Villain 1: one-way audio
Mechanism: media is two independent one-way streams; one of them died — asymmetric firewall rules, NAT return-path failure, or (DR) bypass reachable in one direction only. Signature: caller hears callee but not vice versa (or reverse), consistently per site/direction. Proof: capture at the deaf end — RTP arriving? If arriving-but-silent, it's the endpoint (device/mute/driver); if absent, walk the path back. Call Analytics shows per-direction packet counts — a zero column is the answer in one glance.
Villain 2: the ~30-second drop
Mechanism: call sets up, but a confirmation leg (SIP ACK on DR) or the media keepalive path is blocked; a timer expires and tears the call down. SIP-ALG 'helpfully' rewriting packets is the serial offender. Signature: metronomic — drops at the same second mark every time. Proof: SBC trace shows the unACKed transaction or the ALG-mangled headers (Via/Contact rewritten to private IPs). Fix is almost always: disable SIP-ALG at the edge device; confirm by the drop vanishing.
Villain 3: echo
Mechanism: the far end's loudspeaker re-entering their mic — YOU hear the echo, THEY cause it. Certified headsets exist because acoustic echo cancellation needs known geometry. Signature: echo heard by the person NOT causing it; worse with laptop speakers, conference-room double-devices (two joined machines, both live mics). Proof: mute the suspected end's mic — echo stops = confirmed. In rooms: the second device in the roster.
Villain 4: robot voice / underwater audio
Mechanism: packet loss + jitter beyond concealment — congestion, Wi-Fi retries, or TCP-fallback media (the rung-3 tell). Signature: intermittent, correlates with location/time (the 10 a.m. backup job, the far meeting room). Proof: Call Analytics per-stream jitter/loss/RTT graphs; CQD by subnet for the pattern (one subnet's poor-call % vs the estate); transport shows TCP = network denied UDP (see network concept).
Villain 5: ghost calls and no-audio-connects
Mechanism (DR): scanners probing the SBC's SIP port cause phantom rings; service-side, a client with dead media devices auto-answers into silence. Signature: rings with nobody there (scanner) — often at odd hours to mainline numbers; or connects with instant silence (device). Proof: SBC access logs show INVITEs from non-Microsoft sources (lock the ACL to Microsoft's ranges — fixed); device case shows in the client's media log as capture-device failure.
What to watch (standing instrumentation)
- Per-user: Call Analytics — the first click for EVERY voice ticket; per-leg, per-stream, per-direction numbers.
- Per-estate: CQD poor-call % by subnet/building — the villains cluster geographically; a weekly glance beats a monthly crisis. (The Pulse concept is precisely this chart, plus drift correlation.)
- Per-trunk (DR): SBC logs with the ACL locked to Microsoft ranges — ghost calls end and every remaining INVITE is meaningful.
- After every fix: the same measurement that proved the fault, re-run — closure with evidence, not vibes.