Troubleshooting · Symptoms
Calls Dropping Mid-Call: Find Who Hung Up
A call that ends itself mid-sentence is not one fault but a category — and the category splits cleanly the moment you look at a capture. Either the call was ended politely (a SIP BYE message, meaning some system decided to hang up) or it ended rude (the packets simply stop — power, network, or a device dying). Those two signatures lead to entirely different fixes, and guessing between them is how drop tickets live for weeks.
This guide covers irregular, unpredictable drops. If your calls die at suspiciously exact durations (always ~15 or ~30 minutes), skip to the timed-drops guide — that is a different, very specific fault family.
Read the ending in the capture
| Capture signature | Meaning | Where to look |
|---|---|---|
| BYE from the far end/provider | Their side or an upstream system ended the call deliberately | Provider ticket with the Call-ID; check for upstream session limits |
| BYE from your phone/PBX right at the drop | Your endpoint decided to hang up: firmware crash, hook-switch fault, app closure | That endpoint: firmware, logs, swap test |
| No BYE — RTP just stops, then a timeout teardown | The path died: power loss, switch/router reboot, ISP drop, failover event | Correlate the timestamp with network/power events |
| Re-INVITE or UPDATE unanswered, then BYE | Session refresh failure — see the timed-drops guide | Session timers, NAT pinholes for signaling |
| RTP stops one direction seconds before the end | Media died first; the hangup is a consequence | The one-way-audio causes: NAT, firewall state expiry |
The usual suspects behind 'random' drops
- Power and PoE: a switch shedding load or a marginal PoE port reboots a phone mid-call; the phone's absence looks like a network drop. Check switch logs and PoE budgets (also the rebooting-phones guide).
- ISP or WAN micro-outages: 20-second carrier blips and failover events that users experience as 'the call dropped' while the internet 'never went down'. Router WAN logs and uptime records correlate precisely.
- Firewall/NAT state expiry on long calls: UDP mappings and session entries age out; signaling dies quietly until a refresh fails — borderlands with the timed-drop family.
- Endpoint firmware: specific phone firmwares have known mid-call crash bugs; a drop pattern that follows one model/firmware is a changelog search away from an answer.
- Call-recording or integration middleware: recorders and CTI bridges in the media path can and do drop calls when they fault — bypass-test by removing the integration from one extension.
Diagnosis sequence
- Log three real examples with exact times, numbers and extensions before touching anything — drops are diagnosed from instances, not impressions.
- Capture continuously (ring buffer / port mirror at the edge) so a drop is caught in the act; classify the ending with the table above.
- Correlate the drop timestamps with infrastructure: switch and router logs, WAN uptime, PoE events, provider status. Coincidence at the same second is causation until proven otherwise.
- Apply the fix for the identified class (power, path, endpoint, provider escalation with Call-IDs) — one change at a time.
- Verify statistically: track drops per 100 calls for a week before and after. 'Feels better' is not verification for an intermittent fault.
Frequently asked questions
- Why do drops cluster at certain times of day?
- Because their causes do: PoE load peaks when every phone and light is on, WAN congestion peaks mid-morning, backups run at night. A time pattern is a fingerprint — match it against the suspect list before suspecting the provider.
- Our calls drop when it rains / when the AC kicks on — seriously?
- Seriously. Weather degrades outside copper and fixed-wireless paths; large electrical loads expose marginal power and grounding. Intermittent infrastructure faults love physical triggers, and noting them in the ticket log is how they get believed and fixed.
- When is it the provider's fault?
- When captures show a provider-side BYE without cause, or drops across multiple sites on the same provider simultaneously, or their status/incident history aligns. Bring Call-IDs and timestamps — 'calls are dropping' without instances gets the standard brush-off.
Sources and further reading
Related guides
Disclaimer: This guide is educational information based on published VoIP standards and professional practice, not engineering advice for your specific system. VoIP pricing, taxes and fees change and vary by provider and location — verify current figures with providers before purchasing. If your phone system supports emergency calling, work with your provider or a qualified VoIP engineer for changes that affect E911.