The SIP BYE Glare Trap: Why Teardown Race Conditions Leave Phantom Calls Billed on Cloud Trunks

---

The Core Premise: Why Simultaneous Hang-Ups Cause 60-Minute "Ghost Calls"

When both participants on a Voice over IP (VoIP) call hang up at the exact same instant, the call does not cleanly terminate; it triggers a protocol race condition known as "BYE Glare" that silently keeps carrier billing meters running for hours. Under IETF RFC 3261 and RFC 5407, terminating a voice session requires transmitting a SIP BYE request and receiving a 200 OK response. In high-volume enterprise telecom environments—especially modern deployments pairing human callers with conversational AI voice agents—simultaneous hang-ups are extraordinarily common: the AI finishes saying "Thank you, goodbye" and issues a teardown command at the exact millisecond the human taps the red end-call button. Because both BYE packets cross in transit across the public internet, each endpoint receives a teardown request for a dialog it has already marked as closed. Broken SIP stacks and legacy Session Border Controllers (SBCs) panic, returning SIP/2.0 481 Call/Transaction Does Not Exist. Upstream wholesale carrier billing engines (e.g., Twilio, Bandwidth, Telnyx, Sinch) frequently interpret a 481 response not as a successful confirmation of termination, but as an unacknowledged failed transaction. The Call Detail Record (CDR) remains active, media relays (RTPEngine, Asterisk, FreeSWITCH) keep high-port UDP sockets pinned open waiting for timeout thresholds, and enterprise customers are billed for a 60-minute conference call that lasted 18 seconds.

"There is no line item on a telecom invoice more insidious than the phantom 60-minute call. Both the human and the AI hung up thirty seconds in, but because two BYE packets crossed in flight on the wire, the billing engine kept the meter running until the maximum session timer expired."

The Protocol Mechanics: How Crossed Signals Spawn the 481 Error

To understand why teardown race conditions paralyze voice infrastructure, trace the signaling packet exchange governed by RFC 5407 (Section 3.2.2, "BYE Crossed with BYE"):

• The Simultaneous Teardown: User Agent Client (UAC - Human) and User Agent Server (UAS - Cloud PBX or AI Agent) simultaneously decide to terminate the call.
  1. UAC transmits BYE (CSeq: 102 BYE) towards UAS.
  2. UAS simultaneously transmits BYE (CSeq: 201 BYE) towards UAC.
• The First Arrival & Dialog Destruction: UAS receives UAC's BYE. The UAS signaling stack immediately transitions the internal dialog state to TERMINATED, frees the local RTP media handles, and responds with SIP/2.0 200 OK.
• The Collision on the Wire: Meanwhile, the UAS's original BYE arrives at UAC. However, UAC has already received the UAS's BYE and destroyed its local dialog context.
• The Fatal 481 Rejection: Because the UAC no longer finds an active dialog matching the Call-ID, From, and To tags in its memory table, it strictly adheres to RFC 3261 Section 15 and responds with SIP/2.0 481 Call/Transaction Does Not Exist.
• The Carrier Billing Black Hole: Upstream carrier softswitches tracking the call through an intermediate SIP trunk evaluate the transaction. They observe a BYE that received a 481 error instead of a 200 OK. If the carrier softswitch relies on strict end-to-end transaction matching to write the CDR disconnect timestamp, the session stays logically "active" in the billing database until a hard session timer (often 3,600 seconds) forces an administrative cleanup.

The 4 Hidden Traps in SIP Teardown Architecture

1. The AI Voice Agent Hang-Up Multiplier

In traditional human-to-human telecommunications, BYE glare occurred in less than 0.1% of calls because one party almost always hung up slightly ahead of the other. Conversational AI voice agents (built with WebRTC, Twilio Media Streams, or SIP trunks via Bland, Vapi, Retell, or LiveKit) have made simultaneous hang-ups an epidemic:

• Deterministic Speech Completion: Voice models detect the end of an interaction, synthesize a farewell sentence, and immediately trigger an automated webhook: call.hangup().
• The Human Reaction Window: Human users hear the synthetic agent say "Goodbye" and tap the disconnect button within the exact same 300ms window, causing BYE glare rates to surge to 5% to 8% of all outbound calls.

2. Orphaned UDP RTP Port Leaks

When signaling fails to resolve cleanly, the media plane suffers resource starvation:

• The Missing RTCP BYE: Endpoints are supposed to transmit an RTCP packet containing a BYE item on the media port pair (UDP ports 10000–20000) when ending a session. In high-jitter wireless or mobile environments, this UDP packet is frequently dropped.
• Port Exhaustion on Media Relays: Media relays like RTPEngine or FreeSWITCH allocate 2 UDP ports per call leg (1 for RTP, 1 for RTCP). If the signaling layer fails to issue an explicit teardown command due to a 481 transaction error, the media relay holds those UDP ports open until its internal rtp_timeout timer expires (typically 60 seconds to 10 minutes), exhausting the kernel's ephemeral port range under peak traffic.

3. The Strict Stateful Proxy Retry Loop

When stateful SIP proxies (like Kamailio or OpenSIPS) forward a BYE and receive a 481 from an upstream carrier, naive proxy routing logic treats the 481 as a recoverable network failure:

• The Retransmission Storm: The proxy retransmits the BYE up to 7 times (governed by SIP Timer F / Timer B) over a 32-second window, consuming proxy worker memory and generating unnecessary network traffic for a call that is already dead.

4. CDR Discrepancies and Invoicing Disputes

Enterprise voice aggregators reconcile CDRs between wholesale carriers and customer PBXs:

• Your internal PBX logs show a call duration of 12 seconds.
• The wholesale carrier invoice shows a call duration of 3,600 seconds ($1.80 instead of $0.006).
• When scaled across 500,000 monthly automated outbound calls, BYE glare accounts for tens of thousands of dollars in disputed billing charges every quarter.

Architectural Comparison: Naive SIP Proxy vs. Calricon RFC 5407 Compliant Core

Dimension	Standard Default SIP Implementation	Production Failure Mode	Calricon Resilient Core Pattern
481 on BYE Handling	Treated as a failed transaction error	Retransmission storms; billing clock keeps running	Treated as success; terminates billing immediately
BYE Inbound on Closed Dialog	Returns 481 Call Does Not Exist	Confuses upstream peer and triggers CDR lockups	Returns 200 OK within 5-second tombstone window
Media Teardown Trigger	Tied strictly to 200 OK signaling receipt	Orphaned UDP ports on failed 3-way handshakes	Immediate media teardown on first BYE transmission
Carrier Ingress Normalization	Passes through raw client response codes	Carrier CDR mismatch and inflated invoices	SBC rewrites incoming 481 to 200 OK for billing leg

The Calricon Production Playbook: Taming Teardown Race Conditions

1. Implement the 5-Second Dialog "Tombstone" Buffer (RFC 5407 Section 3.2.2)

Per RFC 5407, when a user agent sends a BYE or receives a valid BYE, it must not instantly vaporize the dialog context from memory. It must maintain a short-lived Tombstone State for 5 to 10 seconds:

• If a crossed BYE arrives for a tombstoned dialog, the SIP stack recognizes the call-ID and immediately returns 200 OK instead of 481 Call/Transaction Does Not Exist.
• Both sides receive clean 200 OK acknowledgments, closing the signaling transaction cleanly across both state machines.

2. Normalize 481 Responses at the Edge SBC / Proxy Layer

If you route traffic through intermediate carriers that struggle with BYE glare, configure your edge Kamailio or OpenSIPS proxy to catch 481 responses to BYE requests and translate them to synthetic 200 OK confirmations:

# Kamailio: Catch 481 on BYE and treat as successful termination
onreply_route[HANDLE_BYE_REPLIES] {
    if (is_method("BYE")) {
        # If peer says call does not exist, the call is dead!
        if (t_check_status("481")) {
            xlog("L_INFO", "BYE Glare detected on Call-ID: $ci - Normalizing 481 to 200 OK\n");
            # Force immediate CDR termination in local database
            acc_db_request("200", "acc");
            # Instruct RTPEngine to drop media ports immediately
            rtpengine_delete();
            # Terminate transaction gracefully
            drop;
        }
    }
}
  

3. Decouple Media Relay Teardown from Signaling Confirmation

Never wait for the signaling three-way handshake to complete before instructing your media relay (RTPEngine) to close UDP audio sockets:

• The millisecond your application decides to send a BYE, immediately dispatch an asynchronous delete command to RTPEngine.
• Even if the network drops subsequent signaling packets or encounters a 481 collision, the audio stream is silenced instantly, preventing runaway bandwidth usage and freeing kernel UDP ports immediately.

4. Automated CDR Duration Sanity Audits

Configure automated data pipeline checks comparing upstream carrier CDR durations against internal application-layer session durations. Flag any call where carrier billing duration exceeds application audio duration by more than 60 seconds. Automating this audit provides immediate evidence to dispute inflated wholesale carrier invoices caused by teardown glares.

The Strategic Takeaway: Clean Teardowns Are as Vital as Clean Setups

Telecom engineering teams invest massive effort into optimizing call setup latencies (sub-100ms PDD) and audio quality, while treating call teardown as an afterthought. In modern real-time systems dominated by high-frequency automated voice agents, signaling race conditions at the end of a call are just as destructive as failures at the start.

By enforcing RFC 5407 tombstone buffers, normalizing 481 responses at the proxy edge, and decoupling media release from signaling round-trips, voice infrastructure leaders can permanently eliminate phantom call duration, protect media server capacity, and save tens of thousands of dollars in billing discrepancies every month.