Tag Archive: SCCP

I flashed 5 of these phones back 6 months ago with some difficulty (after trying different methods/firmware versions/network cables/switches etc I finally got them all working), unfortunately I failed to record my findings! Time to resurrect the blog!

Last week I found myself with a few more Cisco CP-7906G IP phones to convert from old SCCP firmware to SIP. Rather than using the xml.conf method I chose to hard reset (I could remember this is how I did it last time);

  • Hold the # key while powering on the phone (either by POE or mains)
  • Once the red indicator on the handset start flashing release #
  • Key 3491672850*#

As my FreePBX (Asterisk PBX) is running and has the firmware ready I hoped everything would just work… Unfortunately not. All of the phones got stuck trying to pull term06.default.loads. I spent countless hours trying to figure out the problem, including;

  • Trying different DHCP servers (tftpd32, tftpd64, pumpkin & solarwinds TFTP server)
  • Trying different switches, network patch leads and even a direct connection between my laptop and the phones
  • Trying different IP ranges and network configurations

But still the phones repeatedly searched for term06.default.loads;

Dec 30 10:15:32 localhost in.tftpd[24929]: RRQ from filename term06.default.loads
Dec 30 10:15:33 localhost in.tftpd[24950]: RRQ from filename term06.default.loads
Dec 30 10:18:00 localhost in.tftpd[25093]: RRQ from filename term06.default.loads
Dec 30 10:18:00 localhost in.tftpd[25094]: RRQ from filename term06.default.loads
Dec 30 10:19:33 localhost in.tftpd[25151]: RRQ from filename term06.default.loads
Dec 30 10:19:34 localhost in.tftpd[25152]: RRQ from filename term06.default.loads

Eventually I decided to try a few different firmware versions “just in case”. Initially none worked (and they are hard to come by because I don’t have an active Cisco subscription and without one, you cannot download them directly from Cisco).

After almost giving up, I figured out that many of the firmware images I was previously unable to open (.cop or .cop.sgn) were in fact just zip files which can be opened in 7-zip. I recall when using the old technique to upgrade the firmware you need to start with a version around 8.5 then slowly incrementally patch. I didn’t think this was necessary with the “hard reset” technique, but found cmterm-7911_7906-sccp.8-5-2.cop.sgn and gave it a whirl….

Dec 30 10:44:41 localhost in.tftpd[26016]: RRQ from filename term06.default.loads
Dec 30 10:44:42 localhost in.tftpd[26017]: RRQ from filename jar11sccp.8-5-2TH1-9.sbn
Dec 30 10:44:49 localhost in.tftpd[26018]: RRQ from filename cnu11.8-5-2TH1-9.sbn
Dec 30 10:44:51 localhost in.tftpd[26019]: RRQ from filename apps11.8-5-2TH1-9.sbn
Dec 30 10:45:03 localhost in.tftpd[26024]: RRQ from filename dsp11.8-5-2TH1-9.sbn
Dec 30 10:45:05 localhost in.tftpd[26025]: RRQ from filename cvm11sccp.8-5-2TH1-9.sbn

Instantly the phone picked up term06.default.loads and proceeded to pickup the other files!

Once the phone booted, it clearly wasn’t going to register against my PBX (as it’s still running SCCP firmware). So I placed the SIP firmware cmterm-7911_7906-sip.9-4-2SR1-1.cop.sgn back on the TFTP. Carried out another hard reset and again, the phone instantly picked up the new files;

Dec 30 11:01:20 localhost in.tftpd[26726]: RRQ from filename term06.default.loads
Dec 30 11:01:21 localhost in.tftpd[26727]: RRQ from filename jar11sip.9-4-2ES9.sbn
Dec 30 11:01:28 localhost in.tftpd[26729]: RRQ from filename cnu11.9-4-2ES9.sbn
Dec 30 11:01:31 localhost in.tftpd[26730]: RRQ from filename apps11.9-4-2ES9.sbn
Dec 30 11:01:44 localhost in.tftpd[26736]: RRQ from filename dsp11.9-4-2ES9.sbn
Dec 30 11:01:46 localhost in.tftpd[26737]: RRQ from filename cvm11sip.9-4-2ES9.sbn

I provisioned the phones in FreePBX but they seemed to get stuck in a cycle registering/updating locale/rebooting. Fortunately I recalled having this issue previously and determined that the 7906 phones have a relatively short maximum password length which the default FreePBX passwords exceed. I was able to confirm this by looking at the Asterisk log;

[root@localhost ~]# tail /var/log/asterisk/full
[2015-12-30 02:06:30] NOTICE[1915] chan_sip.c: Registration from '<sip:1006@>' failed for '' - Wrong password
[2015-12-30 02:08:07] NOTICE[1915] chan_sip.c: Registration from '<sip:1006@>' failed for '' - Wrong password
[2015-12-30 02:08:54] NOTICE[1915] chan_sip.c: Registration from '<sip:1006@>' failed for '' - Wrong password

Once I changed the password and rebuilt the configs in Endpoint manager the phones registered straight away.

In conclusion, I think the bootloader on the phones needed to be upgraded to enable them to be capable of loading the 9.x firmware. Flashing them with the 8.x firmware first upgraded the bootloader and from there it was plane sailing! I have attached the two firmwares for reference;

As a sidenote; I have never had luck with using DHCP option 150 (in either pfSense or tftpd32). Entering an IP address in it’s normal format has definitely never worked (when I do a wireshark trace I can confirm this). I believe you’re supposed to use some hex format, but having tried this in several different formats i’ve still never managed to get it working. The preferable route seems to be using DHCP option 66 (I believe this supports either a hostname or IP). In tftpd32 you don’t actually need to configure this option, the built in DHCP server automatically configures it to the hostname of the interface running the service.


Damn- i’ve already got lazy and not been updating regularly as i told myself i would. A few bits i remember since last time…

-New fileserver arrived and i have now realised the 2 raid cards i have are useless (i need SATA non-raid cards) for ZFS with FreeNAS. Currently hunting on eBay for something else!
-My rack tft/lcd keyboard/mouse thing packed up- so i need to look for a new one of those too!
-LINQ to SQL: I got hooked a while back but didn’t like the way it interprets some manipulation and couldn’t cope with bulk updates. But now i figured i can simply do db.executecommand() i’m happy!
-I got trixbox working nicely with the Cisco Wireless 7920 IP Phone i bagged cheap off eBay (using SCCP):
setup static ip/dns (system-config-network)
create some extensions?
yum install asterisk16-devel gcc
yum update
wget Chan_SCCP V3.tar.gz
tar -zxvf Chan_SCCP…
make install
copy sccp.conf (from /root/Chan… to /etc/asterisk) + edit
edit /etc/asterisk/modules.conf (add:
noload => skinny_sccp.so
load => chan_sccp.so

-Communicating between multiple forms in vb.NET: I was struggling to figure how to pass information to another form without storing it in a control. I ended up doing something like:
Public Class Form2
Dim edit_acct_row as Int32
Public Sub New(ByVal row_index As Int32)
edit_acct_row = row_index
End Sub

then calling the form like:
Dim f_pick_acct = New Form2(edit_acct_row)

-Checking/Ticking a checkbox in a DataGridView with vb.NET: When simply manipulating the dgv.rows(r).cells(c).value the state of the checkbox was not updating! I ended up having to:
Form1.dgv_preview.Rows(r).Cells(c).Value = True

-My Simpsons Kesha (Ke$ha) Tick Tock Intro Video on youtube has had over 10,000 hits! I’m not working on another video which will take quite some time but i hope will attract quite a lot of attention once complete :)

Wow- a lot squeezed into a small space + tons i’m sure i’ve learnt and forgotten!


%d bloggers like this: