SIP is commonly uses as its transport UDP (default port 5060), TCP (default port 5060) or TLS (default TCP port 5061). SIP signalling may also be compressed and delivered by Sigcomp
SIP is commonly used to establish media sessions, e.g. RTP/RTCP streams carrying audio or video data, where session details are commonly negociated using SDP offers/answers
Number resolution - TRIP and ENUM (IETF Charter for ENUM)
Seamless signaling - SIGTRAN and SIP-T
SIMPLE - SIP for Instant Messaging and Presence Leveraging Extensions IETF Charter for SIMPLE
The SIP dissector is fully functional. You can also view SIP message statistics (Statistics | SIP...) or view SIP call flow graphs (Statistics | VoIP Calls)
SampleCaptures/aaa.pcap Sample SIP and RTP traffic.
A complete list of SIP display filter fields can be found in the display filter reference
Show only the SIP based traffic:
sip
You cannot directly filter SIP protocols while capturing. However, if you know the
or
or port used (see above), you can filter on that one.