Ethereal trace of SIP protocol

[limtohsoon]

Hi Sir,

I'm analyzing an Ethereal trace of SIP protocol (TCP port 5060). Please find attached the trace file.

I understand that frame #3 is the last segment in the TCP 3-way handshake. However, why does the source host start to send data in this frame? Is this normal for SIP?

The problem now is end-user report their application does not work.

Please advise.

Thank you.

B.Rgds,

Lim TS

[didyap]

SIP specification uses a hybrid TCP-UDP transport. All the messages exchanged on a specific SIP transaction must use the same transport but an implementation is free to use different transports for each transaction between two SIP elements. The SIP specification only mandates to use the TCP transport or another congestion controlled transport protocol if the size of the message to send is bigger than the MTU.

The problem with Outbound is that there is only one flow created,either over an UDP or a congestion controlled transport and so the SIP elements no longer have the possibility to choose the best transport for each transaction.

For the further details for SIP follow the URL :

http://www.cisco.com/en/US/docs/ios/12_3/sip/configuration/guide/chapter0.html#wp1123201