Ethereal trace of SIP protocol

Unanswered Question
Apr 18th, 2008

Hi Sir,

I'm analyzing an Ethereal trace of SIP protocol (TCP port 5060). Please find attached the trace file.

I understand that frame #3 is the last segment in the TCP 3-way handshake. However, why does the source host start to send data in this frame? Is this normal for SIP?

The problem now is end-user report their application does not work.

Please advise.

Thank you.


Lim TS

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
didyap Thu, 04/24/2008 - 06:31

SIP specification uses a hybrid TCP-UDP transport. All the messages exchanged on a specific SIP transaction must use the same transport but an implementation is free to use different transports for each transaction between two SIP elements. The SIP specification only mandates to use the TCP transport or another congestion controlled transport protocol if the size of the message to send is bigger than the MTU.

The problem with Outbound is that there is only one flow created,either over an UDP or a congestion controlled transport and so the SIP elements no longer have the possibility to choose the best transport for each transaction.

For the further details for SIP follow the URL :


This Discussion