Calls that drop after exactly 30 seconds — or 32, or 64 — are one of the most recognizable patterns in VoIP troubleshooting. The precision of the timing is the clue. This isn't random packet loss or a flaky network. It's a SIP timer firing, a NAT binding expiring, or RTP silence detection kicking in. Here's how to tell which one and fix it.
When a VoIP call drops at a precise interval — 30 seconds, 32 seconds, 64 seconds, 180 seconds — it's because a timer expired. SIP is full of timers defined in RFC 3261, each governing how long a UA waits before retransmitting or giving up on a transaction. When the timer fires and no response has been received, the call is torn down.
The most common culprits by timing:
If your calls drop at an irregular time, it's probably not a timer issue — look at network quality instead. Precision timing is always a timer.
Timer B governs INVITE transactions. Timer F governs non-INVITE transactions. Both are defined as 64 × T1, where T1 defaults to 500ms — giving a default timeout of 32 seconds.
Timer H is the specific timer that governs the wait for ACK after a 200 OK. If ACK doesn't arrive within 32 seconds, the UAS sends a BYE. This is why the "no ACK" failure mode produces drops at almost exactly 32 seconds.
Some implementations use a T1 of 200ms or 1000ms, which shifts the timeout to ~13 seconds or ~64 seconds respectively. If your drops are at an unusual interval, calculate the T1 value being used: dropout_time / 64.
UDP NAT bindings are stateless — the router creates a mapping when the first packet goes out and expires it after a period of inactivity. The default on many consumer and small business routers is 30 seconds. Enterprise firewalls typically use 60–300 seconds.
The failure pattern: call connects, both parties can hear each other, then exactly 30 seconds after the last RTP packet the audio stops. The SIP signaling may still be up (the dialog is alive) but the media path is dead because the NAT binding closed.
In a PCAP, look at the RTP stream timestamps. If you see a gap in RTP packets at exactly the timeout interval — and the packets resume sending but stop arriving — the NAT binding closed during the gap. The sending side is still transmitting but packets are being dropped at the NAT.
Configure your SIP endpoint or PBX to send RTP comfort noise or SIP OPTIONS keepalives every 15–20 seconds to keep the NAT binding alive. On Asterisk, set rtpkeepalive=15 in rtp.conf. On FreeSWITCH, set rtp-timeout-sec and enable comfort noise.
Every call drop produces a BYE request. Find it in your trace and note who sent it — the caller, callee, or a proxy. The source of the BYE tells you which side timed out.
Calculate the time from call connect (200 OK) to the BYE. If it's 30–32 seconds, Timer H or NAT. If it's 60–64 seconds, Timer B with default T1. If it's 90–1800 seconds, session timer. If it's 20–30 seconds, RTP inactivity.
If the drop is at ~32 seconds, search your trace for the ACK after the 200 OK. If no ACK is present, the ACK was lost in transit — NAT, firewall, or routing issue.
If the drop is at a longer interval (90s+), look for a re-INVITE before the BYE. If a re-INVITE was sent but never acknowledged, session timer expiry is the cause.
No ACK (Timer H): The ACK is being lost between the two endpoints. Check firewall rules — the ACK uses the same port as the INVITE but some stateful firewalls don't track it correctly. Disable SIP ALG on your router. If behind NAT, ensure your SIP proxy or SBC is handling ACK routing correctly.
NAT binding expiry: Enable RTP keepalives on your PBX (every 15–20 seconds). Increase the NAT UDP timeout on your firewall to 120+ seconds. Consider deploying an SBC to anchor media and eliminate endpoint NAT traversal entirely.
Session timer: Ensure both endpoints support RFC 4028 session timers and are configured with compatible Session-Expires values. Set a minimum of 1800 seconds unless you have a specific reason for shorter intervals. Configure your proxy to handle session refresh if endpoints don't support it.
RTP inactivity: Disable RTP inactivity timeout on your PBX if silence suppression is enabled, or increase the timeout to 120+ seconds. Alternatively disable silence suppression to ensure continuous RTP flow.
Paste your SIP trace into SIPSymposium. The analyzer identifies the exact timer that fired, checks for missing ACKs, detects NAT issues in RTP timing, and tells you exactly which endpoint sent the BYE and why.
VoIP calls dropping after exactly 30 seconds indicate a timer is firing. At ~32 seconds it is SIP Timer H — the server sent a 200 OK but never received the ACK, so it terminates the call. Other common causes are NAT UDP binding expiry (many routers expire bindings after 30 seconds of inactivity) and RTP inactivity timeouts on the PBX.
To fix 30-second call drops: enable RTP keepalives every 15-20 seconds to prevent NAT binding expiry, check that ACK packets are not being dropped by a firewall (disable SIP ALG), configure session timers with a minimum of 1800 seconds, and increase the NAT UDP timeout on your firewall to 120 seconds or more.
SIP Timer H is the wait time for ACK receipt after sending a 200 OK. It defaults to 64 x T1 = 32 seconds. If the ACK is lost in transit (due to NAT, firewall, or routing issue), Timer H fires and the call is terminated with a BYE. The fix is to ensure ACK packets can travel the full network path between both endpoints.
Paste your SIP trace into SIPSymposium. The analyzer identifies the timer, finds the missing ACK, detects NAT binding issues, and tells you exactly what to fix.