Measure one failure from answer to teardown
Record the answer timestamp, the first terminating message or local hangup event and the resulting duration on several calls. Preserve direction, endpoint, trunk, transport, hold state and whether each audio direction worked. A repeatable interval is a useful fingerprint, but a display rounded to 30 seconds is not proof of a particular SIP timer.
Use one bounded signaling trace and PBX log for the same call. Keep Call-ID, CSeq, tags and PBX channel identifiers separate; a duration in a CDR alone does not identify which dialog participant or application ended the session.
Prove the final answer and ACK on the affected dialog
RFC 3261 requires the successful final response to an INVITE to be retransmitted until the matching ACK arrives. With the standard T1 value, the 64 × T1 window is 32 seconds; after that window without the ACK, the answering user agent should terminate the session with BYE. Look for repeated 2xx responses with the same dialog identifiers, the expected ACK and the first BYE.
A wrong Contact, Record-Route path, advertised address, NAT translation or firewall policy can let the INVITE and 2xx succeed while sending the ACK elsewhere. Do not infer this cause from the duration alone. Asterisk documents a 500 ms default timer_t1 and 32,000 ms default timer_b, but Timer B governs an unanswered outbound INVITE transaction; it is not interchangeable with the post-2xx ACK path.
Trace both PBX dialogs instead of finding any ACK
A back-to-back PBX normally owns separate dialogs toward the caller and carrier. Each leg has its own Call-ID, CSeq, route set, remote target, final response and ACK. An ACK observed on the phone leg does not prove that the trunk leg received its ACK, and a carrier retransmission does not prove the phone failed.
Map the two legs by PBX channel and linked identifiers, then identify the first failed transaction. Preserve the source and destination of any BYE plus Reason or Q.850 information as evidence supplied by that participant, not an automatic root-cause verdict.
Separate session refresh from initial-answer acknowledgement
A SIP session timer begins only when the dialog negotiated Session-Expires. Record the interval, the named refresher, the mid-dialog re-INVITE or UPDATE and its response. RFC 4028 says only a successful 2xx refresh extends the session; a timed-out refresh or a 408 or 481 response can lead the refresher to send BYE, while the non-refresher can terminate when no refresh arrives before expiry.
Asterisk's documented endpoint defaults are a 90-second minimum and 1,800-second maximum session interval. Inspect the effective endpoint and peer exchange rather than treating those defaults as the live value. An initial 32-second answer failure and a later session-expiry failure are different transactions even when the user describes both as a timed drop.
Separate received-media inactivity and transport state
If both answer transactions are complete, compare the failure time with the last RTP packet received by the component that actually hung up the call. Asterisk's rtp_timeout and rtp_timeout_hold count seconds without received RTP in off-hold and on-hold states; their documented default is zero, meaning no check. They do not prove that RTP was sent, reached another capture point or became audible.
Also inspect direct-media topology, SDP address changes, hold direction, firewall or NAT state and TCP or TLS connection events. A SIP ALG or stateful firewall remains a hypothesis until the trace shows where the required message or packet stopped. Do not use rtp_keepalive, a broad timer increase or disabled session timers as a substitute for locating the failed direction.
Reproduce the original path after one bounded repair
Correct the demonstrated route, advertised address, policy or endpoint setting and repeat the same direction through the same topology. Keep the call established beyond the former failure window, then exercise hold, resume and normal participant hangup. Repeat the relevant opposite direction if it uses a different trunk or route.
Confirm that the expected ACK or refresh reaches its dialog peer, received media continues where required and abandoned calls still clear. Restore any temporary logging and experimental timer changes. No call, dialog, ACK, BYE, RTP stream, firewall state, timer or repair was tested for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- IETF RFC 3261 — SIP, including linked updates ↗
- IETF RFC 4028 — SIP session timers ↗
- Asterisk current res_pjsip option reference ↗
- Asterisk PJSIP troubleshooting guide ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.