Q.850 cause 38 (Network out of order): what it means

Short answer: Q.850 cause 38 (Network out of order) means the network is not working correctly and the condition is likely to last a relatively long time, so retrying right away is unlikely to help. It is a real failure, not one at the destination. It may be on your link, on the SBC or in the carrier's network. Find out who generated the cause and open a ticket.

How Monitor treats cause 38

When the carrier gives the Q.850 cause in the Reason header of the SIP response, Monitor keeps it beside the SIP code on every test call, and it appears in the incident's evidence, ready for the ticket with the carrier. On the English screens, cause 38 reads: the network is out of order.

Cause 38 also decides how a SIP 480 is read, since on its own a 480 does not say whether the destination rang or nothing answered:

What should answer the number	SIP 480 with cause 38
A greeting or recorded message (the IVR)	Down
A test tone or echo service	Down
Other: it may ring or be answered	Down

Like any failure, a test call read as Down is repeated 3 times, every 2 minutes, and only 4 failures in a row open an incident.

What does cause 38 mean in practice?

Q.850 cause 38, Network out of order, means the network is not working correctly and the condition is likely to persist for a relatively long period. The definition itself says that retrying immediately will probably not work. That sets it apart from cause 41, which describes a passing failure. Under RFC 3398 (section 7.2.4.1), cause 38 becomes SIP 503 Service Unavailable; in the other direction, SIP 502 Bad Gateway maps back to 38. It arrives in the ISUP REL on SS7 links, in the ISDN DISCONNECT, and in a Reason: Q.850;cause=38 on SIP trunks. In Asterisk, ${HANGUPCAUSE} is set to 38 and the CDR shows hangupcause 38 when the field is recorded. In LTE, the “cause code 38” in ESM messages comes from a different 3GPP table and has nothing to do with this cause.

When it appears

• A fiber cut or transmission failure in the carrier’s network.
• A carrier SBC or switch down, with no alternative route for the traffic.
• An E1 in alarm on the carrier’s side.
• An intermediate gateway that receives a 502 from another and converts it into 38.
• Your site’s internet link down, when the local SBC responds on behalf of the network.

How to diagnose it

1. See who generated the cause: in sngrep, the 503 or 502 response shows the User-Agent or Server of whoever responded.
2. Test several destinations. If they all fail over the same trunk, the failure is in the network, not at the destination.
3. Check the link: packet loss and latency to the carrier’s signaling IP address, with ping and mtr.
4. Check pjsip show registrations and the trunk status in FreePBX, Issabel or 3CX.
5. On an E1, dahdi show status shows red alarms (local loss of signal) or yellow alarms (the far end is not receiving your signal).

What to send the carrier

• Date, time and time zone when the failure started, and whether it is still going on.
• The A and B test numbers and the list of destinations that failed.
• The Call-ID, the response received and the Reason with cause=38.
• The mtr result to the carrier’s signaling IP address.
• The circuit ID or the trunk identifier, and the E1 alarms, if any.

Frequently asked questions

Should I retry the call when I get cause 38?

Retrying once does no harm, but the definition of cause 38 says the condition is likely to last, so immediate back-to-back attempts tend to fail the same way. If there is an alternative route, such as another trunk or another carrier, it is better to divert traffic to it while the failure is being handled.

What is the difference between cause 38 and cause 27?

Cause 27 (Destination out of order) says the interface to the destination failed, so the problem is close to the receiving end. Cause 38 says the network itself has a fault. Under RFC 3398, 27 becomes SIP 502 and 38 becomes SIP 503. On an 0800 number that terminates on your PBX, 27 points to your side; 38, to the network.