I'm analyzing an Ethereal trace of SIP protocol (TCP port 5060). Please find attached the trace file.
I understand that frame #3 is the last segment in the TCP 3-way handshake. However, why does the source host start to send data in this frame? Is this normal for SIP?
The problem now is end-user report their application does not work.