Problem -> (send SIP BYE)! Hungup cause: Normal, unspecified



rarely (about once a week), I notice this error on my customer’s UCM 6202:
“send SIP BYE)! Hungup causes: Normal, unspecified”
This error can be seen in screen 1 taken from “System Events” and on screen 2 there is the same phone call taken from the CDR.
In essence once in a while it happens that the conversation just falls without apparent reason.
There are also calls of 20-30 minutes, so it is not a problem of NAT or timer.
I noticed that it happened even during a simple local conversation between extension and extension, so I exclude a problem of Trunk or connectivity.
UCM 6202 fw
error -> SIP internal call failure! From user: 3345319383, To user: 201UCM hung up the call (send SIP BYE)! Hungup cause: Normal, unspecified
Did any of you have a problem? Do you know of a solution?

p.s.: it is impossible for me to post a pcap because it is a rare problem (about once a week) and it is difficult to simulate and identify.


Hello @damiano70,

Ah, intermitent issues. The most fun of all!

Is it happening for all phones, or only some?

You need to know who initiates the “BYE” command first. Is it the UCM or the phone?

I’ve had this once at a client’s, and it was because of packet loss on one phone that was easily fixed by changing the patch cable.

Here’s what I did to make my diagnostic: I started capturing the traffic. Then instructed the client to report exact details such as the time at which the issue arises, and between which caller / callee. I then analysed the packets using wireshark and found that the UCM closed the channel first, for no apparent reason (and also the same “hungup cause: Normal”).


Unfortunately, as I said, it’s rare but it happens,
happens regardless of the extension and regardless of whether the conversation is internal or external, I have already reversed phones, changed the network point and the network patch.


You know you can capture packets for days at a time, right? That’s the only way for you to understand what’s happening. Like I said, advise your client to tell you as soon as the problem happens so that you can stop the capture, and analyse it. Otherwise you’re just shooting in the dark.


you mean press “start” for example capture in the morning and stop at night?


Sure, why not. Last time I did at a client’s (they have 15 phones and not a huge volume of calls), I let it run for 4 days straight!

Edit: I just checked and the capture file was around 22MB


Okay, I thought about it, but since the internal space of the UCM is “limited”, I thought it wouldn’t work.
Usually I use SFTP, however thanks for the suggestion


You can catch syslog too.


Does syslog write “all the time”?
do you say I see the event from the syslog?
(I know it’s a stupid question, otherwise it wouldn’t be called syslog :P)


Yes, in UCM you can add:
pjsip module and channel (all level) and you will see sip notification too.


Okay, thank you,
I’ve never used it before, now I know what can be done.