SIP 487 Request Terminated: what it means and how to fix it

Short answer: SIP 487 Request Terminated means the INVITE was ended by a CANCEL before the call was answered. Most often the caller hung up while it was ringing, or the PBX gave up after a timeout. It is not a destination failure. Only investigate when it shows up in excess: see who sent the CANCEL and after how many seconds.

How Monitor treats SIP 487

The reading depends on what should answer the number, which is the question 2N5 answers when it adds each circuit. These are the rules the product applies today, generated from the same function that judges every test call.

What should answer the number	After ringing	Without ringing
A greeting or recorded message (the IVR)	Down	Down
A test tone or echo service	Down	Down
Other: it may ring or be answered	Up	Down

For "Other": With "Count ringback as reachable" unticked: Down.

What Monitor records for an IVR: The line rang and nobody answered, but this circuit is supposed to answer every call by itself (SIP 487).

A call read as Down alerts nobody on its own: it is repeated 3 times, every 2 minutes, and only 4 failures in a row open an incident, with each call's SIP code and Q.850 cause as evidence for the carrier. At the default pace, every circuit is tested every 15 minutes.

If the carrier returns SIP 487 when 2N5's calling account registers, before any call, the test is monitoring blind: it is a problem on 2N5's side, it does not count against the circuit and it does not alert the customer.

What does SIP 487 mean in practice?

SIP 487 Request Terminated is the response a request gets when it is ended by a BYE or a CANCEL, according to RFC 3261. In the typical case, the flow goes like this: the INVITE goes out, the destination responds 180 or 183 and starts ringing, the caller gives up and your side sends a CANCEL. The destination confirms the CANCEL with 200 OK and answers the original INVITE with 487.

So the 487 comes from the destination, but the decision to end the call came from the caller. It shows up all the time in PBX logs and is almost always normal. The SIP 487 error only deserves investigation when the volume breaks the usual pattern, when the CANCEL always goes out after the same number of seconds (a sign of a configured timeout), or when the CANCEL comes from a device you do not control.

Common causes in Brazil

• The customer gave up while it was ringing or while listening to a message before the call was answered.
• Ring time ran out on the PBX: Asterisk’s Dial() timeout, or the ring group or queue timeout in FreePBX and Issabel, expired and the PBX sent a CANCEL.
• A simultaneous ring group: one extension answered and the others received a CANCEL.
• An IVR queue that overflows to another destination after a while, canceling the previous attempt.
• A campaign dialer with a short ring time that gives up before the person can answer.
• An SBC between the PBX and the carrier’s trunk with its own timer, which cancels the INVITE before the PBX’s timeout.

How to diagnose it

1. Open the call in sngrep and find the CANCEL: see who sent it and how many seconds passed since the INVITE and since the 180 or 183.
2. If the CANCEL leaves your PBX after the same interval every time, such as 20, 30 or 60 seconds, review the Dial() timeout in the dial plan or the ring time of the group and the queue.
3. Turn on pjsip set logger on (or sip set debug on with chan_sip) and read the CANCEL’s Reason header, such as Reason: SIP;cause=200 or Reason: Q.850;cause=16.
4. On Asterisk, check the DIALSTATUS variable: CANCEL means the caller hung up before the call was answered, and NOANSWER means the ring time ran out.
5. On 3CX, enable detailed (Verbose) logging and see in the Activity Log who ended the call before it was answered.
6. Compare the share of calls ending in 487 with the day’s total. A sudden rise usually comes from a configuration change or an overloaded queue.

What to send the carrier

• Only open a ticket if the CANCEL came from the carrier’s side without anyone on your side hanging up.
• Exact date and time with the time zone, for example 2026-10-07 14:32:10 -03:00.
• Calling number (A), destination number (B) and the Call-ID.
• The full sequence: INVITE, provisional responses, CANCEL and SIP/2.0 487 Request Terminated, with the time of each message.
• The CANCEL’s Reason header and how many calls were affected.
• The pcap file of the capture, if you have one.

Frequently asked questions

Is SIP 487 an error?

Most of the time, no. It is the standard response to the INVITE after the calling side sends a CANCEL, and it appears in any PBX log with unanswered calls. It becomes a problem when it shows up in unusual volume, with a ring time that is too short, or with a CANCEL that nobody on your side asked for.

Which Q.850 cause corresponds to SIP 487?

RFC 3398 defines no Q.850 cause for the 487. On the way from the phone network to SIP, Q.850 cause 16 (Normal call clearing) usually becomes a BYE or a CANCEL, not a response code. That is why, when a call comes from a telephone exchange and the caller gives up, you see the CANCEL followed by the 487.

Why do I see 487 on extensions that did not answer a ring group?

In a simultaneous ring group, the PBX calls several extensions at once. When one answers, it sends a CANCEL to the others, and each one responds 487. The CANCEL may carry the Reason header indicating that the call was completed elsewhere. This is expected behavior.