1.1 Hardware versions
There are two versions produced: F1000 and F1000G. The only hardware difference between them is the WiFi radio module. The F1000 phone supports 802.11b wireless LAN specification. The F1000G supports 802.11g as well. The two versions can be distinguished by the startup screen showing either "F1000" or "F1000G"; the label inside the battery compartment also states the phone hardware version. Software drivers are different and users should NEVER attempt to download the F1000 firmware into F1000G, and vice versa.
1.2 Wireless device F1000 is built around the WV8307 wireless phone platform produced by Agere. Data transfer rate varies dynamically in steps (11, 5.5, 2, 1 Mbit/s). The transmit power (TX) of this phone is 20mW, compared to 200mW for a typical cell phone. Receiver sensitivity (RX) varies with the WiFi connection speed; higher data rate requires a stronger signal.
For F1000, RX sensitivity working range varies from -91dB at 1 Mbit/s to -83dBm at 11 Mbit/s.
For F1000G connected at 802.11b (lower) speeds, sensitivity is -93dBm to -88dBm.
For F1000G (at the full range of 802.11g speeds), sensitivity is –86dBm at 1 Mbit/s to -72dBm at 54 Mbit/s.
To measure received signal strength see Service screen.
1.3 Earphone Socket
Any 2.5 mm 4-conductor headset (4 conductors/3 insulators) works with the F1000. They are labeled as "Nokia Style" in US retail stores. The button on the headset has no function assigned (with Nokia compatible phones, it initiates or answers a call). The 3-conductor/2-insulator headsets plugs are not compatible.
1.4 Voice encoding
Overall sound quality of WiFi VoIP phones is influenced by several factors: CODEC (speech encoding method) used, available network bandwidth, voice transcoding at the server side (to overcome eventual codec incompatibility), RF noise in the WiFi frequency, interference with other WiFi devices, voice packets transport time (latency).
F1000 codecs are user-selectable via the F1000 web interface. G.711 codec usually gives best results if bandwidth is not an issue. G.729 is a good choice if the user's primary concern is to conserve bandwidth. G.726 gives highly variable sound quality from good to unacceptable. It has been confirmed that the F1000 implementation is incompatible with some other G.726 implementations. If users experience sound quality problems with G.726 enabled, the only remedy is to turn it off.
For Vonage-branded phones, codec selection has been removed from the firmware. Instead, users have to log into their Vonage web account, go to the "Dashboard", select Features/Bandwidth_Saver, and choose from 30, 50 or 90 Kbit/s (G.729, G.726 and G.711, respectively).
1.5 USB Port Interface
The port at the bottom of the handset is a mini-USB form connector. PC config software can be used to configure handset parameters using this port, but this requires additional hardware (SO writer) connected to PC's COM port and also a software tool. End users are not expected to use the USB port this way and the manufacturer has not published any details about the configuration process.
1.6 Telnet Interface
On early shipped phones prior to firmware release 3.10, both telnet and rsh (remote shell) access were enabled. Telnet access (at port 23) remains active, but is password-secured and is meant only for internal debugging procedures and direct memory and processes manipulation. Starting from firmware release 3.60, most user-related functions are available via standard web interface (see the User manual).
1.7 MAC Address MAC address is a globally unique numeric identifier, assigned to the phone wireless module. The F1000 MAC address is printed on the cardboard box and on the label inside the phone's battery compartment. You can also read it via the phone's web interface. Wireless modules inside the F1000 phones have MAC addresses in the range 00:07:xx:xx:xx:xx.
2.1 Battery charger
The original F1000 charger specifications are: Input: 100-240V AC 50-60Hz; output: 5.2V DC 600mA; mini USB connector. Some GSM phones on the market use similar chargers. If the charger output is 5.2VDC - or 5VDC - and it shows a wide range for input voltage (indicating that it is a switching supply and not a magnetic transformer), then it will likely charge the F1000. You should also check the maximal output current. If your charger does not deliver 600mA, it may only be used to keep the phone in the charged state (trickle charge), but will probably refuse to charge a F1000 with an empty or near empty battery.
2.2 Charging via USB
The USB cable hooked to a notebook or PC will charge the phone, but not fully. It will charge more with USB 2.0 than 1.1, but either will charge.
2.3 Desktop charger
Desktop charger for the F1000 may be purchased separately and can be found in the catalogues as "F1000 desk stand/charger".
2.4 Power saving mode
All phones should be shipped from UTStarcom with power saving mode (sleep mode) enabled. However, it may be useful to disable the power savings temporarily for debugging, network traffic monitoring or signal measuring purposes.
1) Invoke the ATE menu (see part 7) and wait for the "Func No:" prompt.
2) Enter 10 and press the green key.
3) Press 0 for 'disable' or 1 for 'enable'.
4) Press the green key. Wait for "Success".
5) Turn off the phone and load the battery fully.
WARNING: If this feature is turned off, the expected battery life decreases to about 12 hours. The phone is NOT intended to run that way in normal use.
2.5 Overcharge bug
About 5% of phones tend to reboot at irregular intervals when fully charged and still connected to the charger. This behavior is firmware independent. The obvious workaround for the affected unit is to disconnect the charger after recharging. It has been reported that performing factory reset might cure this problem.
3.1 Upgrade policy
UTStarcom does not offer any firmware related files for public download. The manufacturer's policy is that users get firmware from either the VoIP carrier offering service or from an authorized distributor of the phone. You should therefore be able to get the latest firmware version from the same place where you got the unit.
3.2 Firmware versions
F1000 firmware numbers range from 2.x to 3.x, latest official unrestricted version being 3.80st. F1000G firmware numbering scheme is 1.x and 2.x; the latest version is 2.70st. Phones locked to a particular VoIP provider may use a different numbering; Vonage firmware releases - substantially different from the manufacturer's version - are actually numbered 5.x.
3.3 Firmware upgrade (automatic provisioning)
If the phone was sold as a part of the VoIP service bundle, the upgrade server IP address points to the provider's TFTP server (= config server, provisioning server). The phone gets the newest firmware and/or configuration from there.The mechanism of downloading and decompressing the file is automated; the phone will restart after a successful upgrade for the changes to take effect. Setting the upgrade server IP address to 0.0.0.0 (or leaving it blank) disables this feature.
Note: The provider may have hardcoded the server address in the firmware to bind the phone permanently to their service. Vonage-branded phones will not work if they are not allowed to connect to their upgrade server at regular intervals (1 hour or less).
3.4 Firmware upgrade (remote)
One of the F1000 forum members - Beta Teilchen - keeps a web page dedicated to the F1000 remote upgrade. On February 25, 2006 12:00 AM, Beta Teilchen wrote:
"Especially for users without Windows, I set up a public upgrade server which is provider- and distributor-independent. You can find this server
on http://utstarcom.betateilchen.de and this server is capable to deliver
firmware files to your phone via http or tftp - depending which method you configure in your phone." 3.5 Firmware upgrade (local)
Firmware can be transferred to the phone using local wireless LAN. This method requires that the upgrade files be downloaded to a local computer first. Upgrade instruction can be usually found at the vendor's/provider's web page. Users who are not bound to any specific provider may consider visiting the Sipgate (Germany) web page. The unrestricted firmware version 3.80st (for F1000 only) and 2.70st (for F1000G only) can be downloaded from there.
The file contains the firmware and an uploader program for Windows XP and 2000; Linux with wine will also work. The upgrade instructions follow:
1) Get and unpack the file
2) Connect a PC to the WLAN router, preferably with a CAT5 cable (users reported that wireless connection will not work reliably for the upgrade).
3) The Subnet-Mask for all the devices involved must be 255.255.255.0
4) Select Menu/Misc/Local_TFTP_Update on the phone
5) Start the upgrade program (fwupgrade.exe) on your PC
6) Reset the phone after upgrade in order to correctly initialize all values. F1000 may show unpredictable behavior if the final "Factory reset" is omitted.
Note: Users reported that the local upgrade may not work with a "cheap AP". Try using another AP (from a different manufacturer). Reasons for upgrade failure with "cheap APs" are not known. If the update process fails to initiate, first things to check are:
- are both equipments (your PC and F1000) on the same IP subnet?
- can you ping F1000 from your PC?
- are you sure that you don't have IP conflicts in your network?
- are you sure your access point is not blocking inter-users traffic?
- are you sure you are not using any type of personal firewall or protection
tool on your PC that can block packets?
3.6 Technical information
The encoding method for encrypting the F1000 configuration file for download is aes-256-cbc. The filename would be mac_address.aes, where "mac_address" is the phone's MAC address string (without separators). The default encryption key that the phone tries to use depends on the voice service provider, can be NULL (empty string), 'F1000' or something else not disclosed (in this case, users are not supposed to mess with it).
Administrators who plan to manage F1000 configuration centrally using automatic provisioning should get the configuration compiler from their phone vendor, run a local TFTP server and put the configuration files on it. When generating these files, encryption string should be set to NULL.
4.1 Phone Passwords
Password is required to change settings via keyboard or login to the phone's web interface. Phone passwords are factory preset and documented in the user's manual. Default values are:
login name = admin, password = psw login name = user, password = 888888 .
Whenever the phone prompts for the "Security Code", it expects the phone's user password to be entered. The user password can be changed under Menu/Settings/Set_Security/Change_Code; it must stay 6 digits numeric. If the default password does not work, it is highly probable that the provider has changed it in order to protect their SIP configuration.
Note: The phone's user password (= Security Code) and the SIP password are different things.
4.2 Phone Reset
The web interface offers a simple way to reset to factory defaults. It is necessary to login to the phone's admin account to perform a full reset. Go to the "Advanced" screen. Click on "Factory Reset" then "Submit" and "Reboot phone".
Early manufactured phones can be reset to factory defaults, including admin and user passwords, using the undocumented ATE menu feature.
1) Invoke the ATE menu and wait for the "Func No:" prompt.
2) Enter 37 and press the green key. Wait for "Success" and press red key.
3) Enter 38 and press the green key. Wait for "Success" and press red key.
4) Enter 41 (=Clear User Data) and press the green key. Wait for "Success" and press red key.
5) Turn the phone off and back on - it should be totally cleared and the default passwords will be set.
WARNING: Performing the ATE reset will also clear the phonebook entries and all user-specific settings.
4.3 User-defined Display
Press Menu/Settings/Scheme/Static_Picture/User-defined. You can put in up to 12 characters of alphanumeric text. This feature may be used to show the phone's number, service provider, or subscriber's name on the "standby" display. You may also want to turn off the screensaver to ensure that your text stays on the screen all the time. However, user-defined graphic picture can not be uploaded nor displayed.
The F1000 delivers unique ringtones based on the calling party ID. The phone takes the caller ID number and looks in its phonebook. If there is a match, the phone will ring based on the group the number is assigned to (Friend, Family, Colleague, ...). These group identifiers can be used as desired to deliver different rings.
4.5 Sound Volume
Some users reported the sound output to be too low to assure good hearing, especially in noisy environment. It is possible to adjust the volume during the call by pressing the right arrow on the central rocker button.
If you experience an audible echo, then the other party's hardware is to blame; the other side should turn on the software echo supression, or use closed earphones, if possible.
4.6 Clock Setup
Users need not bother with entering the correct time, as the clock gets synchronized automatically via internet connection. If the clock keeps on resetting to a wrong hour, you should check first the phone's time zone (Menu/Tools/Time_Zone) and Daylight Savings Time setting (DST) (Menu/Tools/Daylight_Saving). However, DST switching is not automated and must be done manually twice a year.
4.7 Backing Up Settings
There is currently no way to save phonebook entries (max. 200 items). SIP profiles or other settings can not be backed up. You can only copy and paste texts from the phone's configuration web page, or save all the F1000 web pages locally for future reference.
5.1 Connection Profiles
The phone has four memory positions to store preferred wireless networks. You should save the networks that you use most of the time in the top memory slots (SSID1, SSID2 and SSID3). At startup, the phone checks each SSID to see if it can establish a WiFi connection. It takes a few seconds on each one, because it looks for hidden/non-broadcasting APs as well as those broadcasting. If it finds nothing, then it goes on to search any open AP.
To bypass the whole proces, you can press Menu/WiFi_Settings/Net_Search to obtain a list of APs available. Pick an AP from the list, then press Save (to Profile SSID4 which can be used for temporary storage), then press Activate.
5.2 Autoscan mode
To make the initial connection you just set the phone to Auto Scan and the F1000 automatically connects to the nearest open access point. This also should make the F1000 look for APs should it drop out of a coverage. If you disable Auto scan, then the search stops after checking the four saved SSID profiles. If you only want the phone to associate with a single SSID, you can put it's settings in all four profiles and turn off Auto scan.
5.3 Ad hoc local connection
It is possible to register the F1000 over DHCP enabled Ad hoc connection to a local PC.
The standard process of setting up an Ad hoc connection on a Windows XP machine is described here:
http://www.microsoft.com/windowsxp/using/networking/expert/bowman_02april08.mspx5.4 WLAN connection w/authentication
Many WLANs (e. g. WiFi hotspots in hotels) provide authentication dialogue via web page only, using either http or https protocol. F1000 does not support https authentication due to its HW/SW limitations. For purpose of a http-based authentication, F1000 offers a mechanism to download and run predefined authentication scripts. The idea was that users would build up and debug scripts for various hotspots and share them with other F1000 users. However, UTStarcom has not published any information about programming such scripts.
In order to get past the web "Welcome page", a laptop is needed to perform authentication for the first time and once per 24 hours. The laptop's wireless device MAC address must be changed to mimic the F1000 MAC address, either by operation system resources (see Wikipedia) or using a third party program, e. g. Mac Makeup or SMAC.
5.5 Moving from one AP to another
In large buildings or complex areas, F1000 can move from one Access Point (AP) to another AP without dropping the call (handover capability). All APs ensuring the WiFi coverage should be connected to one router and belong to one network (with the same SSID); they must not be configured to provide DHCP nor routing.
6.1 F1000 SIP Settings (partial list)
SIP Register Server Mode = (static IP or DNS)
SIP Register Server Domain = sip.your_provider_name.com
SIP Register Server IP Address = (IP address or 0.0.0.0 if using DNS)
SIP Register Server Port = (usually 5060)
SIP Outbound Proxy = (static IP or DNS)
SIP Outbound Server Domain = (may be the same as SIP Register Server Domain)
SIP Outbound Server IP Address = (IP address or 0.0.0.0 if using DNS)
SIP Outbound Server Port = (usually 5060)
SIP User Name = (what the provider gave you as "SIP user name" or "SIP ID", usually your SIP phone number)
SIP Authentication String = (if the provider did not mention it, use the same string as SIP user name)
SIP Password = (your SIP password given by the provider; the phone will ask for the Security Code first)
STUN Server Name = (provider's STUN server or any other working STUN server)
STUN Server Port = (usually 3478, but it may differ - check the STUN server settings)
STUN On/Off (if not explicitly required by the provider, do NOT use STUN)
6.2 Time Server
The phone gets current world time automatically from pool.ntp.org or ntp.nasa.gov. The IP addresses are factory preset and users can not change them directly (but see below). Local time displayed depends on both the Time Zone and Daylight Savings Time (DST) settings in the phone.
If you are behind a firewall that blocks time sync requests, ask the site administrator to open the NTP port 123. He/she may instruct you to use a local (internal) NTP server instead. In order to change the NTP server address to a local machine, visit the web page http://utstarcom.betateilchen.de. The page is maintained by Beta Teilchen, one of the UTStarcom forum members. Follow the instructions in the section "Enterprise Config" to obtain a special setup file with NTP server(s) of your choice.
6.3 TFTP Server
F1000 connects to this server at startup (after establishing the WiFi connection and before registering to VoIP provider). The phone checks whether there is a new file (firmware or provider-specific configuration) to download. If found, the file is transferred to the phone using TFTP and decompressed, overwriting the previous firmware/settings.Actually, only few VOIP providers run their TFTP server to deliver files to their customers' phones. Most of them let the users configure the phone manually. If in doubt, follow the instructions given by your distributor/provider.
The default value "tftp.config.com" can be changed under Menu/Misc/Remote_TFTP_Server. Users with unlocked phones may want to set the TFTP server IP address to 0.0.0.0 (or leave it blank) and update the firmware using one of the methods discussed earlier.
6.4 SIP Register Server
This setting does not affect (as one might expect) the server used for registration; F1000 seems to work a little bit diferent than other VoIP devices. F1000 sends both registration and voice packets only to the SIP Outbound Server, defining itself as SIP_User_Name@SIP_Register_Server_Domain or SIP_User_Name@SIP_Register_Server_IP_Address .
Using domain name or IP address in the identification string depends on the SIP_Register_Server_Mode setting.
6.5 SIP Outbound Server
This is the server that F1000 uses for SIP registration and all the VoIP communication. Some providers say that you don't need to use outbound; in this case you must copy the SIP_Register_Server values into the SIP_Outbound_Server fields. F1000 waits 2 minutes for the registration confirmation (which would be the incoming SIP code "200 OK"). If the registration fails, F1000 will keep on retrying at its register intervals while displaying the warning "No AP service, try other AP".
Without registering properly via the SIP Outbound Server the F1000 does not get into the state of making or accepting calls.
6.6 Register Interval
This is the time after which the phone sends a new REGISTER message to the SIP server. Default F1000 value is 60s; this may be changed under Menu/Network_Services/Register_Interval. The SIP server may dictate a longer registration interval (e. g. by returning a SIP code 423 with a Min-Expires header field).
Some SIP servers do not tolerate re-registering at short periods. Increasing the setting (to 120s or more) might help in these cases. Intervals recommended by VOiP providers vary between 300s and 3600s.
6.7 STUN server STUN server provides the phone with information about the firewall(s) and NAT type between the phone and the internet. If you use a STUN server, check the server port settings: F1000 sets port 10000 as default, while most STUN servers use port 3478. However, if your firewall blocks the port 3478, you may want to choose a server with non-standard settings (e. g. stun.sipgate.net runs on port 10000).
If no STUN server address was mentioned in the provider's setup instructions, then you are not expected to set up STUN nor use it. Some SIP proxies may get confused if your phone uses STUN information to modify the outgoing SIP packet headers. Also, if you are behind a symmetric NAT, STUN should not be used.
6.8 Null Packets
This setting forces the phone to send empty "null packets" (keepalives) at certain intervals via a router or firewall in order to keep the communication port open. If users behind the firewall with NAT experience loss of connection due to timing of resources, the issue should be rather addressed by proper router configuration. Using null packets does not solve the problem - it only masks it in order to make things work (with the result of polluting the web with obsolete traffic).
6.9 Internet Connection Test
Change the clock (either manually or by disconnecting the battery). If the clock resets to the proper time, then the internet connection is working. In cases when SIP is blocked by a firewall, it is common for NTP to not be blocked - hence the clock synchronization wil tell you if the phone is connecting at all, but it does not assure that SIP signals and voice stream will also go through.
6.10 Log Messages
Press Menu/Misc/Local_log to see the last 20 messages exchanged between the phone and the SIP proxy. Messages with higher numbers are newer. The three-digit numbers are SIP response codes (see RFC 3261 for the complete list). The most common codes are listed below:
100 = Trying
180 = Ringing. The user agent receiving the INVITE is trying to alert the user.
200 = O.K.
302 = Moved temporarily. The other party is temporarily unreachable.
400 = Bad Request. (Check the STUN settings in the phone. You may accidentally have put the SIP server address into the STUN server field.)
401 = Unauthorized. (You found a SIP server, but it is not happy with your account credentials.Check username, authentication and password string fields in the SIP menu. On rare occassions the 401 response may be caused by the registration interval set too short - see code 423.)
403 = Forbidden. The server has rejected the attempt to register, probably due to an invalid or incorrect "To" field in the received packet header. Some servers do not tolerate if a tel: URI is placed inside the "To" field.
404 = Not found. (Check the extension that you are using for the SIP username. The server can't find it.)
407 = Proxy authentication required. (A string of "Register out" followed by 407 in is most likely a case of the SIP server not accepting your authentication string - often the same as your SIP user name - or your password.)
423 = Interval too brief. (Try to increase the phone's register interval. Default setting in F1000 is 60 sec.)
479 = Please don't use private IP addresses. (Your "Register" message contained a private IP address instead of a public IP. Being behind a NAT causes this problem. Using STUN server might help to overcome the NAT barrier. If you use an Asterisk server, check the "externip" and "localnet" parameters in the [general] section of your sip.conf file.)
486 = Busy Here. The callee's end system was contacted successfully, but the callee is currently not willing or able to take calls.
7.1 Service Screen
Press * and # and power button simultaneously. The phone screen will display RSSI (Received Signal Strength Indicator) and Batery Count, instead of the usual picture(s). This feature is useful to measure the received signal intensity and check the coverage of your AP. Battery count displays the remaining battery capacity (readings are probably in mAh (?), decreasing from 800 downwards).
Restarting the unit will bring back the standard display scheme.
7.2 Secret menu
This is an undocumented Operating System level function, referred to as "ATE menu". It was implemented on early shipped phones only. Invoking the ATE menu requires the following steps:
1) Turn off the phone.
2) Hold 1 and 9 and the power button simultaneously for cca 3 seconds.
3) Wait for the input field "Func No:". The phone is now in the "ATE state", ready to receive ATE commands via keyboard.
4) Enter the required ATE commands (known key sequences are power savings setup and phone reset).
5) Turn the phone off and on again. This will clear the ATE state and make all changes valid.
Note: The ATE menu is implemented on some - but not all - F1000 phones. It has been reported that the ATE menu feature is hardware dependent and can not be brought back by changing the firmware.Most providers now sell phones without the ATE menu, which makes the password reset impossible.