SIP and H323 Port Assignment

guillermohurtado · ‎05-25-2009

Hello,

After analizing VoIP call traces, I noticed that:

When a SIP call is placed the caller uses source port 5060 and destination port 5060. The called peer addresses response messages to port 5060 with source port 5060. Now, when a H323 call is placed the caller uses a random source port (X) and destination port 1720. The called peer addresses response messages to port X with source port 1720. Is this a normal behavior? Why in H323 the caller doesn't use port 1720 as source port?

Thanks in advance.

paolo bevilacqua · ‎05-25-2009

SIP and H.323, being different protocol developed by different people in different times, do not have to obey any common standard.

In general, the source port is irrelevant, as one port is enough to identify the application. That is true also for SIP, a client can source from another port also.

Nicholas Matthews · ‎05-26-2009

This behavior is used to save up memory for the sockets. Commonly applications don't like to listen and send from the same socket for performance reasons I believe.

Regardless, it's the destination port you should match on and care about, as the source port is fairly irrelevant.

This is also more common with TCP streams that are heavier on sockets. In this case you were probably looking at UDP 5060 and TCP 1720.

-nick