Weird problem: ip phones rebooting at the same time

[lucas@evolux.net.br]

Hi,

i'm currently with a weird problem. My client reports all its yealinks ip phones are rebooting at the same time.

At first i thought it was POE, but he insisted it was not cause there were ip phones without POE rebooting.

Firmware version: 32.70.0.200

Is there some way i can check what was the cause of the reboot? I tried syslog and i could get nothing.

Attached to the post there is a one day full syslog from an Yealink T32G that rebooted. i've added a line with the text "<<REBOOT>>" at the exact time of reboot.

Does anyone can help?

[James_Yealink]

Hi Lucas,

Sorry for the late, we have a Nation Holiday from 10.1 to 10.7.
The problem happens all the time or it happens suddenly?
Is there a device in the network which will send notify message? Phone will reboot when it receive a notify message carrying "check-sync" parameter.

And have you fill a URL in phone Setting-> Autoprovision interface-> Server URL filed? If yes, please delete it and check again.

You can configure phone to not reboot when receive a notify message wich "check-sync" by this autoprovision parameter.
sip.notify_reboot_enable = 2

Regards,
James

Regards,
James

[Bryan Nelson]

Maybe related to provisioning?

Provisioning cycles can cause reboots, and the syslog shows a lot of provisioning activity.

[James_Yealink]

Yes Bnelson,

It's possible to related to autoprovision or sip notify message.

Have you tried the two method? Can it eliminate the problem?
**********
And have you fill a URL in phone Setting-> Autoprovision interface-> Server URL filed? If yes, please delete it and check again.

You can configure phone to not reboot when receive a notify message wich "check-sync" by this autoprovision parameter.
sip.notify_reboot_enable = 2
**************
Regards,
james

[kkj]

I too am having this problem. The strange thing about this in my case though, is that two separate groups of phones (on the same subnet), which are registered to different SIP servers, are all rebooting at the same time.

Additionally, it only affects our T38 phones. We also have T22 phones configured on the same network and same SIP servers, but they are not affected.

To give you an example, consider the following phones...
All phones HW version - 21.5.5.160.64.0.0

Phone 1
T38 - 38.70.0.186
10.0.0.21/24 - IP (Subnet A)
10.0.0.11 - SIP Server (Subnet A)

Phone 2
T38 - 38.70.0.126
10.0.0.22/24 - IP (Subnet A)
10.0.25.12 - SIP Server (Subnet B)

Phone 3
T38 - 38.70.0.171
10.0.0.23/24 - IP (Subnet A)
10.0.25.12 - SIP Server (Subnet B)

Phone 4
T38 - 38.70.0.186
10.0.0.24/24 - IP (Subnet A)
10.0.25.12 - SIP Server (Subnet B)

My suspicion is that there is a broadcast/multicast message inside the 10.0.0.0/24 network that triggers the phones to reboot. What confuses me, is the fact that it affects phones on several different servers.

Thoughts?

[kkj]

Update

After some digging I found information on sip notify messages that can reboot phones remotely. It looks like this...

Code:

[reboot-yealink]
Event=>check-sync\;reboot=true
Context-Length=>0

My thought is that this type of message will cause the phones to reboot, BUT I had configured a phone with the sip.notify_reboot_enable = 2 line and it still rebooted with the rest of the phones today. The reboot seems to happen at random times. I also tested directing a reboot notify message at the phone with that configuration and it did not reboot.

My guess is that there is another type of message being sent, but it still strange that it only affects T38s.

[Bryan Nelson]

You should try to do a packet capture on the network if possible and maybe we can identify the rouge packet!

This may be a genuine bug\exploit that needs to be patched. Or it may be something simpler. Either way, we have a lot of T-38's out there, and I don't want to run into this myself.