SIP TRACE EXERCISE AND ANSWER KEY
Guide: https://yenra.com/session-initiation-protocol-tutorials/
Updated September 7, 2026

Purpose: practice reading registration, call setup and media destinations.
Prerequisite: basic IP address and port knowledge. Use this paper exercise or
an authorized lab capture. All values below are fictional. Excerpts omit
required fields and byte lengths; they are not complete sendable messages.
Documentation addresses and example.com are for illustration only.

EXERCISE A: REGISTRATION
Mira's identity: sip:mira@example.com
Proposed contact: sip:mira@192.0.2.10:5060
Phone -> registrar: REGISTER sip:example.com SIP/2.0
Registrar -> phone: 401 Unauthorized with a challenge
Phone -> registrar: REGISTER with calculated authorization response
Registrar -> phone: 200 OK with accepted binding lifetime

What does the 401 mean in this successful sequence? ______________________
Which value represents the identity, and which the contact? ______________
What must the phone read before scheduling a refresh? ___________________

EXERCISE B: CALL SETUP
Collapsed route; proxy hops, retransmissions and early-media variants omitted.
Mira -> Leon: INVITE with offer
Toward Mira: 100 Trying
Leon -> Mira: 180 Ringing
Leon -> Mira: 200 OK with answer
Mira -> Leon: ACK
Audio in both directions
Mira -> Leon: BYE
Leon -> Mira: 200 OK

Why do the two 200 responses establish different things? ________________
Which header identifies the request method for each response? ____________

EXERCISE C: MEDIA
Selected offer lines, not a complete SDP body:
c=IN IP4 192.0.2.10
m=audio 40000 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=sendrecv
Assume Leon accepts this format and advertises 198.51.100.20:41000,
also sendrecv. Assume direct media with no relay or NAT transformation.
Where should Mira send audio? _________________________________________
Where should Leon send audio? _________________________________________

ANSWER KEY
A: The registrar challenges the phone to authenticate. Mira's example.com
URI is the identity; the address with 192.0.2.10 is the proposed contact.
Read the granted lifetime, which can differ from the requested lifetime.
B: One 200 responds to INVITE, the other to BYE. Inspect CSeq's method.
C: Mira sends toward 198.51.100.20:41000; Leon toward 192.0.2.10:40000.
In a real deployment read negotiated SDP and observe packets on the actual
media path. SIP-server and media-destination addresses can differ.

CAPTURE OBSERVATION RECORD
Date/time/time zone: __________ Capture location: ______________________
Platform and version: _________ Call-ID and correlated leg IDs: __________
Last successful stage: ________ Expected next message: __________________
Advertised media destinations: ________________________________________
Observed packet directions: ___________________________________________
Established finding: __________ Unobserved segment/next check: __________
Keep credentials, authorization values and personal content out of shared
notes. Use endpoint/server diagnostics where encrypted signaling prevents
packet inspection. A connected call still needs an audio-path test.

References: RFC 3261 (SIP), RFC 3665 (basic call flows), RFC 8760
(updated Digest authentication), RFC 8866 (SDP), RFC 3264 (offer/answer).
https://www.rfc-editor.org/rfc/rfc3665.html
https://www.wireshark.org/docs/wsug_html_chunked/ChTelVoipCalls.html