Exercise 1 -SIP

Using the captured SIP packets at the end of this exercise, place the five SIP messages
into a call flow. Remember, SIP responses show the same From and To headers as the
original request!

Msg Phone 1 SIP Server Phone 2

1

How did you figure out the call flow?

Exercise 2 – Identifying SIP URIs
Use the captured SIP messages to identify the IP addresses, telephone numbers,
and SIP Uniform Resource Identifiers (URIs) for the two SIP telephones.

SIP Telephone 1

Telephone
Number
SIP URI

IP Address

SIP Telephone 2

Telephone
Number
Where did you find this information? SIP URI

IP Address
Exercise 3 Interpreting SIP Headers
A. What combination of headers uniquely identifies this SIP call?

B. What Layer 4 protocol and port number were used for the SIP signaling messages? Where did you find
that information?

C. What combination of fields identifies a dialog within this call?

D. What field identifies a transaction within the dialog?

Exercise 4 Interpreting SDP Parameters
The captured SIP packets contain an SDP offer/answer handshake. Interpret the SDP parameters and answer
the following questions.

A. Which message carried the SDP offer? Who sent the message?

B. What voice encoders were listed in the SDP offer? Which vocoder was preferred?

C. Which SIP message carried the SDP answer? What vocoder was selected in the SDP answer?

D. What UDP port numbers were selected for the media flows?
Exercise 5 – Interpreting IP, UDP & RTP Headers
A. What IP addresses are used? Who sent each media packet, Phone 1 or 2? (Hint: refer to the IP
addresses you discovered in the SIP signaling.)

B. What IP quality of service was requested? Hint: check the IP headers.

C. What UDP port numbers are used? Is this consistent with the SDP parameters in Exercise4?

D. What type of “data” is carried in each RTP packet?

Captured SIP Packets
•SIP Packet 1 of 5 SIP Packet 2 of 5
INVITE sip:202-682-0167@voip.net:5060 SIP/2.0 SIP/2.0 100 Trying
Via: SIP/2.0/UDP sip:512-378-1231@itsp.net:5060;branch=z9hG4bK_1102 Via: SIP/2.0/UDP sip:512-378-
From: "Phone 1"<sip:512-378- 1231@itsp.net:5060;branch=z9hG4bK_1102;received=11.22.3.1
1231@itsp.net;user=phone>;tag=1_1102_f4726 From: "Phone 1"<sip:512-378-1231@itsp.net;user=phone>;tag=1_1102_f4726
To: <sip: 202-682-0167@voip.net;user=phone> To: <sip: 202-682-0167@voip.net;user=phone>
Call-ID: 1851017346@itsp.net Call-ID: 1851017346@itsp.net
CSeq: 1 INVITE CSeq: 1 INVITE
Max-Forwards: 70 Contact: <sip:202-682-0167@180.13.2.3:5060>
Contact: <sip:512-378-1231@itsp.net:5060> Content-Length: 0
Allow:
INVITE,ACK,BYE,CANCEL,OPTIONS,REGISTER,INFO,PRACK,SUBSCRIBE,NOTIFY
,REFER,UPDATE
Content-Length: 429
Content-Type: application/sdp
SIP Packet 3 of 5
v=0
SIP/2.0 180 Ringing
o=- IN IP4 11.22.1.76
Via: SIP/2.0/UDP sip:512-378-
s=-
1231@itsp.net:5060;branch=z9hG4bK_1102;received=11.22.3.1
c=IN IP4 11.22.1.76
From: "Phone 1"<sip:512-378-
t=0 0
1231@itsp.net;user=phone>;tag=1_1102_f4726
m=audio 11088 RTP/AVP 0 8 99 101 102
To: <sip:202-682-
a=rtpmap:99 G.729a/8000
0167@voip.net;user=phone>;tag=000ded61654900
a=rtpmap:101 G.729b/8000
Call-ID: 1851017346@itsp.net
a=rtpmap:102 G.726-24/8000
CSeq: 1 INVITE
Contact: <sip:202-682-0167@180.13.2.3:5060>
Content-Length: 0
Captured SIP Packets
SIP Packet 4 of 5
SIP/2.0 200 OK SIP Packet 5 of 5
Via: SIP/2.0/UDP sip:512-378- ACK sip:202-682-0167@180.13.2.3:5060 SIP/2.0
1231@itsp.net:5060;branch=z9hG4bK_11 Via: SIP/2.0/UDP sip:512-378-
02;received=11.22.3.1 1231@itsp.net:5060;branch=z9hG4bK_1266
From: "Phone 1"<sip:512-378- From: "Phone 1"<sip:512-378-
1231@itsp.net;user=phone>;tag=1_1102_ 1231@itsp.net;user=phone>;tag=1_1102_f4726
f4726 To: <sip:202-682-
To: <sip:202-682- 0167@voip.net;user=phone>;tag=000ded61654900
0167@voip.net;user=phone>;tag=000ded Call-ID: 1851017346@itsp.net
61654900 CSeq: 1 ACK
Call-ID: 1851017346@itsp.net Max-Forwards: 70
CSeq: 1 INVITE Content-Length: 0
Contact: <sip:202-682-
0167@180.13.2.3:5060>
Content-Type: application/sdp
Content-Length: 140
v=0
o=- IN IP4 180.13.2.3
s=SIP Call
c=IN IP4 180.13.2.3
t=0 0
m=audio 16384 RTP/AVP 0
a=rtpmap:0 PCMU/8000
Captured RTP Bearer Packets
RTP Bearer Packet 1 of 3
Ethernet:
MAC Addresses: Destination = 00:D0:58:72:DB:80, Source = 00:02:B9:B5:8F:20
Protocol: 0x0800 IP
CRC: (Good)
IP Header:
Version: 4
IP Header Length = 20 Bytes
Type of Service:
011 . . . . . : Precedence = Flash
. . .0 . . . . : Delay = Normal
. . . .0 . . . : Throughput = Normal
. . . . .0 . . : Reliability = Normal
. . . . . .0 . : Cost = Normal
. . . . . . . 0: Reserved
Total IP Datagram length: 200 bytes
ID: 0x22D5
Fragment: Not Fragmented
Time to live: 254
Protocol: 17 (UDP)
Header checksum: 0x7FBE (Good)
IP Addresses: Source = 11.22.1.76 Destination = 180.13.2.3
UDP Header:
Ports: Source= 11088. Destination = 16384
UDP Datagram length: 180 bytes
Checksum: 0x0000
RTP Header:
Version: 2, Padding: 0, Extension: 0, CSRC Count: 0, Marker: 0,
Payload Type: PCMU(G.711) (0), Audio/Video: Audio, Clock Rate (Hz): 8000
Sequence Number: 1400, Timestamp: 1183210951, SSRC: 34537731
RTP Data:
Length = 160 bytes
0000 FC FD 72 79 F7 F8 77 77 7C FE F9 F9 7C 70 7A F1
0010 F5 72 79 7E 7C
Captured RTP Bearer Packets
RTP Bearer Packet 2 of 3
Ethernet:
MAC Addresses; Destination = 00:02:B9:B5:8F:20, Source = 00:D0:58:72:DB:80
Protocol: 0x0800 IP
CRC: (Good)
IP Header:
Version: 4
IP Header Length: 20 Bytes
Type of Service:
011 . . . . . : Precedence = Flash
. . .0 . . . . : Delay = Normal
. . . .0 . . . : Throughput = Normal
. . . . .0 . . : Reliability = Normal
. . . . . .0 . : Cost = Normal
. . . . . . . 0: Reserved
Total IP length: 200 bytes
ID: 0xB658
Fragment: Not Fragmented
Time to live: 252
Protocol: 17 (UDP)
Header checksum: 0xEE3A (Good)
IP Addresses: Source = 180.13.2.3, Destination = 11.22.1.76
UDP Header:
Ports: Source = 16384, Destination = 11088
UDP length: 180 bytes
Checksum: 0x0000
RTP Header:
Version: 2, Padding: 0, Extension: 0, CSRC Count: 0, Marker: 0,
Payload Type: PCMU(G.711) (0), Audio/Video: Audio, Clock Rate (Hz): 8000
Sequence Number: 5991, Timestamp: 3710524699, SSRC: 535953923
RTP Data:
Length = 160 bytes
0000 70 7A 76 7E 7E FE FC F9 F1 FC FA FA FC F8 F7 FA
0010 FA FB F6 F7
Captured RTP Bearer Packets
RTP Bearer Packet 3 of 3
Ethernet:
MAC Addresses: Destination = 00:D0:58:72:DB:80, Source = 00:02:B9:B5:8F:20
Protocol: 0x0800 IP
CRC: (Good)
IP Header:
Version: 4
IP Header Length: 20 Bytes
Type of Service:
011 . . . . . : Precedence = Flash
. . .0 . . . . : Delay = Normal
. . . .0 . . . : Throughput = Normal
. . . . .0 . . : Reliability = Normal
. . . . . .0 . : Cost = Normal
. . . . . . . 0: Reserved
Total IP length: 200 bytes
ID: 0x22D5
Fragment: Not Fragmented
Time to live: 254
Protocol: 17 (UDP)
Header checksum: 0x7FBE (Good)
IP Addresses: Source = 11.22.1.76, Destination = 180.13.2.3
UDP Header:
Ports: Source = 11088, Destination = 16384
UDP length: 180 bytes
Checksum: 0x0000
RTP Header:
Version: 2, Padding: 0, Extension: 0, CSRC Count: 0, Marker: 0,
Payload Type: PCMU(G.711) (0), Audio/Video: Audio, Clock Rate (Hz): 8000
Sequence Number: 1401, Timestamp: 1183211111, SSRC: 34537731
RTP Data:
Length = 160 bytes
0000 FF 7C 7E FD FC 7D 7B 7C FE FD 7B 7A 7C FE FB FE
0010 7C 79 FD F8 7E