
Via: The Via: headers are used to record the route of the request.The To: fields in responses are copied from the related request message. To: This field contains the address of the called party.The actual caller (phone number 15) might be located elsewhere but the proxy will not show the actual IP address in message headers. Note that in our example, 10.10.1.99 is the IP address of the Asterisk PBX which plays the role of a SIP proxy. In SIP responses, From: is always a copy of the From: field in the related request message. From: is a mandatory field in all SIP requests and responses. From: This field ('From: "Test 15" tag=as58f4201b' in our example message) contains the address of the caller with an optional display name and with optional tags.The CSeq: identifier is composed of a sequence number (incremented for each new request) and the name of the particular request. As mentioned in the previous section, the same CSeq: is always shared by a request and its related response or responses. CSeq: This is an ID that identifies the particular SIP transaction.It usually consists of a random string and the IP address of the sender. Call-ID: This is a unique identifier of the given SIP session.It also gives the SIP address of the receiving endpoint and identifies the version of the protocol (SIP/2.0).

The request start line: The string "INVITE SIP/2.0" tells that this is an invitation to a call. Let's describe the most important message headers in the example above. Message Headers and Call Flows are the quickest way to determine VoIP faults WinPcap ( Windows and bundled with Wireshark - see below ).Two programs are useful for this purpose but bear in mind that TLS and SRTP traffic will require decrypting and for obvious reasons we do not share encryption keys. Performing and Analysing SIP Packet Captures
