Connection Information - Provides the media IP of the originating side.Owner/Creator, Session Id (o) - Creator of this session.Message BodyĮxpand Session Description Protocol You will see the following details: The key points to note are: TIP: When you use * 67to block your caller ID, this field is still kept intact. Remote-Party-ID - Source number information generated by the Originating party. It is unique to this call only.Ĭontact - Tells the destination side where to send the next response. To - The destination number and the IP the call is being sent to.Ĭall ID - This is the ID generated for this call.

Let's go over the key aspect of the Invite packet: Session Initiation Protocol (INVITE)Įxpand Session Initiation Protocol (INVITE)Įxpand Message Header Here we are able to see the following details: The key points to note here are:įrom - Indicates the source number and the source IP. Reading the Invite Packet Selecting the Invite packet you will see the lower window list the following attributes:Įach section can be expanded to provide more information. Each packet can be selected which will yield different details. These will rearrange the packets accordingly. Reading a Basic SIP Captureīelow is what you would normally see in a SIP capture: Highlighted red are the various columns that are clickable. With Call Flow, you can also select the packet which will select the packet in the main Wireshark interface: Let's go into what these packets offer in greater detail. Select a call Flow Sequence Below is an example of a basic call flow: If we were reviewing this capture to see where a BYE came from we can see the BYE came from IP 216.221.154.158. This can be a helpful view as it shows the call flow between servers as well as which IP is providing what response. In this article, we will attempt to cover the basics of reading a Wireshark packet capture.

Reading wireshark capture packets