Trace| Starting SLOT_CA_TRANSFER_CALL.3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 (without notification)


And transfer is successfull ( completed by response ) ( Success ) :

2026-07-09 14:07:38.303|0060|Trace| Call control transaction 3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 has completed by response(no notifications):
Success(NotSpecified:

Then below on the same log file you see more details about the actual call where you see the Refered By and the target.
As a side nore, if this was a v20 windows client or not is not clear here as if this was a v20 windows client then this must be checked on the tunnel logs and see the Registrations from this extension there. If not, it was a web client or pwa.
Also this can be clearly seen on the Bin Log Viewer where you see the User Agent for the Registrations of this extension.

 

[Alphabetic]

@Alphabetic lets break this down more for the Presence point of View

Request comes form extension 441 :

2026-07-09 14:07:38.048|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000006)


PBX checks the rights of this user ( ConnectionAccessRights ) :

2026-07-09 14:07:38.058|0098|Debug| [MyPhone.ServerMessageFactory] ([124 RequestConnectionAccessRights]) - 00:00:00.0097146 - from 441[49254f82-a0e8-0ae8***]@<3CX_WAN_IP>. Requests:1 -> 0 (traceid=0HNMT58MCFPRU:0000000


Transfer is performed from 441 ( you see the CA_TRANSFER_CALL )

2026-07-09 14:07:38.295|0098|Debug| [MyPhone.Client] HandleRequest from 441@49254f82-a0e8-0ae8***(traceid=0HNMT58MCFPRU:00000008)
2026-07-09 14:07:38.300|0098|Trace| Starting SLOT_CA_TRANSFER_CALL.3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 (without notification)


And transfer is successfull ( completed by response ) ( Success ) :

2026-07-09 14:07:38.303|0060|Trace| Call control transaction 3CXPhoneSystemMC01.ReplaceWithAsyncInitOnlyWithRouteToNumber.18 has completed by response(no notifications):
Success(NotSpecified:

Then below on the same log file you see more details about the actual call where you see the Refered By and the target.
As a side nore, if this was a v20 windows client or not is not clear here as if this was a v20 windows client then this must be checked on the tunnel logs and see the Registrations from this extension there. If not, it was a web client or pwa.
Also this can be clearly seen on the Bin Log Viewer where you see the User Agent for the Registrations of this extension.

thanks for the info.

What are the ways a user could blind transfer from PWA without picking the call up?

They dont have this extension as a BLF.

441 was logged in to this queue at the time and 624 is not in this queue.

 

[bitn2]

You could blind transfer from the panel if you have the rights to do so.

 

[Alphabetic]

You could blind transfer from the panel if you have the rights to do so.

How? I've tried to simulate.

Im only able to blind transfer a call once the call is in progress

 

[KyriacosS_3CX]

How? I've tried to simulate.

Im only able to blind transfer a call once the call is in progress

Did you try a queue call, or a normal call?

 

[Alphabetic]

Did you try a queue call, or a normal call?

Its a queue call and i've got rights and queue manager.



When I right click it:



When I drag and drop:



When im on the call I can do what I like

 

[Alphabetic]

OK, note to self... when performing tests make sure you're not the only one in the queue..

I dont get the option to "divert" calls when im being polled but I can do it on polls to other agents.

I can replicate the problem now - though customer tells me "i didnt do anything" but the evidence is there.. SMH.

Anyway.. on a side note.. I just learnt that if you hold down ALT when dragging and dropping the call it toggles between blind and attended transfer.