Filter the capture with sip, rtp, and sip.Method, and confirm sip.CSeq.method in the SIP display-filter reference.
The display filters you may type from this lesson are sip, rtp, and sip.Method. A common way to see INVITE requests is sip.CSeq.method == "INVITE". Confirm that field in the Wireshark SIP display-filter reference before you trust it in a ticket. The reference for SIP fields is the page this lesson cites as ws-sip. RTP display fields have their own page, ws-rtp.
sip.Method is the safe method field when you want the request method. This lesson does not invent other field names. If a blog names a filter you have not found on those two reference pages, leave it out of the write-up until you confirm it there.
Select one packet and read the SIP headers in order: Call-ID, CSeq, Via branch, To tag. The filter got you to the packet. The match rules from the ladder lesson decide whether the next packet is the same transaction.
rtp shows the media packets. SIP showing a 200 OK with an m= line does not mean those RTP packets are in the capture. When the call is silent, keep the SIP filter long enough to read the negotiated address and port, then use the rtp display filter to see whether media arrived. Cite the RTP reference for RTP fields and the SIP reference for SIP fields.
Room: Display filters for SIP and RTP
© 2026 CypherMonkeyLabs 🐒