SIP and Wireshark

(SIP)
Session Initiation Protocol
What is a SIP?
Session Initiation Protocol (SIP)

Is a text based signaling protocol. Developed in
1996
The SIP protocol is situated at the session layer
in the OSI model, and at the application layer in
the TCP/IP model.
SIP is designed to be independent of the
underlying transport layer; it can run on TCP or
UDP port 5060 or 5061.
RFC 3261
SIP Terms
SIP User Agents (UAs) are the end-user devices, used to create and manage a SIP session. A SIP
UA has two main components, the User Agent Client (UAC) sends messages and answers with SIP
responses, the User Agent Server (UAS) responds to SIP requests sent by the peer. SIP UAs may
work in point to point mode. Typical implementations of a UA are SIP softphones, SIP hardphones
and SIP-enabled ATAs. In my case the SIP UA is a Cisco 2811 acting as a VoIP Gateway.
Proxy, Proxy Server: An intermediary entity that acts as both a server and a client for the purpose
of making requests on behalf of other clients. A proxy server primarily plays the role of routing,
which means its job is to ensure that a request is sent to another entity "closer" to the targeted user.
Proxies are also useful for enforcing policy (for example, making sure a user is allowed to make a
call). A proxy interprets, and, if necessary, rewrites specific parts of a request message before
forwarding it.
A registrar is a server that accepts REGISTER requests and places the information it receives in
those requests into the location service for the domain it handles.
A redirect server is a user agent server that generates 3xx responses to requests it receives,
directing the client to contact an alternate set of URIs.The redirect server allows SIP Proxy Servers
to direct SIP session invitations to external domains.
SIP Signaling
SIP Dialog and Transactions

A dialog is a complete
exchange of SIP messages
between two user-agents.
A transaction is a SIP
message exchange between
two user-agents that starts
with a request and ends with
its final response. It is a part
of a dialog.
SIP to SS7 Mapping
SIP Requests
Method
Description
I NVI TE
A session is being requested to be setup using a specified media
ACK
Message from client to indicate that a successful response to an I NVI TE has been received
OPTI ONS A Query to a server about its capabilities

BYE
A call is being released by either party
CANCEL
Cancels any pending requests. Usually sent to a Proxy Server to cancel searches
REGI STER Used by client to register a particular address with the SI P server
SIP Message
Invite
INVITE sip:5620@172.22.5.10:5060 SIP/2.0
Via: SIP/2.0/UDP 172.22.12.3:5060;branch=z9hG4bK155691746
Remote-Party-ID: "JEFFERSON MARTI" <sip:8432762180@172.22.12.3>;party=calling;screen=yes;privacy=off
From: "JEFFERSON MARTI" <sip:8432762180@172.22.12.3>;tag=B064C8D4-DF3
To: <sip:5620@172.22.5.10>
Date: Wed, 28 Jul 2010 15:38:36 GMT
Call-ID: 54322D8-999511DF-99D69AFE-2081E384@172.22.12.3
Supported: timer,resource-priority,replaces,sdp-anat
Min-SE: 1800
Cisco-Guid: 81646792-2576683487-2605776921-107194714
User-Agent: Cisco-SIPGateway/IOS-12.x
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY, INFO,
REGISTER
CSeq: 101 INVITE
Max-Forwards: 70
Timestamp: 1280331516
Contact: <sip:8432762180@172.22.12.3:5060>
Call-Info: <sip:172.22.12.3:5060>;method="NOTIFY;Event=telephone-event;Duration=2000"
Expires: 180
Allow-Events: telephone-event
Content-Type: multipart/mixed;boundary=uniqueBoundary
Mime-Version: 1.0
Content-Length: 1112
SIP Message
Trying 100
SIP/2.0 100 Trying
Date: Wed, 28 Jul 2010 15:38:36 GMT
Allow-Events: presence
Content-Length: 0
To: <sip:5620@172.22.5.10>
Call-ID: 54322D8-999511DF-99D69AFE-2081E384@172.22.12.3
CSeq: 101 INVITE
SIP Message
Ringing 180
SIP/2.0 180 Ringing
Date: Wed, 28 Jul 2010 15:38:36 GMT
Allow: INVITE, OPTIONS, INFO, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE,
NOTIFY
Allow-Events: presence
P-Asserted-Identity: "Marty Jefferson" <sip:5620@172.22.5.10>
Supported: X-cisco-srtp-fallback
Supported: Geolocation
Remote-Party-ID: "Marty Jefferson" <sip:5620@172.22.5.10>;party=called;screen=yes;privacy=off
Content-Length: 0
To: <sip:5620@172.22.5.10>;tag=011176a9-9c00-4b03-b253-35ace3ee8112-19702291
Contact: <sip:5620@172.22.5.10:5060>
Call-ID: 54322D8-999511DF-99D69AFE-2081E384@172.22.12.3
CSeq: 101 INVITE
SIP Message
OK 200
SIP/2.0 200 OK
Via: SIP/2.0/UDP 172.22.5.10:5060;branch=z9hG4bK590fd0304b15ff
From: "Marty Jefferson" <sip:7049435620@172.22.5.10>;tag=011176a9-9c00-4b03-b25335ace3ee8112-19702287
To: <sip:918432762180@172.22.12.3>;tag=B05DBE70-718
Date: Wed, 28 Jul 2010 15:30:52 GMT
Call-ID: 19c7a380-c5014d2c-58464b-a0516ac@172.22.5.10
CSeq: 101 INVITE
Allow: INVITE, OPTIONS, BYE, CANCEL, ACK, PRACK, UPDATE, REFER, SUBSCRIBE, NOTIFY,
INFO, REGISTER
Allow-Events: telephone-event
Remote-Party-ID: <sip:918432762180@172.22.12.3>;party=called;screen=no;privacy=off
Contact: <sip:918432762180@172.22.12.3:5060>
Supported: replaces
Supported: sdp-anat
Server: Cisco-SIPGateway/IOS-12.x
Session-Expires: 1800;refresher=uac
Require: timer
Mime-Version: 1.0
Content-Length: 670
SIP Message
ACK
ACK sip:918432762180@172.22.12.3:5060 SIP/2.0
Date: Wed, 28 Jul 2010 15:38:37 GMT
From: "Marty Jefferson" <sip:7049435620@172.22.5.10>;tag=011176a9-9c00-4b03-b25335ace3ee8112-19702292
Allow-Events: presence, kpml
Content-Length: 0
To: <sip:918432762180@172.22.12.3>;tag=B064D884-10C
Call-ID: 2ef10200-c5014efd-584897-a0516ac@172.22.5.10
Via: SIP/2.0/UDP 172.22.5.10:5060;branch=z9hG4bK59121e2736c5b4
CSeq: 101 ACK
Max-Forwards: 70
SIP Message
BYE
BYE sip:5620@172.22.5.10:5060 SIP/2.0
Via: SIP/2.0/UDP 172.22.12.3:5060;branch=z9hG4bK1556CB3C
To: <sip:5620@172.22.5.10>;tag=011176a9-9c00-4b03-b253-35ace3ee8112-19702291
Date: Wed, 28 Jul 2010 15:38:36 GMT
Call-ID: 54322D8-999511DF-99D69AFE-2081E384@172.22.12.3
User-Agent: Cisco-SIPGateway/IOS-12.x
Max-Forwards: 70
Timestamp: 1280331524
CSeq: 103 BYE
Reason: Q.850;cause=16
Mime-Version: 1.0
Content-Length: 281
SIP Responses
Description
Examples
1xx
Informational Request received, continuing to

process request.
180 Ringing
181 Call is Being Forwarded
2xx
Success Action was successfully received,

understood and accepted.
200 OK
3xx
Redirection Further action needs to be taken in

order to complete the request.
300 Multiple Choices

302 Moved Temporarily
4xx
Client Error Request contains bad syntax or cannot

be fulfilled at this server.
401 Unauthorized
408 Request Timeout
5xx
Server Error Server failed to fulfill an apparently

valid request.
503 Service Unavailable

505 Version Not Suported
6xx
Global Failure Request is invalid at any server.
600 Busy Everywhere

603 Decline
SIP Responses
Q850 Reason Codes
Q850 Reason Codes
SIP Headers
Via contains the address at which the originator is expecting to receive responses to this request.
Mandatory
To contains a display name and a SIP URI towards which the request was originally directed. Mandatory
Display names are described in RFC 2822
From also contains a display name and a SIP URI that indicate the originator of the request. The From also
contains a tag parameter which is used for identification purposes. Mandatory
Call-ID contains a globally unique identifier for this call. Mandatory
CSeq or Command Sequence contains an integer and a method name. The CSeq number is incremented
for each new request within a dialog and is a traditional sequence number. Mandatory
Contact contains a SIP URI that represents a direct route to the originator usually composed of a username
at a fully qualified domain name (FQDN). While an FQDN is preferred, many end systems do not have
registered domain names, so IP addresses are permitted. The Contact header field tells other elements
where to send future requests.
Max-Forwards serves to limit the number of hops a request can make on the way to its destination. It
consists of an integer that is decremented by one at each hop.
Content-Type contains a description of the message body. Mandatory
Content-Length contains an octet (byte) count of the message body.
Basic SIP Invite

INVITE sip:01150259917040@67.135.76.4 SIP/2.0
Via: SIP/2.0/UDP 69.7.163.154:5060;branch=z9hG4bK400fc6e6
From: "8069664170" <sip:8069664170@69.7.163.154>;tag=as42e2ecf6
To: <sip:01150259917040@67.135.76.4>
Contact: sip:8069664170@69.7.163.154
Min-SE: 90
Session Expires: 300
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
User-Agent: MatrixSwitch
Date: Thu, 22 Dec 2005 18:38:28 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER
Content-Type: application/sdp
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:18 G729/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=fmtp:18 annexb=no - - - -
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
Called Number
(User-URI)
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Destination IP
(Host-URI)
Request URI (Value of To Address in

SBC Local-Policy) should match on its
parameter (Either Host or User-URI)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
Signaling Port
Number of the
Source IP Address
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Source IP Address
Via Header (Mandatory). Via

Header is used for translation
rules and Session Agent
matches.
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
From Address
This is used to make a
match in SBC LocalPolicy.
Maps to the ISUP

v=0
Generic Name
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Maps to the ISUP

Calling Party Number
From Header (Mandatory)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
Destination Number
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Destination IP Signaling
Address
To Header (Mandatory)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
Contact Address
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
This is used to send

the reply back to the
sender.
Contact Header
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Call-ID Header
This is a Mandatory
Header
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Command Sequence
Header (Mandatory)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154`
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
User-Agent Header
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Allow Header
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Content-Type Header
(Mandatory)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Content-Length Header
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: sip:8069664170@69.7.163.154
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Min-SE Header (Establish the

lower limit of Session refresh
interval) (RFC 4028)
SIP Headers
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: sip:8069664170@69.7.163.154
Min-SE: 90
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
SE Header (Establish the

upper limit of Session refresh
interval) (RFC 4028)
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Note: SE value of UAC should

be greater or equal to Min-SE
value of UAS. Once the Min-SE
of UAS is greater than the SE
value of UAC, UAS will provide
SIP error 422 (Session Interval
too small)
SDP Parameters
Session description
v= (protocol version) Mandatory
o= (owner/creator and session identifier). Mandatory
s= (session name) Mandatory
t= (time the session is active) Mandatory
i=* (session information)
u=* (URI of description)
e=* (email address)
p=* (phone number)
c=* (connection information - not required if included in all media)
b=* (bandwidth information)
z=* (time zone adjustments)
k=* (encryption key)
a=* (zero or more session attribute lines)
r=* (zero or more repeat times)Media description
m= (media name and transport address) Mandatory
i=* (media title)
c=* (connection information - optional if included at session-level)
b=* (bandwidth information)
a=* (zero or more media attribute lines)
SDP Parameters (RFC 4566)

INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
This is the SDP

information within
the Invite
SDP Parameters
INVITE sip:01150259917040@67.135.76.4 SIP/2.0
To: <sip:01150259917040@67.135.76.4>
Contact: <sip:8069664170@69.7.163.154>
Call-ID: 2485823e63b290b47c042f20764d990a@69.7.163.154
CSeq: 102 INVITE
Date: Thu, 22 Dec 2005 18:38:28 GMT
Protocol
Content-Length: 268
v=0
o=root 14040 14040 IN IP4 69.7.163.154
s=session
c=IN IP4 69.7.163.154
t=0 0
m=audio 26784 RTP/AVP 0 8 18 101
a=rtpmap:18 G729/8000
a=fmtp:101 0-16
Version Mandatory
Owner Mandatory
IP address for RTP
Session Name Mandatory
Time the session is active

Mandatory
RTP Media Packets (CODEC)

Type
Bit-rate
kbps
Coding
Delay
Quality
(MOS)
G.711
PCM
G.726
64
<1ms
4.2
Good
ADPCM
32
<1ms
4.0
Good
G.728
CELP
16
2 ms
4.0
Good
GSM
RPE-LTP
13.2
2ms
3.7
Fair-Good
G.729
CELP
5ms
4.0
Good
G.723.1
CELP
6.4
7.5
3.8
Fair-Good
I
P
U
D
P
R
T
P
G.729 Data Packet
8 kbps data 26.4 kbps with headers
Quality
(Wireshark)
Capturing VoIP (SIP) Calls
Thank You

SIP and Wireshark

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SIP and Wireshark

Uploaded by

Copyright:

Available Formats

(SIP)

Session Initiation Protocol

Session Initiation Protocol (SIP)

SIP Dialog and Transactions

SIP to SS7 Mapping

A session is being requested to be setup using a specified media

OPTI ONS A Query to a server about its capabilities

A call is being released by either party

Informational Request received, continuing to

Success Action was successfully received,

Redirection Further action needs to be taken in

300 Multiple Choices

Client Error Request contains bad syntax or cannot

Server Error Server failed to fulfill an apparently

503 Service Unavailable

Global Failure Request is invalid at any server.

600 Busy Everywhere

Q850 Reason Codes

Q850 Reason Codes

Basic SIP Invite

Request URI (Value of To Address in

Via Header (Mandatory). Via

Maps to the ISUP

Maps to the ISUP

From Header (Mandatory)

This is used to send

Min-SE Header (Establish the

SE Header (Establish the

Note: SE value of UAC should

SDP Parameters (RFC 4566)

This is the SDP

Session Name Mandatory

Time the session is active

RTP Media Packets (CODEC)

G.729 Data Packet

8 kbps data 26.4 kbps with headers

You might also like