Choosing UDP or TCP or TLS transport for SIP

See also

Sources

1. 1
   RFC 5923 lets a SIP entity reuse one TLS connection for requests in both directions by adding an alias parameter to its Via header field.

   RFC 5923: Connection Reuse in the Session Initiation Protocol (SIP) · Section 1, Section 5 and Section 8.1 · Checked 2026-10-14
2. 2
   With its default disable_tcp_switch=yes, Asterisk keeps oversized requests on UDP rather than applying the RFC 3261 section 18.1.1 size rule, leaving them exposed to IP fragmentation.inferred

   res_pjsip - Asterisk Documentation · [system] disable_tcp_switch, read against RFC 3261 Section 18.1.1 · Checked 2026-10-14
3. 3
   If no configured Asterisk PJSIP transport matches the required type and address family, sending fails with an Unsupported transport (PJSIP_EUNSUPTRANSPORT) error, for example TCP with no TCP transport defined.

   PJSIP Transport Selection - Asterisk Documentation · Section on failure when no transport matches · Checked 2026-10-14
4. 4
   An Asterisk res_pjsip transport's protocol option accepts udp, tcp, tls, ws, wss and flow, and defaults to udp.

   res_pjsip - Asterisk Documentation · [transport] section, option protocol · Checked 2026-10-14
5. 5
   For Asterisk PJSIP DNS SRV lookups, the URI must name TCP or TLS in its transport parameter (unless it is a sips URI) for those transports' SRV records to be queried.

   PJSIP Transport Selection - Asterisk Documentation · Section on DNS SRV lookups · Checked 2026-10-14
6. 6
   Asterisk res_pjsip tcp_keepalive_enable sends TCP keepalives to detect silently dropped connections such as NAT timeouts, and defaults to no.

   res_pjsip - Asterisk Documentation · [transport] section, option tcp_keepalive_enable · Checked 2026-10-14
7. 7
   Asterisk PJSIP reuses an existing TCP or TLS connection to the same address, port and transport type before opening a new one.

   PJSIP Transport Selection - Asterisk Documentation · Sections on transport selection with and without an explicit endpoint transport · Checked 2026-10-14
8. 8
   Asterisk res_pjsip option disable_tcp_switch, which disables automatic UDP-to-TCP switching for oversized requests per RFC 3261 section 18.1.1, defaults to yes.

   res_pjsip - Asterisk Documentation · [system] section, option disable_tcp_switch · Checked 2026-10-14
9. 9
   Asterisk PJSIP assumes UDP when a URI has no transport parameter, and switches to TLS automatically for a sips URI.

   PJSIP Transport Selection - Asterisk Documentation · Section on URI parsing / transport parameter · Checked 2026-10-14
10. 10
    RFC 3261 makes the Content-Length header field mandatory when SIP runs over a stream-oriented transport such as TCP.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.3 (Framing); also Section 20.14 (Content-Length) · Checked 2026-10-14
11. 11
    RFC 5626 says the CRLF keep-alive interval SHOULD be 120 seconds (95-second lower bound) where battery is not a concern and 840 seconds (672-second lower bound) where it is.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.1 (CRLF Keep-Alive Technique) · Checked 2026-10-14
12. 12
    RFC 5626 CRLF keep-alives MUST only be used with connection-oriented transports such as TCP and TLS.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.1 (CRLF Keep-Alive Technique) · Checked 2026-10-14
13. 13
    RFC 3261 sets the default SIP port to 5060 for UDP, TCP and SCTP and 5061 for TLS.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.1.1 (Sending Requests) · Checked 2026-10-14
14. 14
    Genesys says both ends of a BYOC trunk must be configured for the same transport protocol, otherwise the trunk may not function.

    Choose a trunk transport protocol · Article body, paragraph on matching both ends · Checked 2026-10-14
15. 15
    Genesys Cloud BYOC Cloud trunks of type BYOC Carrier or BYOC PBX can send calls over UDP, TCP or TLS, where TLS runs over TCP.

    Choose a trunk transport protocol · Article body, opening paragraphs · Checked 2026-10-14
16. 16
    Genesys lists 5061 for TLS and 5060 for UDP and TCP as the common firewall ports for BYOC trunk transport.

    Choose a trunk transport protocol · Article body, firewall ports paragraph · Checked 2026-10-14
17. 17
    The Genesys Cloud BYOC trunk transport setting only controls the protocol used to send calls and is not enforced on calls received on the trunk.

    Choose a trunk transport protocol · Article body, paragraph on what the setting controls · Checked 2026-10-14
18. 18
    Genesys advises choosing TCP for BYOC trunks that carry large UUI or custom header data, to prevent call failures when packets exceed the MTU.

    Choose a trunk transport protocol · Article body, TCP paragraph · Checked 2026-10-14
19. 19
    RFC 3261 recommends keeping connections open for an implementation-defined duration that SHOULD at least cover the time needed to bring a transaction to the terminated state.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18 (Transport), introductory paragraphs on connection lifetime · Checked 2026-10-14
20. 20
    Because vendor transport settings often govern only the sending direction (Genesys) or only origination (Twilio), a transport mismatch can break calls in one direction while the other still works.inferred

    Choose a trunk transport protocol · Article body, outbound-only and matching-ends paragraphs; compare Twilio Origination settings > The transport parameter · Checked 2026-10-14
21. 21
    RFC 3261 requires every SIP element to implement both UDP and TCP; other transports are optional.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18 (Transport), introductory paragraphs · Checked 2026-10-14
22. 22
    RFC 3263 defines NAPTR services SIP+D2U, SIP+D2T, SIPS+D2T and SIP+D2S, and says a SIPS+D2U record SHOULD NOT be published because TLS over UDP is not possible.

    RFC 3263: Session Initiation Protocol (SIP): Locating SIP Servers · Section 4.1 (Selecting a Transport Protocol) and Section 9 (IANA Considerations) · Checked 2026-10-14
23. 23
    Under RFC 3263, if no NAPTR and no SRV records are found, the client SHOULD use TCP for a SIPS URI and UDP for a SIP URI.

    RFC 3263: Session Initiation Protocol (SIP): Locating SIP Servers · Section 4.1 (Selecting a Transport Protocol), final paragraphs · Checked 2026-10-14
24. 24
    Under RFC 3263, when the URI has a numeric IP address or an explicit port but no transport parameter, the client SHOULD use UDP for a SIP URI and TCP for a SIPS URI.

    RFC 3263: Session Initiation Protocol (SIP): Locating SIP Servers · Section 4.1 (Selecting a Transport Protocol) · Checked 2026-10-14
25. 25
    RFC 5626 has the proxy forward incoming requests over the UA's existing flow rather than opening a new one to the Contact, because NAT or firewall can block connections toward the UA.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 1 (Introduction) and Section 3.2 · Checked 2026-10-14
26. 26
    Over a reliable transport, RFC 3261 requires the response to be sent on the existing connection to the source of the request if that connection is still open.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.2.2 (Sending Responses) · Checked 2026-10-14
27. 27
    RFC 5923 limits connection reuse to connections whose sender identity the receiver can verify, so plain TCP or SCTP connections are not reused for requests in the reverse direction.

    RFC 5923: Connection Reuse in the Session Initiation Protocol (SIP) · Section 3 and Section 9.3 (Virtual Servers) · Checked 2026-10-14
28. 28
    RFC 3581 rport lets a UDP client behind NAT ask the server to send the response to the source IP address and port the request came from, instead of the Via sent-by port.

    RFC 3581: An Extension to the Session Initiation Protocol (SIP) for Symmetric Response Routing · Section 1 (Introduction) and Section 4 (Server Behavior) · Checked 2026-10-14
29. 29
    RFC 3261 requires a server that listens for UDP on a port and interface to listen for TCP on the same port and interface.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.2.1 (Receiving Requests) · Checked 2026-10-14
30. 30
    RFC 3261 requires proxy servers, redirect servers and registrars to implement TLS and to support both mutual and one-way authentication.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.3.1 (Requirements for Implementers of SIP) · Checked 2026-10-14
31. 31
    RFC 5630 says a SIPS Request-URI does not by itself show the request was sent securely on each hop, and there is no SIP mechanism to indicate end-to-end security.

    RFC 5630: The Use of the SIPS URI Scheme in the Session Initiation Protocol (SIP) · Section 3.2 and Section 4 · Checked 2026-10-14
32. 32
    RFC 3261 states that UDP is not a valid transport for SIPS.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.2.2 (SIPS URI Scheme) · Checked 2026-10-14
33. 33
    RFC 5630 defines SIPS to mean the target resource is contacted securely using TLS on each hop, and bars proxies from using the RFC 3261 last-hop exception.

    RFC 5630: The Use of the SIPS URI Scheme in the Session Initiation Protocol (SIP) · Section 4 (Overview of Operations) and Section 5.3 (Proxy Behavior) · Checked 2026-10-14
34. 34
    Under RFC 3261 a request within 200 bytes of the path MTU, or larger than 1300 bytes when the path MTU is unknown, MUST be sent over a congestion-controlled transport such as TCP.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.1.1 (Sending Requests), paragraph on message size · Checked 2026-10-14
35. 35
    If a request moved to TCP only because of its size meets an ICMP Protocol Not Supported or a TCP reset, RFC 3261 says the element SHOULD retry over UDP; this exists for RFC 2543 backward compatibility and the RFC expects it to be deprecated.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.1.1 (Sending Requests), paragraph following the size rule · Checked 2026-10-14
36. 36
    RFC 5626 says the time between STUN keep-alives over UDP SHOULD be a random number between 24 and 29 seconds.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 (STUN Keep-Alive Technique) · Checked 2026-10-14
37. 37
    RFC 5626 STUN keep-alives MUST only be used with connectionless transports such as UDP.

    RFC 5626: Managing Client-Initiated Connections in the Session Initiation Protocol (SIP) · Section 4.4.2 (STUN Keep-Alive Technique) · Checked 2026-10-14
38. 38
    Because the Direct Routing planning page lists only SIP/TLS for signalling, plain UDP or TCP SIP toward Microsoft is not a documented Direct Routing option.inferred

    Plan Direct Routing · Section 'SIP signaling ports' · Checked 2026-10-14
39. 39
    Teams Direct Routing requires a trusted public certificate on the SBC for TLS, with the SBC FQDN in the CN or SAN and issued by a CA in the Microsoft Trusted Root Program.

    Plan Direct Routing · Sections 'Infrastructure requirements' and 'Public trusted certificate for the SBC' · Checked 2026-10-14
40. 40
    Teams Direct Routing signalling is SIP/TLS: the SBC connects to the Microsoft SIP proxy on port 5061, and Microsoft connects to the SBC on the port configured on the SBC.

    Plan Direct Routing · Section 'SIP signaling ports' (table) · Checked 2026-10-14
41. 41
    RFC 3261 as published makes TLS_RSA_WITH_AES_128_CBC_SHA the minimum ciphersuite implementers must support.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.2.1 (Transport and Network Layer Security) · Checked 2026-10-14
42. 42
    In RFC 3261, TLS protects SIP hop by hop over a connection-oriented transport, so a UA using TLS to its proxy has no assurance TLS is used end to end.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.2.1 (Transport and Network Layer Security) · Checked 2026-10-14
43. 43
    RFC 5630 says UACs, UASs and proxies MUST NOT use the transport=tls URI parameter.

    RFC 5630: The Use of the SIPS URI Scheme in the Session Initiation Protocol (SIP) · Sections 3.1.4, 5.1.1, 5.1.2 and 5.3 · Checked 2026-10-14
44. 44
    Twilio strongly suggests not using sips URI schemes in Twilio SIP configurations because of how Twilio processes such URIs.

    Elastic SIP Trunking · Origination settings > Origination SIP URI > The transport parameter (note) · Checked 2026-10-14
45. 45
    For customer equipment behind NAT without an SBC, Twilio says to keep the binding open with periodic SIP OPTIONS over UDP, or with OPTIONS or double-CRLF keep-alives over TCP or TLS, CRLF having the smallest overhead.

    Elastic SIP Trunking · Your Network > Deploying behind a NAT · Checked 2026-10-14
46. 46
    Twilio no longer supports TLS 1.0 or TLS 1.1 for inbound or outbound Elastic SIP Trunking calls or SIP registration.

    Elastic SIP Trunking · General settings > Secure Trunking (supported TLS versions) · Checked 2026-10-14
47. 47
    Twilio Elastic SIP Trunking sends originating (inbound-to-customer) SIP requests over UDP by default.

    Elastic SIP Trunking · Origination settings > Origination SIP URI > The transport parameter · Checked 2026-10-14
48. 48
    When Twilio Secure Trunking is enabled, non-encrypted calls are rejected.

    Elastic SIP Trunking · General settings > Secure Trunking · Checked 2026-10-14
49. 49
    Twilio selects TCP or TLS for origination via ;transport=tcp or ;transport=tls on the Origination SIP URI, with TLS defaulting to port 5061 unless another port is given.

    Elastic SIP Trunking · Origination settings > Origination SIP URI > The transport parameter (example URIs) · Checked 2026-10-14
50. 50
    Twilio's documented ;transport=tls with a sip: scheme departs from RFC 5630, which forbids the transport=tls parameter, so standards-strict peers may treat it differently than Twilio expects.inferred

    Elastic SIP Trunking · Origination settings > The transport parameter, read against RFC 5630 Sections 5.1.1 and 5.3 · Checked 2026-10-14
51. 51
    RFC 3261 strongly recommends that UAs be capable of initiating TLS, and says a UAC contacting a proxy, redirect server or registrar SHOULD initiate a TLS connection.

    RFC 3261 — SIP: Session Initiation Protocol · Section 26.3.1 (Requirements for Implementers of SIP) · Checked 2026-10-14
52. 52
    Over an unreliable transport, RFC 3261 sends the response to the address in the top Via received parameter, using the sent-by port or 5060 if none is given.

    RFC 3261 — SIP: Session Initiation Protocol · Section 18.2.2 (Sending Responses) · Checked 2026-10-14
53. 53
    Under RFC 3263, if the target URI carries a transport parameter, the client SHOULD use that transport.

    RFC 3263: Session Initiation Protocol (SIP): Locating SIP Servers · Section 4.1 (Selecting a Transport Protocol) · Checked 2026-10-14
54. 54
    Cisco devices on Webex Calling signal with SIP TLS over TCP to destination port 8934 from source ports 5060-5280.

    Port Reference Information for Webex Calling · Section 'IP Subnets for Webex Calling Services', Devices call signaling row; revision history entry on 5060-5280 · Checked 2026-10-14
55. 55
    Webex Calling Local Gateways send SIP-TLS over TCP to Webex Calling on destination port 5062 for certificate-based trunks and 8934 for registration-based trunks.

    Port Reference Information for Webex Calling · Section 'IP Subnets for Webex Calling Services', call signaling rows for Local Gateway external NIC · Checked 2026-10-14
56. 56
    Every Webex Calling signalling entry in Cisco's port reference is SIP TLS over TCP, so SIP over UDP to Webex Calling is not a documented path, although the page does not say UDP is unsupported.inferred

    Port Reference Information for Webex Calling · Section 'IP Subnets for Webex Calling Services', all call signaling tables · Checked 2026-10-14
57. 57
    RFC 7118 adds WS and WSS as SIP transport values for plain and secure WebSocket and defines SIP over WebSocket as a reliable transport.

    RFC 7118: The WebSocket Protocol as a Transport for the Session Initiation Protocol (SIP) · Section 5 and Section 5.1 · Checked 2026-10-14

Documents

Cite this page

WarmTransfer. (2026, October 14). Choosing UDP or TCP or TLS transport for SIP. WarmTransfer. https://warmtransfer.net/knowledge/sip-transport-udp-tcp-tls

@misc{warmtransfer-sip-transport-udp-tcp-tls,
  title  = {Choosing UDP or TCP or TLS transport for SIP},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sip-transport-udp-tcp-tls},
  note   = {Verified 2026-10-14}
}