{"schema_version": "1.0", "app": "VoIP Health Check", "app_version": "2.3.3", "profile": "quick", "session_id": "Downloads-2026-05-04T203739Z", "started_at": "2026-05-04T20:37:39Z", "finished_at": "2026-05-04T20:39:51Z", "duration_seconds": 132.15, "form": {"problem_experienced": "", "other_problem": "", "hosted_platform": "", "gateway_ip": "", "firewall_ip": "", "starbox_ip": "", "sip_test_endpoint": ""}, "resolved_inputs": {"manual_inputs": {}, "auto_detected": {"gateway_ip": "192.168.1.254"}, "skipped": ["starbox_specific_checks", "external_sip_endpoint_probes"], "notes": ["no problem specified \u2014 running general diagnostics", "hosted_platform left blank \u2014 treating as auto/unknown and inferring context from scan data where possible", "firewall_ip left blank \u2014 not assuming it equals gateway; in-path culprit reported as gateway-or-firewall"]}, "host": {"hostname": "LAPTOP-2LG4851U", "os": "Windows", "os_version": "11 10.0.26200", "username": "rdwso", "local_ips": ["192.168.1.87"], "public_ip": "99.172.127.156", "public_ip_source": "ipify.org"}, "interfaces": [{"name": "Wi-Fi", "description": "Realtek RTL8852BE WiFi 6 802.11ax PCIe Adapter", "mac": "d0:39:57:a0:8d:19", "ipv4": ["192.168.1.87"], "ipv6": ["fe80::2ccc:9453:4402:9e22%9", "2600:1702:1e0:920:7579:9cf2:847c:fa35", "2600:1702:1e0:920:4bb6:cf6d:1993:389c", "2600:1702:1e0:920::49"], "gateway": "", "dns": [], "vlan_id": null, "is_up": true, "speed_mbps": 866, "notes": ""}], "gateway": {"default_gateway": "192.168.1.254", "gateway_mac": "94:8f:cf:1c:7c:b0", "gateway_vendor": "", "first_hop_traceroute": ["8.8.8.8", "192.168.1.254", "99.172.124.1", "76.239.205.213"], "note": ""}, "dns_servers": ["192.168.1.254"], "vlan": {"target_vlan": 41, "status": "not_detected", "confidence": "inconclusive", "evidence": ["No Windows-visible VLAN tag and no 41-style subnet detected. If the switch port is an access port, Windows cannot see the tag even when one is in use."], "explanation": "Windows commonly cannot observe 802.1Q tags unless the NIC driver is explicitly configured to expose VLAN IDs or the switch port is a trunk. Treat 'not_detected' as 'we couldn't see it', not 'it isn't there'.", "suggestions": ["On the switch, confirm the port is configured for VLAN 41 (access mode for a phone, trunk with native data + tagged voice for a PC + phone in line).", "If using a phone with a passthrough PC port, verify the phone is tagging voice on VLAN 41 and leaving PC traffic untagged.", "On the Windows NIC, check Device Manager -> Adapter -> Advanced for a 'VLAN ID' or 'Priority & VLAN' setting."]}, "sip_alg": {"overall": "likely_off", "confidence": "likely", "methods": [{"name": "SIP OPTIONS (UDP)", "result": "inconclusive", "confidence": "inconclusive", "detail": "No external SIP test endpoint configured (Advanced field left blank). Skipped cleanly \u2014 SIP ALG proof from this method is limited/inconclusive without a configured endpoint. Other non-endpoint ALG signals still ran.", "evidence": ""}, {"name": "Public/Private IP comparison", "result": "inconclusive", "confidence": "inconclusive", "detail": "Public IP (99.172.127.156) differs from local IPs (192.168.1.87). NAT is in play \u2014 ALG behavior depends on the NAT device, not this fact alone.", "evidence": "public=99.172.127.156; local=192.168.1.87"}, {"name": "Windows local services", "result": "likely_off", "confidence": "likely", "detail": "Windows does not implement SIP ALG itself. Listed services shown for context only.", "evidence": "iphlpsvc=Running, SharedAccess=Running"}], "explanation": "No external SIP test endpoint configured \u2014 that field is optional. SIP ALG proof is therefore limited/inconclusive: the header-rewrite test (the only client-side method that can produce strong evidence) was skipped, but other non-endpoint ALG signals ran.", "suggestions": ["Optional: paste a SIP echo/test endpoint (host:port) under Advanced to enable header-rewrite detection on a re-run.", "Disable SIP ALG / SIP helper / SIP fixup on the firewall and any router/modem in line.", "Capture traffic on the Windows host (Wireshark + Npcap) and compare SIP headers before/after the firewall to prove ALG.", "Whitelist 199.15.180.0/22 (Sangoma) so the gateway does not apply NAT helper logic to it."], "needs_external_endpoint": true, "external_endpoint_configured": ""}, "port_tests": [{"group": "Core Voice Services", "service": "SIP", "protocol": "tcp", "port": 2160, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:2160 timed out after 2s", "suggestion": "Verify outbound TCP 2160 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "Core Voice Services", "service": "SIP", "protocol": "udp", "port": 2160, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 2160 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 10000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 10001, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 20000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 30000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 40000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 50000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 60000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "RTP", "protocol": "udp", "port": 65000, "destination": "199.15.180.1", "direction": "IP Phones to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-65000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "Core Voice Services", "service": "NTP", "protocol": "tcp", "port": 123, "destination": "pool.ntp.org", "direction": "IP Phones to Internet", "sip_alg_relevant": false, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to pool.ntp.org:123 timed out after 2s", "suggestion": "Verify outbound TCP 123 to pool.ntp.org is allowed by the firewall.", "raw": ""}, {"group": "Application Framework", "service": "HTTPS", "protocol": "tcp", "port": 443, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": false, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:33437", "suggestion": "", "raw": ""}, {"group": "Application Framework", "service": "HTTP", "protocol": "tcp", "port": 80, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": false, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:33438", "suggestion": "", "raw": ""}, {"group": "Application Framework", "service": "XMPP", "protocol": "tcp", "port": 5280, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:5280 timed out after 2s", "suggestion": "Verify outbound TCP 5280-5281 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "Application Framework", "service": "XMPP", "protocol": "tcp", "port": 5281, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:5281 timed out after 2s", "suggestion": "Verify outbound TCP 5280-5281 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "Application Framework", "service": "StarFax Personal", "protocol": "tcp", "port": 9080, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:9080 timed out after 2s", "suggestion": "Verify outbound TCP 9080 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "Application Framework", "service": "Application Framework Video", "protocol": "tcp", "port": 1935, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": false, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:1935 timed out after 2s", "suggestion": "Verify outbound TCP 1935 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "SIP", "protocol": "tcp", "port": 59000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:59000 timed out after 2s", "suggestion": "Verify outbound TCP 59000-60000 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "SIP", "protocol": "tcp", "port": 59500, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:59500 timed out after 2s", "suggestion": "Verify outbound TCP 59000-60000 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "SIP", "protocol": "tcp", "port": 60000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:60000 timed out after 2s", "suggestion": "Verify outbound TCP 59000-60000 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "RTC", "protocol": "udp", "port": 10000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-20000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "RTC", "protocol": "udp", "port": 12500, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-20000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "RTC", "protocol": "udp", "port": 15000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-20000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "RTC", "protocol": "udp", "port": 17500, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-20000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "RTC", "protocol": "udp", "port": 20000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 10000-20000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "HTTPS", "protocol": "tcp", "port": 443, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:32008", "suggestion": "", "raw": ""}, {"group": "StarPhone Desktop v3.x", "service": "HTTP", "protocol": "tcp", "port": 80, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:32009", "suggestion": "", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "SIP", "protocol": "tcp", "port": 5060, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:5060 timed out after 2s", "suggestion": "Verify outbound TCP 5060,2160 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "SIP", "protocol": "tcp", "port": 2160, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:2160 timed out after 2s", "suggestion": "Verify outbound TCP 5060,2160 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "XMPP", "protocol": "tcp", "port": 5222, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "filtered", "confidence": "likely", "likely_blocking_device": "gateway-or-firewall", "evidence": "TCP connect to 199.15.180.1:5222 timed out after 2s", "suggestion": "Verify outbound TCP 5222 to 199.15.180.1 is allowed by the firewall.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "HTTPS", "protocol": "tcp", "port": 443, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:41805", "suggestion": "", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "HTTP", "protocol": "tcp", "port": 80, "destination": "example.com", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open", "confidence": "confirmed", "likely_blocking_device": "none", "evidence": "TCP connect succeeded from 2600:1702:1e0:920:7579:9cf2:847c:fa35:41806", "suggestion": "", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 4000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 4001, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 4007, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 10000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 20000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 30000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}, {"group": "StarPhone iPhone / Android / TeamHub", "service": "RTP/RTCP", "protocol": "udp", "port": 40000, "destination": "199.15.180.1", "direction": "Workstations to Internet", "sip_alg_relevant": true, "method": "socket", "result": "open|filtered", "confidence": "inconclusive", "likely_blocking_device": "gateway-or-firewall", "evidence": "No UDP reply within timeout (UDP cannot be declared open without a response).", "suggestion": "Verify outbound UDP 4000-4007,10000-40000 to 199.15.180.1 is allowed by the firewall. Also ensure SIP ALG is OFF so RTP isn't pinned/rewritten. If only some sample ports fail, the firewall is enforcing a narrower range than required \u2014 open the full range.", "raw": ""}], "capture": {"engine": "pktmon", "available": true, "detail": "Using built-in Windows pktmon at C:\\WINDOWS\\system32\\pktmon.EXE. Capture must be started from an Administrator shell \u2014 if pktmon refuses to start, re-run the app as Administrator."}, "attribution": {"likely_device": "gateway-or-firewall", "confidence": "likely", "rationale": "No firewall IP was specified, so we cannot separate the firewall from the gateway 192.168.1.254 (auto-detected). Treating the in-path culprit as 'gateway or firewall'.", "user_provided_gateway_ip": "", "user_provided_firewall_ip": "", "user_provided_starbox_ip": "", "auto_detected_gateway_ip": "192.168.1.254"}, "latency": {"targets": [{"target_label": "gateway", "target_host": "192.168.1.254", "samples_sent": 8, "samples_received": 8, "packet_loss_pct": 0.0, "rtt_min_ms": 5.0, "rtt_avg_ms": 6.625, "rtt_max_ms": 12.0, "jitter_ms": 2.429, "jitter_formula": "mean(|rtt[i] - rtt[i-1]|) over received samples", "confidence": "strong", "status": "ok", "notes": [], "raw_rtts_ms": [6.0, 12.0, 6.0, 5.0, 5.0, 7.0, 7.0, 5.0]}, {"target_label": "public", "target_host": "8.8.8.8", "samples_sent": 8, "samples_received": 8, "packet_loss_pct": 0.0, "rtt_min_ms": 25.0, "rtt_avg_ms": 27.0, "rtt_max_ms": 33.0, "jitter_ms": 3.429, "jitter_formula": "mean(|rtt[i] - rtt[i-1]|) over received samples", "confidence": "strong", "status": "ok", "notes": [], "raw_rtts_ms": [27.0, 25.0, 28.0, 27.0, 26.0, 25.0, 33.0, 25.0]}, {"target_label": "public", "target_host": "1.1.1.1", "samples_sent": 8, "samples_received": 8, "packet_loss_pct": 0.0, "rtt_min_ms": 25.0, "rtt_avg_ms": 27.75, "rtt_max_ms": 35.0, "jitter_ms": 3.571, "jitter_formula": "mean(|rtt[i] - rtt[i-1]|) over received samples", "confidence": "strong", "status": "ok", "notes": [], "raw_rtts_ms": [25.0, 27.0, 25.0, 27.0, 29.0, 28.0, 35.0, 26.0]}, {"target_label": "sangoma", "target_host": "199.15.180.1", "samples_sent": 8, "samples_received": 0, "packet_loss_pct": 100.0, "rtt_min_ms": null, "rtt_avg_ms": null, "rtt_max_ms": null, "jitter_ms": null, "jitter_formula": "mean(|rtt[i] - rtt[i-1]|) over received samples", "confidence": "likely", "status": "unreachable", "notes": ["ping exited rc=1"], "raw_rtts_ms": []}], "overall_status": "bad", "overall_summary": "1 target(s) showing unreachable / poor latency.", "suggestions": ["One or more targets did not respond to ICMP. Some firewalls drop ping but still pass voice traffic \u2014 re-test against the Sangoma SBC with SIP OPTIONS to confirm reachability.", "Packet loss above 3% will cause audible drop-outs. Check the WAN link, ISP throughput, and any in-path firewall rate-limits or buffer-bloat."]}, "dhcp": {"available": true, "method": "ipconfig", "adapters": [{"adapter_name": "Wireless LAN adapter Local Area Connection* 1", "description": "Microsoft Wi-Fi Direct Virtual Adapter", "dhcp_enabled": true, "dhcp_server": "", "lease_obtained": "", "lease_expires": "", "ipv4": [], "default_gateway": "", "notes": []}, {"adapter_name": "Wireless LAN adapter Local Area Connection* 2", "description": "Microsoft Wi-Fi Direct Virtual Adapter #2", "dhcp_enabled": true, "dhcp_server": "", "lease_obtained": "", "lease_expires": "", "ipv4": [], "default_gateway": "", "notes": []}, {"adapter_name": "Wireless LAN adapter Wi-Fi", "description": "Realtek RTL8852BE WiFi 6 802.11ax PCIe Adapter", "dhcp_enabled": true, "dhcp_server": "192.168.1.254", "lease_obtained": "Saturday, May 2, 2026 6:57:57 AM", "lease_expires": "Tuesday, May 5, 2026 4:28:44 PM", "ipv4": ["192.168.1.87"], "default_gateway": "", "notes": []}], "inferred_assigner": "dedicated DHCP server (not the gateway)", "inferred_assigner_ip": "192.168.1.254", "confidence": "likely", "explanation": "Adapter 'Wireless LAN adapter Wi-Fi' reports DHCP server 192.168.1.254 which differs from the gateway ?. A separate DHCP appliance or server is assigning IPs.", "suggestions": ["Voice phones generally expect option 66/150 from the same DHCP server \u2014 confirm those options are configured on the dedicated DHCP host."], "limitations": ["ipconfig only sees the *current* lease; rogue DHCP servers on the same broadcast domain are not detected without a passive capture."]}, "issues": [{"code": "voice_ports_blocked", "title": "Voice-related ports are blocked: TCP 2160, TCP 5060, TCP 5222, TCP 5280, TCP 5281, TCP 59000, TCP 59500, TCP 60000, TCP 9080", "severity": "critical", "confidence": "likely", "detail": "10 of the voice-related ports we tested are not reachable from this PC. Calls and registration depend on these ports \u2014 if the firewall blocks them, phones either won't register or audio will be one-way.", "suggested_fix": "Allow outbound TCP 2160/5060/5061/5222/443 and UDP 10000-65000 to 199.15.180.0/22 on the firewall.", "related_ports": [2160, 5060, 5222, 5280, 5281, 9080, 59000, 59500, 60000]}, {"code": "vlan_not_detected", "title": "VLAN 41 was not detected on this PC", "severity": "warning", "confidence": "inconclusive", "detail": "Windows commonly cannot observe 802.1Q tags unless the NIC driver is explicitly configured to expose VLAN IDs or the switch port is a trunk. Treat 'not_detected' as 'we couldn't see it', not 'it isn't there'.", "suggested_fix": "If the phone or PC is meant to be on the voice VLAN, verify the switch port and NIC VLAN configuration.", "related_ports": []}, {"code": "local_firewall_check", "title": "Some TCP probes were silently dropped", "severity": "warning", "confidence": "likely", "detail": "Filtered TCP results can come from the local Windows firewall as well as upstream devices. Check Windows Defender Firewall outbound rules.", "suggested_fix": "Open Windows Defender Firewall and confirm no outbound rule blocks the StarPhone / SIP client.", "related_ports": []}, {"code": "latency_bad", "title": "Latency, jitter or packet loss outside VoIP comfort range", "severity": "critical", "confidence": "strong", "detail": "1 target(s) showing unreachable / poor latency.", "suggested_fix": "One or more targets did not respond to ICMP. Some firewalls drop ping but still pass voice traffic \u2014 re-test against the Sangoma SBC with SIP OPTIONS to confirm reachability.; Packet loss above 3% will cause audible drop-outs. Check the WAN link, ISP throughput, and any in-path firewall rate-limits or buffer-bloat.", "related_ports": []}, {"code": "dhcp_assigner", "title": "IP assigned by: dedicated DHCP server (not the gateway)", "severity": "info", "confidence": "likely", "detail": "Adapter 'Wireless LAN adapter Wi-Fi' reports DHCP server 192.168.1.254 which differs from the gateway ?. A separate DHCP appliance or server is assigning IPs.", "suggested_fix": "Voice phones generally expect option 66/150 from the same DHCP server \u2014 confirm those options are configured on the dedicated DHCP host.", "related_ports": []}], "fixes": ["Open Sangoma's voice ports outbound (see report for list).", "Verify VLAN 41 tagging on the switch port and NIC.", "One or more targets did not respond to ICMP. Some firewalls drop ping but still pass voice traffic \u2014 re-test against the Sangoma SBC with SIP OPTIONS to confirm reachability.", "Packet loss above 3% will cause audible drop-outs. Check the WAN link, ISP throughput, and any in-path firewall rate-limits or buffer-bloat."], "nmap_runs": [], "raw_logs": [], "sangoma_catalog": {"destination_networks": ["199.15.180.0/22"], "default_sangoma_host": "199.15.180.1", "groups": [{"name": "Core Voice Services", "rules": [{"service": "SIP", "protocol": "tcp", "ports": "2160", "sample_ports": [2160], "direction": "IP Phones to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": "Sangoma SIP signaling on TCP 2160."}, {"service": "SIP", "protocol": "udp", "ports": "2160", "sample_ports": [2160], "direction": "IP Phones to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": "Sangoma SIP signaling on UDP 2160."}, {"service": "RTP", "protocol": "udp", "ports": "10000-65000", "sample_ports": [10000, 10001, 20000, 30000, 40000, 50000, 60000, 65000], "direction": "IP Phones to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": "Voice media RTP. Massive UDP range; scanner samples it."}, {"service": "NTP", "protocol": "tcp", "ports": "123", "sample_ports": [123], "direction": "IP Phones to Internet", "sip_alg_relevant": false, "destinations": [], "notes": "Phone time sync (TCP 123 per the guide)."}]}, {"name": "Application Framework", "rules": [{"service": "HTTPS", "protocol": "tcp", "ports": "443", "sample_ports": [443], "direction": "Workstations to Internet", "sip_alg_relevant": false, "destinations": [], "notes": "Generic outbound HTTPS."}, {"service": "HTTP", "protocol": "tcp", "ports": "80", "sample_ports": [80], "direction": "Workstations to Internet", "sip_alg_relevant": false, "destinations": [], "notes": "Generic outbound HTTP."}, {"service": "XMPP", "protocol": "tcp", "ports": "5280-5281", "sample_ports": [5280, 5281], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": "Application Framework XMPP."}, {"service": "StarFax Personal", "protocol": "tcp", "ports": "9080", "sample_ports": [9080], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": ""}, {"service": "Application Framework Video", "protocol": "tcp", "ports": "1935", "sample_ports": [1935], "direction": "Workstations to Internet", "sip_alg_relevant": false, "destinations": [], "notes": ""}]}, {"name": "StarPhone Desktop v3.x", "rules": [{"service": "SIP", "protocol": "tcp", "ports": "59000-60000", "sample_ports": [59000, 59500, 60000], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": "StarPhone desktop SIP register/signal."}, {"service": "RTC", "protocol": "udp", "ports": "10000-20000", "sample_ports": [10000, 12500, 15000, 17500, 20000], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": "StarPhone desktop media."}, {"service": "HTTPS", "protocol": "tcp", "ports": "443", "sample_ports": [443], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": ""}, {"service": "HTTP", "protocol": "tcp", "ports": "80", "sample_ports": [80], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": ""}]}, {"name": "StarPhone iPhone / Android / TeamHub", "rules": [{"service": "SIP", "protocol": "tcp", "ports": "5060,2160", "sample_ports": [5060, 2160], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": ""}, {"service": "XMPP", "protocol": "tcp", "ports": "5222", "sample_ports": [5222], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": ""}, {"service": "HTTPS", "protocol": "tcp", "ports": "443", "sample_ports": [443], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": ""}, {"service": "HTTP", "protocol": "tcp", "ports": "80", "sample_ports": [80], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": [], "notes": ""}, {"service": "RTP/RTCP", "protocol": "udp", "ports": "4000-4007,10000-40000", "sample_ports": [4000, 4001, 4007, 10000, 20000, 30000, 40000], "direction": "Workstations to Internet", "sip_alg_relevant": true, "destinations": ["199.15.180.0/22"], "notes": "Mobile media \u2014 guide notes 4000-4007 and/or 10000-40000 (or up to 65000) to 199.15.180.0/22."}]}]}}