The “interesting” traffic that exists in this capture is a telephone call made from extension 3XX to extension 4XX. The capture was performed on the computer running the X-lite software. pcap file that we will be using for this example has the following characteristics: Sample Wireshark SIP Analysis Capture Characteristics The extension numbers have been similarly obscured. The 192.168.1.61 address has not been obscured since this is a private IP address and cannot be reached from the Internet. Because this capture is from a real VoIP production network, for obvious reasons, the first three octets of the IP addresses have been obscured in the screenshots, and therefore, will be referred to as X.Y.Z.23 and X.Y.Z.183 respectively in the text.

Note that the addresses you see are taken from the Wireshark capture that is used in this article. The following diagram depicts the scenario. Details of the intervening network infrastructure are not included here, such as the NAT router behind which the X-lite client is operating as these are irrelevant to the exercise.

There is a second phone that also registers on the same SIP server which has an extension of 4XX and an IP address of X.Y.Z.183. This device registers with a SIP server somewhere on the Internet with an IP address of X.Y.Z.23. The scenario for Wireshark SIP analysis that will be examined is one where there is an X -lite SIP client, now known as Bria Solo Free, configured on a computer with an extension of 3XX and an IP address of 192.168.1.61.