SIP Troubleshooting & Packet Analysis-Basic Practical for Beginners

Level 2: Most Common SIP Issues & Their Symptoms

Top 8 problems you will fix daily:

1. No ringing / 503/408 timeout → registration failed, firewall, NAT, codec mismatch
2. One-way / no audio → asymmetric RTP, codec not supported, firewall blocks media
3. Call drops after 30s → NAT timeout, keep-alive missing, RTP timeout
4. CLI / caller ID not showing → provider not sending PAI/RPID, privacy flag
5. Registration rejected (401/403) → wrong credentials, IP not whitelisted
6. Busy tone / 486 Busy Here → called party busy or misconfigured diversion
7. 488 Not Acceptable Here → codec mismatch (G.711 vs G.729)
8. Echo / choppy audio → jitter, packet loss, bad internet

Illustration: Issues as puzzle pieces — match symptom → root cause → fix 🔍🧩.

Pro Tip: “When in doubt — capture the trace.” 80% of mysteries disappear once you see the packets.

Level 3: Free Tools You Need & How to Start Capturing

Essential free tools & quick start:

1. Wireshark (best for beginners) → download from wireshark.org
2. sngrep (console SIP viewer) → install via apt/brew
3. tcpdump (command-line capture) → already on Linux servers
4. Homer (web-based SIP capture) → if your company has it
5. 6X free test numbers → https://6xcom.com/telecom-test-numbers

Quick capture in Wireshark:

• Select interface (Ethernet/Wi-Fi)
• Filter: sip or rtp
• Start capture → make test call → stop → save .pcap

Illustration: Packet capture as a security camera — record everything when problem happens 🎥.

Rule: “No trace = no proof.” Always capture before you escalate — it makes you look professional.

Level 4: Reading SIP Traces – What to Look For First

5-minute trace reading checklist:

1. Look for INVITE → is there a 100 Trying / 180 Ringing / 200 OK?
2. Check status codes: 4xx (client error), 5xx (server error)
3. Verify From/To/Contact – correct number & domain?
4. Look at SDP (m= audio line) – codec match? IP/port reachable?
5. Check Via & Record-Route – routing loop?
6. Look for RTP after 200 OK – packets flowing both ways?

Common red flags:

• No 180/200 → destination unreachable
• 488 → codec not supported
• One-way RTP → media path broken

Illustration: Trace reading as detective work — follow the clues from INVITE to BYE 🔍📜.

Pro Tip: “Colorize Wireshark: green = 2xx, yellow = 1xx, red = 4xx/5xx.” Makes problems jump out instantly.

Level 5: Quick Diagnostic Checklists for Top Issues

One-way / no audio checklist:

1. Capture trace → check SDP IPs/ports
2. Symmetric RTP enabled on switch?
3. Firewall allowing RTP ports (usually 10000–20000)?
4. NAT keep-alive / STUN configured?
5. Test with 6X test number – same issue?

No ringing / registration fail:

1. Check REGISTER → 401/403 → credentials wrong?
2. IP whitelisted on provider side?
3. REGISTER interval too long?
4. Capture REGISTER → see response code

CLI not showing:

1. Check From / PAI / RPID headers
2. Privacy: header present?
3. Provider CLI policy correct?

Illustration: Checklists as your troubleshooting GPS — follow steps, reach destination faster 🗺️🛠️.

Rule: “Use 6X test numbers every time — if it works on test number but not customer, problem is customer-side.”

Level 6: Escalation-Ready Documentation & Communication

How to escalate professionally:

• Ticket title: “One-way audio – USA route – Cust +1-555-123-4567 – Trace attached”
• Body structure:
  – Customer symptoms & time
  – Steps already tried
  – Trace summary (key messages/codes)
  – .pcap file attached or link
  – Test number result
• Bridge language: “We have one-way audio, trace shows RTP only one direction, symmetric RTP enabled, firewall open – need media path check”
• Never say “customer issue” without proof

Illustration: Escalation as passing a baton — give complete info so next runner wins 🏃‍♂️🏁.

Pro Tip: “Good trace + clear summary = 80% faster fix.” Engineers love agents who do the homework.

Level 7: SIP Troubleshooting Legend Status Unlocked!

Congrats! You now have the complete basic toolkit to troubleshoot 70–80% of daily SIP/VoIP issues yourself — saving time, reducing escalations, boosting CSAT, and making you the go-to person on your team.

Want intermediate/advanced SIP training (deep Wireshark filters, RTP analysis, fraud via SIP headers, Kamailio debugging)? Email support@6xcom.com — we’ll help you become the SIP wizard your company needs, free!