cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Identify the Direction of the SIP Message

Abdul Jaseem
Beginner
Beginner

Hi Experts,

How to identify the direction of a SIP message.

Following are some sample traces. 

  • If I look in to the AppInfo line, I can see the direction is Incoming SIP or Outgoing SIP
  • The server header also tells that the direction of the message.

But is there any way to detect the direction from the SIP messages?

Sample 1: Direction of the Message: From Phone B (10.173.247.126) to CUCM (10.173.98.10)

00330786.001 |22:51:19.943 |AppInfo |//SIP/SIPUdp/wait_SdlDataInd: Incoming SIP UDP message size 1370 from 10.173.247.126:[5060]:
[11644,NET]

SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.173.98.10:5060;branch=z9hG4bK2ff7e52f5f2
From: <sip:5006@10.173.98.10>;tag=4943~8d4ebf65-f2dd-4e5a-96d8-9741c8d14440-21384618
To: <sip:5005@10.173.98.10>;tag=a80c0da872a9004c44a164c8-3a21c1c9
Call-ID: d2fc8480-7d318336-22c-a62ad0a@10.173.98.10
Date: Sat, 10 Sep 2016 03:51:18 GMT
CSeq: 101 INVITE
Server: Cisco-CP7841/10.3.1
Contact: <sip:791496d6-58be-a3ec-4b11-c663a3cb7513@10.173.247.126:5060;transport=udp>
Allow: ACK,BYE,CANCEL,INVITE,NOTIFY,OPTIONS,REFER,REGISTER,UPDATE,SUBSCRIBE,INFO
Remote-Party-ID: "5005" <sip:5005@10.173.98.10>;party=called;id-type=subscriber;privacy=off;screen=yes
Supported: replaces,join,sdp-anat,norefersub,resource-priority,extended-refer,X-cisco-callinfo,X-cisco-serviceuri,X-cisco-escapecodes,X-cisco-service-control,X-cisco-srtp-fallback,X-cisco-monrec,X-cisco-config,X-cisco-sis-7.0.0,X-cisco-xsi-8.5.1
Allow-Events: kpml,dialog
Content-Length: 353
Content-Type: application/sdp
Content-Disposition: session;handling=optional

Sample 2: Direction of the Message: From CUCM (10.173.98.10) to Phone B (10.173.247.126)

00331501.001 |22:51:35.063 |AppInfo |//SIP/SIPUdp/wait_SdlSPISignal: Outgoing SIP UDP message to 10.173.247.126:[5060]:
[11687,NET]
SIP/2.0 200 OK
Via: SIP/2.0/UDP 10.173.247.126:5060;branch=z9hG4bK2b421f98
From: <sip:5005@10.173.98.10>;tag=a80c0da872a9004c44a164c8-3a21c1c9
To: <sip:5006@10.173.98.10>;tag=4943~8d4ebf65-f2dd-4e5a-96d8-9741c8d14440-21384618
Date: Sat, 10 Sep 2016 03:51:35 GMT
Call-ID: d2fc8480-7d318336-22c-a62ad0a@10.173.98.10
Server: Cisco-CUCM10.5
CSeq: 101 BYE
Content-Length: 0

Helps are much appreciated...

-Abdul

1 ACCEPTED SOLUTION

Accepted Solutions

Anthony Holloway
Cisco Employee
Cisco Employee

This can be a bit tricky, and I suppose there could be a case where if you're looking at a single SIP message, you cannot determine the context.  You'll typically want the entire Dialog if your troubleshooting a call flow.  In which case, the Via header is the originating gateway (which is copied into the From header), and the request line is the terminating gateway (which is copied into the To header).

Knowing the call flow for a SIP call is important if you're troubleshooting SIP.  For example, what a Dialog is, versus what a Transaction is.  Knowing that a 200 OK is a Response and a BYE is a request.  All of that.

Alternatively, you can also just throw your CUBE or CUCM logs into TranslatorX and have it build the diagram for you.

From your Sample 1, I would notice that the message is a Response message, which means this is the terminating side replying to the originating side.  And the Via/From header tells me who the originator is, and the To header tells me who the receiver is.  Since this is a reply to an INVITE, as indicated by the CSeq header, I visual the flow as:

INVITE >>> (from device in Via header; to device in Request line)

<<< 100 Trying (from device in To header; to device in Via header)

<<< 18X Progress/Ringing (from device in To header; to device in Via header)

<<< 200 OK (from device in To header; to device in Via header)

ACK >>> (from device in Via header; to device in Request line)

From your Sample 2, I would notice that the message is a Response message, speficically a 200 OK in response to a BYE.  So, the message is from the device in the To header, and going to the device in the Via header.  I visualize the flow as:

BYE >>> (from device in Via header; to device in Request line)

<<< 200 OK (from device in To header; to device in Via header)

View solution in original post

1 REPLY 1

Anthony Holloway
Cisco Employee
Cisco Employee

This can be a bit tricky, and I suppose there could be a case where if you're looking at a single SIP message, you cannot determine the context.  You'll typically want the entire Dialog if your troubleshooting a call flow.  In which case, the Via header is the originating gateway (which is copied into the From header), and the request line is the terminating gateway (which is copied into the To header).

Knowing the call flow for a SIP call is important if you're troubleshooting SIP.  For example, what a Dialog is, versus what a Transaction is.  Knowing that a 200 OK is a Response and a BYE is a request.  All of that.

Alternatively, you can also just throw your CUBE or CUCM logs into TranslatorX and have it build the diagram for you.

From your Sample 1, I would notice that the message is a Response message, which means this is the terminating side replying to the originating side.  And the Via/From header tells me who the originator is, and the To header tells me who the receiver is.  Since this is a reply to an INVITE, as indicated by the CSeq header, I visual the flow as:

INVITE >>> (from device in Via header; to device in Request line)

<<< 100 Trying (from device in To header; to device in Via header)

<<< 18X Progress/Ringing (from device in To header; to device in Via header)

<<< 200 OK (from device in To header; to device in Via header)

ACK >>> (from device in Via header; to device in Request line)

From your Sample 2, I would notice that the message is a Response message, speficically a 200 OK in response to a BYE.  So, the message is from the device in the To header, and going to the device in the Via header.  I visualize the flow as:

BYE >>> (from device in Via header; to device in Request line)

<<< 200 OK (from device in To header; to device in Via header)

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: