Skip navigation
All People > hassanfahmy > Hassan Mahmoud Fahmy Ali Hassan's Blog > 2016 > April > 11

Hassan Mahmoud Fahmy Ali Hassan's Blog

April 11, 2016 Previous day Next day

You can configure Moh under CME as below



no auto-reg-ephone

cnf-file location flash:

max-conferences 8 gain -6

moh enable-g711 "flash:/MOH.AU" <------------------- replace MOH.AU with your MOH File

web admin system name admin secret 5 $1$UzRJ$.AJ7pixot9P3vCH1m5qXa.

transfer-system full-consult

create cnf-files version-stamp

One of the bigger systems that I find myself supporting in my infrastructure is our Unified Communications system from Cisco Systems. With Cisco’s IP phone system the end phone devices are dumb devices, they store no configuration at all and have to be fed up to date firmware revisions. All of this is fed to the device via the transfer of a configuration file from the TFTP server integrated into Cisco Call Manager.



So how does the phone know where to find this TFTP server? That information is passed to the device as an option when it receives its IP address from the DHCP server, much in the same way it learns the default gateway and DNS servers. The problem is the option for TFTP server, option 150, is not built a default option on any DHCP servers that I’ve ever worked with.



I’m going to proceed here as if you’re working with a bare server that is already a member of the domain. If you already have done some of these steps, please feel free to skip ahead to the parts you need.

From Server Manager choose to add a role and choose DHCP Server.

Once you have the DHCP Server installed and authorized, launch DHCP Manager.

Next you’ll need to go ahead and create a scope for your Cisco IP telephony devices. As I’m sure your voice guys will tell you the IP phones will need to go on their own VLAN and defined through the network, an item for another post. Setup the scope as you normally would with all the relevant information.

Now you will need to right click on IPv4 and choose “Set Predefined Options…” Here you will find all of the options are predefined like Router and DNS Servers, but it also lets you create new ones.

Now click the “Add…” button in the Predefined options window. I always enter in the information exactly as shown below, but honestly the Option number, type as IP address and array checked are the only things that matter, the rest you set as you like.

Once done, OK through the Predefined Options windows until you are back at DHCP Manager. Now you will need to right click Scope Options under your scope and choose “Configure Scope Options…”

Scroll down until your see option 150 and check the box, and finally enter in the IP address(es) of your TFTP server(s) and you should be good to go


Cisco FXO Disconnect issue

Posted by hassanfahmy Apr 11, 2016



The most common symptoms of this problem are phones that continue to ring when the caller has cleared, or FXO ports that remain busy after the previous call should have been cleared.


Refer Cisco document (Understanding FXO Disconnect Problem)

Refer external source (Understanding FXO Disconnect Problem)



Solution :

FXO port dont know the diconnect frequency used in pstn line. we solve this issue by capturing the parameters( frequency and cadence)


create a custom cptone using the command ' voice class custom-cptone '

using this command we can customize disconnect tone,busy tone,pstn line parameter....


how to capture PSTN parameters for FXO disconnect ???


Method 1:


Goto the following webpage (World PSTN Tone Database)


webpage contains international call progress tones


search your country and select tone




voice class custom-cptone

dualtone disconnect


cadence ...


On your FXO port, you will want a configuration similar to:


voice-port 0/0/0

supervisory custom-cptone


supervisory disconnect dualtone mid-call

connection plar



how to capture PSTN parameters for FXO disconnect ???


Method 2:

method is documented in the following link (capture PSTN parameters for FXO disconnet)


for this method


we need two software


1) Wireshark (download)


wireshark is a packet sniffer , here we use wireshark for capturing packet and using these packet we create a audio file and extract disconnect frequency and cadence value.


2) Cool Edit Pro (download)


used for measuring disconnect frequency and cadence value


Getting the packet capture:

you can get it from the back of your phone. In CUCM, on the phone page, enable Span to PC Port and reset. In CME, use this command under telephony-service and reset

"service phone spanToPCPort 0". On the phone you can confirm: Model Information -> Ethernet Information -> Span to PC Port should be "Yes".


If above method is not working use monitor session command









Getting the packet capture:


Start your packet capture. Place call from FXO to IP phone. Hang up on the FXO and listen to the disconnect tone for 10 seconds. Stop the packet capture.



wireshark captured the voice packet which contains the disconnect sound(frequency)



we need to convert these packets to audio file format


follow the instruction given below:



If the blue voice packets show up as UDP instead of RTP, you'll need to decode them. Right click on one of the UDP packets(blue packets ,depends on wireshark config)


select "Decode As". In the list, you should choose RTP.



Then go to Statistics->RTP->Show all Streams. You should click on the stream from your gateway IP address to your IP phone. Click "Analyze Stream".



This will show you the stream analysis from the gateway to the IP phone. At the bottom you should be able to click "Save Payload". You need to choose theforward direction, and .au as the format. Then choose the filename.



now we have the audio file in .au format



{ Optional method :


You may use your PC (START => Program Files =>Accessories => Multi Media => Recorder) with Headset or Microphone to record the disconnect tone via a telephone set from PSTN/PBX and save to a voice file. }



Determining your frequencies and cadence:








Open the audio file in Cool Edit. You should be able to listen to the stream and confirm it's what you heard from the gateway.








Skip to the part where the disconnect tone is. Highlight the part that is the tone.







Go to Analyze-> Frequency Analysis. This will give you the Time Domain of the audio you have selected.








For DTMF and disconnect tones, you should see 2 distinct spikes in the frequency domain. Hover your mouse over the tip of the spike, and you will find out the frequency. For a disconnect tone, you should have either one or two tones, record these values.



To determine the cadence (on/off timing), you need to zoom in on the tones. Select only the 'on' part of the tone - the part you can hear. Go to View->Display Time Format->Decimal.





In the lower right hand corner, it should give you the "Length". This value is in milliseconds and is what you'll use in your custom disconnect class. Record this - this is your ON cadence.



Next, select the empty area between your first and second tones. Look towards the Length field again and record this value, this is your first OFF time.



Continue to do this for each ON/OFF until there is a pattern.




You will then enter this into your router:



voice class custom-cptone

dualtone disconnect


cadence ...


Note: You want to use 3 or more values here for best results.


On your FXO port, you will want a configuration similar to:


voice-port 0/0/0

supervisory custom-cptone


supervisory disconnect dualtone mid-call

connection plar

How to Export Drivers Using Powershell in Windows 8.1 U1




In Windows 8.1 Update 1 there appeared a new Powershell cmdlet Export-WindowsDriver, that allows to export all the installed third-party drivers (non-Microsoft ones) directly from the Driver Store. The news is excellent, since earlier to export and backup the drivers, you had to use third-party apps, like DoubleDriver, DriverMax, etc.



So, to export all the installed third-party drivers in Windows 8.1, run the Powershell console under the administrator privileges and enter the following command:



Export-WindowsDriver –Online -Destination c:\export-drivers





Note. The driver files are saved to directory c:\export-drivers. It must be created in advance.



If you have to export drivers from the offline Windows image mounted, for instance, to c:\win8_image, the command looks like this:




Export-WindowsDriver -Path c:\win8_image -Destination c:\export-drivers





After you run the cmdlet, the data on the exported drivers that are not a part of the system will be displayed on the screen.





When the export is over, some folders with the name of the corresponding INF files of the drivers appear in the specified folder.





Each folder contains all the files necessary to install a driver in the system (the tool creates the list of files according to the description in the INF file of the driver).





To display the list of all exported drivers in a convenient form with the indication of the class, vendor and the driver version, let’s export the drivers with the two commands:




$BackupDrivers = Export-WindowsDriver -Online -Destination c:\export-drivers





After that let the results be displayed in the table:




$BackupDrivers | Select-Object ClassName, ProviderName, Date, Version | Sort-Object ClassName






The drivers from this archive can be distributed to other systems either manually or automatically with DISM, PowerShell, MDT, SCCM, etc.



Note. Later you can install these drivers with PowerShell or DISM, more info in how to integrate drivers into the Windows 8 image.







So, today we have learned a new cmdlet Export-WindowsDriver in Windows 8.1 Update 1, that allows to export all third-party drivers installed in the system into a separate folder.

It’s very regular issue who works for support team, who have the router/IOS configuration files but can’t retrieve the password. Even I don’t know how you faced the issue guys but it was very regular headache for me until i didn’t know this simple method to decrypt the IOS secrets! No, its by any tool or by any code on C/C++! It’s from the IOS itself!! Now let’s see how it works….


Let’s the username/password string we got from IOS is:


‘username cisco password 7 0822455D0A16554745’


Now we need to find out what’s the actual password encrypted to ‘7 0822455D0A16554745’. Now we will need to take help from another router and follow the command chains like below:


R3#conf t

R3(config)#key chain ?

WORD Key-chain name


R3(config)#key chain decryption

R3(config-keychain)#key ?

<0-2147483647> Key identifier


R3(config-keychain)#key 1

R3(config-keychain-key)#key-string 7 0822455D0A16554745

R3(config-keychain-key)#do sh key chain decryption

Key-chain decrypt:

key 1 — text “cisco007”

accept lifetime (always valid) – (always valid) [valid now]

send lifetime (always valid) – (always valid) [valid now]



So the actual secret was ‘cisco007’!

pos 0)


I was speachless. What the heck does that mean? I could see the startup-config file on the firewall. I could do a "sh run" and see my running config. But I could not copy my running config to startup.


I tried a reboot but that only wiped out my config completely. I had to start over from scratch.


The solution was actually very simple.


Cisco has a built in file check utility to fix problems just like this. Many folks who are familiar with unix systems also know the file system check or fsck utility.


To fix this problem, from the command prompt run fsck...


asa2# fsck disk0:

asa2# fsck flash:


you can replace Disk0 / Flash with any another valume


If this is successful you should see the following output:

asa2# fsck disk0:

dosfsck 2.11, 12 Mar 2005, FAT32, LFN


  Contains a free cluster (10). Assuming EOF.


  Contains a free cluster (14). Assuming EOF.


  "." is missing. Can't fix this yet.


  ".." is missing. Can't fix this yet.

Reclaimed 2 unused clusters (16384 bytes) in 2 chains.

Performing changes.

/dev/hda1: 78 files, 3268/65499 clusters

FAT: "posix" option is obsolete, not supported now


fsck of disk0: complete

asa2# fsck fla

asa2# fsck flash:

dosfsck 2.11, 12 Mar 2005, FAT32, LFN


Start does point to root directory. Deleting dir.


Start does point to root directory. Deleting dir.


  "." is missing. Can't fix this yet.


  ".." is missing. Can't fix this yet.

Performing changes.

/dev/hda1: 78 files, 3268/65499 clusters

FAT: "posix" option is obsolete, not supported now


fsck of flash: complete

asa2# wr

Building configuration...

Cryptochecksum: e07e0e8d 8394d8c5 85ea6cf0 e5ddbe40


2197 bytes copied in 1.80 secs (2197 bytes/sec)



I hope this helps you out as much as it did for me. I was tearing my hair out trying to figure out what was going on.