SIP trace capture and ladder analysis

See also

Sources

1. 1
   The ACK sent for a 2xx response to an INVITE is a separate SIP transaction, not part of the INVITE transaction.

   RFC 3261 — SIP: Session Initiation Protocol · Section 6 Definitions, entry 'Transaction' · Checked 2026-09-23
2. 2
   When an INVITE receives a non-2xx final response, the ACK to that response is part of the same INVITE transaction.

   RFC 3261 — SIP: Session Initiation Protocol · Section 6 Definitions, entry 'Transaction' · Checked 2026-09-23
3. 3
   The Cisco Collaboration Solutions Analyzer Log Analyzer turns CUBE debug ccsip messages output into a ladder diagram, and the input must be a text file containing only the SIP debug output with no other command output.

   Troubleshoot CUBE via Collaboration Solutions Analyzer · Technote 222316, requirements and log analysis sections · Checked 2026-09-23
4. 4
   The CSA Log Analyzer also accepts pcap and pcapng packet captures and reports RTP stream statistics such as packet loss.

   Troubleshoot CUBE via Collaboration Solutions Analyzer · Technote 222316, packet capture analysis section · Checked 2026-09-23
5. 5
   The CSA CUBE log analysis supports SIP-to-SIP calls only; other voice protocols are not supported.

   Troubleshoot CUBE via Collaboration Solutions Analyzer · Technote 222316, requirements · Checked 2026-09-23
6. 6
   The CSeq header carries an integer and a method name, and the CSeq number is incremented for each new request within a dialog.

   RFC 3261 — SIP: Session Initiation Protocol · Section 8.1.1.5 CSeq · Checked 2026-09-23
7. 7
   Cisco lists debug ccsip messages, debug ccsip error and debug ccsip non-call as the basic SIP debugs to collect on CUBE, with debug ccsip all, debug ccsip verbose and debug voip ccapi inout as advanced debugs.

   Configure Debug Collection for CUBE and TDM Gateways · Technote 215208, SIP debugs section · Checked 2026-09-23
8. 8
   Cisco advises stopping debugs immediately and engaging TAC if router CPU goes above 80 percent during CUBE debug collection.

   Configure Debug Collection for CUBE and TDM Gateways · Technote 215208, CPU caution · Checked 2026-09-23
9. 9
   Cisco's baseline for CUBE debug collection sets millisecond debug timestamps, service sequence-numbers, a 10 MB logging buffer (logging buffered 10000000) and disables console and monitor logging.

   Configure Debug Collection for CUBE and TDM Gateways · Technote 215208, logging buffer configuration · Checked 2026-09-23
10. 10
    VoIP Trace on Cisco CUBE, introduced in IOS XE Amsterdam 17.3.2, logs SIP signalling and events without enabling debugs, and is on by default (it can be turned off with shutdown).

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: VoIP Trace · VoIP Trace: Overview; Feature Information · Checked 2026-09-23
11. 11
    CUBE VoIP Trace uses by default 10 percent of platform memory (configurable from 10 MB to 1000 MB) and overwrites older traces when the limit is reached.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: VoIP Trace · VoIP Trace: memory limit / configuration section · Checked 2026-09-23
12. 12
    CUBE VoIP Trace captures SIP messages for SIP trunk-to-SIP trunk calls.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: VoIP Trace · VoIP Trace: Overview / Restrictions · Checked 2026-09-23
13. 13
    CUBE VoIP Trace data is viewed with show voip trace, keyed by call-id, session-id, sip-call-id or correlator, among other options.

    Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards: VoIP Trace · VoIP Trace: show voip trace command syntax · Checked 2026-09-23
14. 14
    In SIP a dialog is identified by the combination of a call identifier (Call-ID), a local tag and a remote tag.

    RFC 3261 — SIP: Session Initiation Protocol · Section 6 Definitions, entry 'Dialog' · Checked 2026-09-23
15. 15
    The HEP repository lists Kamailio, OpenSIPS, FreeSWITCH, Asterisk and RTPEngine as native HEP implementations and Captagent, Heplify and Sipgrep as capture agents.

    sipcapture/HEP: Extensible Encapsulation Protocol (EEP/HEP) · README, implementations list · Checked 2026-09-23
16. 16
    HEP/EEP copies an IP datagram to a remote collector by wrapping the original packet and its header properties as chunks inside a new datagram sent over UDP, TCP or SCTP.

    sipcapture/HEP: Extensible Encapsulation Protocol (EEP/HEP) · README, introduction · Checked 2026-09-23
17. 17
    The HOMER repository is licensed under AGPL-3.0.

    sipcapture/homer: HOMER - 100% Opensource Telecom Observability · Repository license badge / LICENSE · Checked 2026-09-23
18. 18
    HOMER 11.x receives HEP over UDP, TCP, TLS or HTTP and states it is backwards compatible with all HEPv3 agents.

    sipcapture/homer: HOMER - 100% Opensource Telecom Observability · README, architecture / Ingest module · Checked 2026-09-23
19. 19
    A ladder tool that groups messages by Call-ID alone can merge separate dialogs that share a Call-ID; it should also key on the From and To tags to separate dialogs correctly.inferred

    RFC 3261 — SIP: Session Initiation Protocol · Section 6 Definitions, entry 'Dialog' (basis for the inference) · Checked 2026-09-23
20. 20
    A passive capture of SIP over TLS negotiated with ECDHE or TLS 1.3 cannot be decoded with the server's RSA key alone; it needs a TLS key log from an endpoint or a trace taken inside the SBC after decryption.inferred

    TLS - Wireshark Wiki · TLS wiki, key log file and RSA keys sections (basis for the inference) · Checked 2026-09-23
21. 21
    Cloud-side ladder views such as the Teams SIP call flow cover only one hop, so an end-to-end ladder for a PSTN call still needs an SBC-side or carrier-side trace joined to it.inferred

    SIP call flow for Direct Routing in Microsoft Teams · Understanding the SIP call flow view (basis for the inference) · Checked 2026-09-23
22. 22
    SIP responses fall into six classes: 1xx provisional, 2xx success, 3xx redirection, 4xx client error, 5xx server error and 6xx global failure.

    RFC 3261 — SIP: Session Initiation Protocol · Section 7.2 Responses · Checked 2026-09-23
23. 23
    RFC 3665 includes reference flows for a session through a SIP ALG (Section 3.5) and a session with a re-INVITE caused by an IP address change (Section 3.7).

    RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Sections 3.5 and 3.7 · Checked 2026-09-23
24. 24
    RFC 3665, 'Session Initiation Protocol (SIP) Basic Call Flow Examples', was published in December 2003 as BCP 75.

    RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Document header · Checked 2026-09-23
25. 25
    RFC 3665 labels the messages in each call flow diagram F1, F2 and so on, and gives the full text of each numbered message after the diagram.

    RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Sections 2 and 3, diagram and message-detail convention · Checked 2026-09-23
26. 26
    RFC 3665 Sections 3.8 to 3.11 give reference flows for unsuccessful sessions: no answer, busy, no response from the user agent, and temporarily unavailable.

    RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Sections 3.8, 3.9, 3.10, 3.11 · Checked 2026-09-23
27. 27
    Section 2 of RFC 3665 gives registration call flows, including a new registration, contact list update and query, cancellation, and an unsuccessful registration (Section 2.5).

    RFC 3665: Session Initiation Protocol (SIP) Basic Call Flow Examples · Sections 2.1 to 2.5 · Checked 2026-09-23
28. 28
    sngrep can send captured packets to a HEP/Homer collector (-H, --eep-send) and can listen for HEP-encapsulated packets (-L, --eep-listen).

    sngrep Wiki: Home · Wiki Home, command-line options -H and -L · Checked 2026-09-23
29. 29
    sngrep can write captured packets to a PCAP file using the -O (--output) option.

    sngrep Wiki: Home · Wiki Home, command-line options list · Checked 2026-09-23
30. 30
    sngrep is a terminal tool that displays SIP call message flows, either from live packet capture or from a PCAP file.

    irontec/sngrep: Ncurses SIP Messages flow viewer · README, opening description and feature list · Checked 2026-09-23
31. 31
    The sngrep wiki states that its TLS decryption supports only a few RSA key-exchange cipher suites (TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384), needs the initial handshake, and cannot decrypt DH or ECDH sessions.

    sngrep Wiki: Home · Wiki Home, TLS decryption note and -k/--keyfile option · Checked 2026-09-23
32. 32
    If a Direct Routing Microsoft response code starts with 560, the final SIP response was generated by the SBC and the last three digits are that SIP code (for example 560403 means the SBC sent 403); any other prefix means a Microsoft service generated it.

    Microsoft and SIP response codes · Direct Routing error codes · Checked 2026-09-23
33. 33
    For Direct Routing failures Microsoft reports a SIP response code (CallEndReason) and a Microsoft response code (CallEndSubReason) that is usually six digits but can be shorter or longer.

    Microsoft and SIP response codes · Introduction, bulleted definitions · Checked 2026-09-23
34. 34
    Microsoft's Direct Routing diagnosis and response-code guidance applies to Direct Routing PSTN calls and does not apply to Calling Plan or Operator Connect deployments.

    Microsoft and SIP response codes · Opening Note · Checked 2026-09-23
35. 35
    SIP call flow data for a Direct Routing call can take up to 30 minutes to be processed and appear in the Teams admin center.

    SIP call flow for Direct Routing in Microsoft Teams · Access SIP call flow, Note · Checked 2026-09-23
36. 36
    In the Teams admin center the Direct Routing SIP call flow is reached from Analytics & reports > Usage reports > PSTN usage report > Direct Routing tab, by selecting a call and then SIP call flow or its Final SIP code value.

    SIP call flow for Direct Routing in Microsoft Teams · Access SIP call flow, steps 1-8 · Checked 2026-09-23
37. 37
    Direct Routing call records older than 30 days are not available in the SIP call flow view.

    SIP call flow for Direct Routing in Microsoft Teams · Access SIP call flow, Note · Checked 2026-09-23
38. 38
    Viewing the Direct Routing SIP call flow requires the Teams Administrator or Teams Telephony Administrator role.

    SIP call flow for Direct Routing in Microsoft Teams · Prerequisites · Checked 2026-09-23
39. 39
    The Teams SIP call flow ladder shows only the SIP messages exchanged between the customer's SBC and the Microsoft SIP Proxy, in chronological order with arrow direction showing sender and receiver.

    SIP call flow for Direct Routing in Microsoft Teams · Understanding the SIP call flow view · Checked 2026-09-23
40. 40
    The Teams admin center SIP call flow feature shows the SIP requests, responses and related SDP exchanged between the Microsoft Teams proxy and the SBC for a selected call.

    Diagnose issues that affect Direct Routing · More information · Checked 2026-09-23
41. 41
    Teams Direct Routing SBC test suites can run Outbound-Inbound, Simultaneous ring, Media escalation and Consultative transfer tests against a chosen SBC using a test user's credentials.

    Diagnose issues that affect Direct Routing · Create a test suite, steps 1-8 · Checked 2026-09-23
42. 42
    Each SIP proxy uses the Via header field to decide where to send a response and removes its own address from the top Via before forwarding it.

    RFC 3261 — SIP: Session Initiation Protocol · Section 4 Overview of Operation · Checked 2026-09-23
43. 43
    The Wireshark VoIP Calls table can be copied to the clipboard as CSV or YAML.

    Wireshark User's Guide: VoIP Calls Window · VoIP Calls Window, control list: Copy · Checked 2026-09-23
44. 44
    The Wireshark Flow Graph window can export the diagram as PDF, PNG, BMP, JPEG or ASCII.

    Wireshark User's Guide: The Flow Graph Window · The Flow Graph Window, Export control · Checked 2026-09-23
45. 45
    In the Wireshark Flow Graph each vertical line represents a host, packet times are shown on the left and port numbers at the arrow ends.

    Wireshark User's Guide: The Flow Graph Window · The Flow Graph Window, description paragraph · Checked 2026-09-23
46. 46
    In the Wireshark VoIP Calls window the Flow Sequence control opens a ladder diagram of the message sequence for the selected calls.

    Wireshark User's Guide: VoIP Calls Window · VoIP Calls Window, control list: Flow Sequence · Checked 2026-09-23
47. 47
    The Play Streams control in the Wireshark VoIP Calls window opens the RTP Player for the selected calls' streams.

    Wireshark User's Guide: VoIP Calls Window · VoIP Calls Window, control list: Play Streams · Checked 2026-09-23
48. 48
    The Wireshark VoIP Calls window can generate a display filter expression that matches the selected calls (Prepare Filter) and can limit its list to calls that match the current display filter.

    Wireshark User's Guide: VoIP Calls Window · VoIP Calls Window, controls: Limit to display filter; Prepare Filter · Checked 2026-09-23
49. 49
    The Wireshark user guide states the SIP Flows window has the same features as the VoIP Calls window.

    Wireshark User's Guide: SIP Flows Window · SIP Flows Window, body text · Checked 2026-09-23
50. 50
    The Wireshark SIP Flows window lists all captured SIP transactions, including registrations, messages and calls, and it includes transactions that are still in progress as well as completed ones.

    Wireshark User's Guide: SIP Flows Window · SIP Flows Window, body text · Checked 2026-09-23
51. 51
    Wireshark can decrypt TLS using a key log file (preference tls.keylog_file), and this method works even when a Diffie-Hellman key exchange is used.

    TLS - Wireshark Wiki · TLS wiki, section on key log file / TLS Decryption · Checked 2026-09-23
52. 52
    Wireshark's RSA private key decryption cannot be used with (EC)DHE cipher suites or with TLS 1.3, and needs the server certificate's private key and a full handshake containing ClientKeyExchange (no resumed sessions).

    TLS - Wireshark Wiki · TLS wiki, RSA keys section · Checked 2026-09-23
53. 53
    The Wireshark VoIP Calls window detects calls signalled with H.323, IAX2, ISUP, MGCP/MEGACO, SIP, SKINNY and UNISTIM and shows the associated RTP streams.

    Wireshark User's Guide: VoIP Calls Window · VoIP Calls Window, introductory paragraph · Checked 2026-09-23
54. 54
    In Webex Calling troubleshooting a Correlation ID ties together the call legs of the same call session, and calls can be searched by email, phone number, MAC address, call ID or correlation ID.

    Troubleshoot Webex Calling calls in Control Hub · Troubleshoot Webex Calling calls, call details and search sections · Checked 2026-09-23
55. 55
    Webex Calling call troubleshooting is under Control Hub Monitoring > Troubleshooting and needs the full admin, read-only admin or support admin role.

    Troubleshoot Webex Calling calls in Control Hub · Troubleshoot Webex Calling calls, access steps · Checked 2026-09-23
56. 56
    Control Hub call troubleshooting shows Webex Calling calls for the past 21 days, and a call appears only after it ends.

    Troubleshoot Webex Calling calls in Control Hub · Troubleshoot Webex Calling calls, overview and search sections · Checked 2026-09-23

Documents

Cite this page

WarmTransfer. (2026, September 23). SIP trace capture and ladder analysis. WarmTransfer. https://warmtransfer.net/knowledge/sip-trace-analysis

@misc{warmtransfer-sip-trace-analysis,
  title  = {SIP trace capture and ladder analysis},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sip-trace-analysis},
  note   = {Verified 2026-09-23}
}