A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / Troubleshooting ladders, captures, and debug / Display filters for SIP and RTP

Display filters for SIP and RTP

Filter the capture with sip, rtp, and sip.Method, and confirm sip.CSeq.method in the SIP display-filter reference.

Learn in 5 minutes

  1. Use the display filters this lesson names
  2. Confirm a CSeq field in the Wireshark reference
  3. Read Call-ID from the packet you selected

Visual

A capture of one answered call · study drawing · cyphermonkeylabs.com AliceSBCBob INVITE 100 INVITE 180 180 200 200 ACK

SVG HTML PNG

Display filters narrow what you see. They are not a second copy of the SIP RFC.

Worked example

Extract the INVITE from a text capture This is a synthetic text capture, not a customer packet. Extract the SIP message. On a real file you would display-filter with sip, and you would confirm sip.CSeq.method == "INVITE" in the Wireshark SIP display-filter reference.

  1. Extract SIP.
  2. Read Call-ID and CSeq on the INVITE.
  3. Note that 100 Trying is a separate message.

Fault

The ticket says the capture proves a missing ACK because the display filter sip.InventedAckFlag == 1 returned nothing.

Only sip, rtp, sip.Method, and a confirmed sip.CSeq.method belong in this lesson's filter list.

Quiz

Which display filter does this lesson treat as safe for all SIP?


The RTP display-filter reference is cited so you can


sip.CSeq.method == "INVITE" should be


sip.Method is


A 200 OK with SDP and no rtp packets means


After the filter selects a packet, you still match


Ecosystem

Glossary, sister systems, and the integration seam for this room.

E911 / emergency calling Location has to ride with the call. RFC 6881 is the BCP, RFC 6442 carries location in SIP, and the FCC MLTS page states Kari’s Law and RAY BAUM’s Act obligations for multi-line systems.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper