What is the difference between origCause_value and destCause_value?

origCause_value indicates why the originating side (caller) disconnected, while destCause_value indicates why the destination side (callee) disconnected. The side that initiates the hang-up usually dictates the code.

What does Cisco Cause Code 41 mean?

Code 41 indicates a 'Temporary Failure.' This is a transient network or equipment issue. Retrying the call immediately often results in success. Code 41 is a common Q.850 standard code.

What does Cisco Cause Code 16 mean?

Code 16 indicates normal call clearing (Normal Clearing) when one party hangs up normally. It is the expected code for completed calls.

What are the most common OnBehalfOf codes?

The OnBehalfOf fields indicate the entity that terminated the call. Common codes include: Code 1 (Station/User), Code 2 (Trunk/Gateway), and Code 12 (Call Manager/Transfer).

Cisco CDR Termination Cause Codes

Diagram illustrating the breakdown and analysis of Cisco CDR call termination cause codes for voice troubleshooting. — *Visualizing the common Q.850 cause codes and their role in Cisco call termination analysis.*

Whether it's a dropped call, a failed setup, or a normal hang-up, Cisco Call Detail Records (CDRs) provide the essential DNA of every voice interaction. By decoding specific termination cause codes and correlating them with related fields, technical teams can effectively troubleshoot voice quality issues, improve call completion rates, and maintain a resilient Cisco Unified Communications Manager (CUCM) infrastructure.

If you are looking for instructions on how to generate these records first, please refer to our Cisco CUBE & CUCM CDR Setup Guide.

Decoding origCause_value vs. destCause_value

In Cisco CDRs, a single call is often split into two "legs"—the originating side and the terminating side. The most direct indicators of why a call ended are found in two specific integer fields:

origCause_value: The reason the call cleared on the originating (caller) side.
destCause_value: The reason the call cleared on the destination (callee) side.

Note: The party that initiates the disconnect typically dictates the cause code recorded. For example, if a caller hangs up normally, the origCause_value will likely be 16 (Normal Clearing).

Cisco & Q.850 Cause Code Cheat Sheet

Cisco utilizes the ITU-T Q.850 standard for cause codes, which is widely adopted in VoIP, SIP, and ISDN signaling. Below is a reference table of the most critical codes for troubleshooting.

Code	Definition	Troubleshooting Context / Likely Culprit
1	Unallocated (unassigned) number	Dial plan error or user misdialed. Check Route Patterns.
16	Normal call clearing	Standard disconnect. One party hung up normally.
17	User busy	Called party is on another line (and no Call Waiting/Hunt Group available).
18	No user responding	Device alerted (rang) but timed out.
21	Call rejected	User hit "Decline" or a feature (like Do Not Disturb) blocked the call.
22	Number changed	The number is no longer reachable at the dialed address.
27	Destination out of order	The destination device or network segment is down.
34	No circuit/channel available	Critical: Network congestion or SIP trunk capacity (CAC) limits reached.
38	Network out of order	Major infrastructure failure.
41	Temporary failure	Transient issue. Retries usually succeed.
47	Resources unavailable	Lack of Transcoders, MTPs, or Conference Bridge resources.

Pro Tip: Beyond standard Q.850 codes, Cisco uses proprietary codes for features. For example, code 393216 is frequently seen during call splits (transfers). For a deep dive on analyzing transfer logic, see our guide on Decoding Transferred Calls in CDRs.

Who Hung Up? "OnBehalfOf" Codes Explained

While cause codes explain why, the origCallTerminationOnBehalfOf and destCallTerminationOnBehalfOf fields explain who or what triggered the event.

Code 1 (Station): The user physically pressed "End Call" on the device.
Code 2 (Trunk Gateway): The PSTN or SIP Provider terminated the connection.
Code 4 (Voicemail): Terminated by Unity Connection (e.g., message left).
Code 12 (Call Park/Manager): Often indicates a transfer, park, or resume action.

3 Scenarios: Practical Troubleshooting with Termination Data

Illustration of a failed Cisco call connection path, often seen when troubleshooting codes like 34, 38, or 41. — *Troubleshooting requires tracing the call path to locate the failure point (e.g., trunk, gateway, or network element).*

Scenario A: Diagnosing "Dropped" Calls

Users report calls cutting off mid-conversation.
What to look for:
Filter for calls where destCause_value is 38 (Network out of order) or 41 (Temporary failure). Check the destCallTerminationOnBehalfOf code; if it shows 5 (Media Resource), you may have a Transcoder or MTP failure.

Scenario B: Calls Not Connecting (Fast Busy)

What to look for:
High frequency of Code 34 (No circuit available). This suggests you are hitting the max concurrent call limit on your SIP Trunk or Gateway. If you see Code 1 (Unallocated), verify your Dial Plan and Route Patterns.

Scenario C: One-Way Audio & Quality Issues

CDRs do not record the audio itself, but they contain "smoking guns."
What to look for:
Calls with a valid dateTimeConnect but a very short duration (e.g., < 5 seconds) often indicate one-way audio where a user hangs up immediately out of frustration. Correlate this with origMediaTransportAddress_IP to isolate specific subnets.

Dealing with calls that end before they are answered? Read our guide on Identifying and Removing Abandoned Calls.

Automating Cause Code Analysis

Manually interpreting thousands of hex codes and correlating them with "OnBehalfOf" fields is time-consuming and prone to error.

Metropolis Corp’s Expo XT UC Analytics automates this translation. It ingests raw Cisco CDR data and normalizes termination codes into plain English, providing dashboards of call completion rates, and allowing for powerful drill-downs into specific failure reasons.