You didn’t specify what the PCAP was of but Cisco IP Phones registered CUCM/CME with SIP firmware behave this way by default. The first dialed digit is sent in the Request URI of the INVITE since it can’t be empty. CUCM initiates a KPML subscription immediately after the 100 TRYING response to collect subsequent digits, allowing it to perform digit-by-digit analysis of the dialing forest.
It’s possible to change this behavior with SIP Dial Rules on CUCM so the phone can recognize acceptable patterns locally and send an INVITE only when the string is complete, e.g. 2XXX. This is rare outside of very large environments where the KPML subscriptions represent a real load on the cluster (there is a sizing tool accessible to Cisco and partners). Because of how little it’s used, the feature can be a little finicky. I begrudgingly steer clear of it.
