Skip to content
SIP Mastery

Part 1 · Foundations / Module 01

VoIP and where SIP fits

How telephone calls moved from reserved circuits to shared packets, which protocols compete for the job of setting up calls, why SIP looks so much like HTTP, and how to find your way through the RFCs that define it.

BasicNOC optionalDEV coredraft

After this module, you can

  • Explain the difference between circuit switching and packet switching, and what it means for a phone call.
  • Compare SIP with H.323, MGCP/H.248, ISUP, and IAX2, and say where you still meet each one.
  • Name the design ideas behind SIP, and the important ways in which SIP is not like HTTP.
  • Find an RFC, read its status, and tell an obsoleted RFC from an updated one.
  • Read the requirement key words MUST, SHOULD, and MAY correctly.

1.1 From circuits to packets

For a hundred years, a phone call meant a circuit. The PSTNPSTN. The traditional telephone network, built on circuits between telephone exchanges. — the public telephone network — connects your phone to a telephone exchange, and exchanges connect to each other over trunks. When you dial, the exchanges reserve a path through the network for your call. In the digital telephone network, that path is a channel of 64 kbit/s: 8,000 samples per second, 8 bits each. The channel stays yours until you hang up — even while nobody speaks.

The exchanges agree on the path with their own signaling protocol, ISUPISUP. The SS7 protocol that sets up and ends calls between telephone exchanges., on a separate network called SS7SS7. The signaling network of the PSTN. Telephone exchanges use it to set up calls.. Signaling on one network, voice on another: this idea survives in SIP.

VoIPVoIP. Voice calls carried as packets over an IP network. SIP is one way to set them up. takes another approach. The phone cuts the voice into small pieces — usually 20 milliseconds each — and sends each piece as a packet. Packets from many calls, web pages, and emails share the same links. Nothing is reserved.

Try it: add calls, and make one caller silent.

Circuits and packets

The same calls, two kinds of network

Circuit switching: the telephone networkExchangeExchangeCall 1 · 64 kbit/sCall 2 · 64 kbit/sfree circuitfree circuitfree circuitfree circuitPacket switching: VoIPRouterRouter12web1212web2 calls send RTP packets, about 50 per second each, on a link they share with other traffic

Circuits: 2 of 6 reserved for the whole call, 128 kbit/s in use. A real E1 link has 30 voice circuits; a T1 has 24.

Packets: 2 calls are sending. Each talking G.711 call needs about 80 kbit/s on the IP network. Free capacity goes to any traffic.

64kbit/s per circuit in the digital PSTN
20 msof audio in a typical VoIP packet
50packets per second, each way
30voice circuits on one E1 link

What VoIP gains:

  • Cost and flexibility. One IP network carries voice, video, and data. A phone works wherever it has an IP connection.
  • New services. Video, presence, messaging, and web integration use the same protocols as voice.

What VoIP must solve, because nothing is reserved:

  • Delay, jitter, and loss. Packets can arrive late, unevenly, or not at all (Modules 16 and 29).
  • NAT and firewalls. Home and office routers change addresses and block unknown traffic (Module 20).
  • Security. Anyone on the Internet can try to make calls on your account (Module 14).

1.2 Signaling protocols side by side

Remember the two jobs from Module 0: signaling sets up the call, media carries the voice. Almost every VoIP system uses RTP for media. The signaling protocols differ — in who they come from, how they encode messages, and above all in who controls the call.

Signaling protocols

Who controls the call?

SIPSIPSIPRTPPhoneProxyProxyPhone
Defined by
IETF: RFC 2543 (1999), replaced by RFC 3261 (2002)
Encoding
Text (UTF-8), like HTTP
Control model
Peer to peer. Phones are full user agents; proxies route between them.
Where you meet it
Almost everywhere: PBXs, SIP trunks, mobile networks (IMS), UC platforms

This course is about SIP. The other tabs show what came before it, and what still runs next to it.

Protocol From Encoding Who controls the call
SIP IETF Text The endpoints, helped by proxies
H.323 ITU-T Binary The endpoints, with an optional gatekeeper
MGCP, H.248 IETF, ITU-T Text or binary A central call agent; gateways only obey
ISUP ITU-T (SS7) Binary Telephone exchanges
IAX2 Asterisk project Binary The two servers, in one UDP flow

Why did SIP become the main protocol? It is text, so a person can read a trace. It reuses ideas from HTTP and email, which Internet developers already knew. Its core is small, and it grows through extensions. And when the mobile industry (3GPP) chose a protocol for the IP Multimedia Subsystem — the system behind VoLTE — it chose SIP. Module 27 covers IMS.

1.3 SIP’s design

SIP follows a few clear ideas. Each one explains something that you will see in traces.

1. SIP is text. You can read every SIP message without a decoder. That is why this course shows raw messages everywhere.

RFC 3261 §7 · SIP Messages
“SIP is a text-based protocol and uses the UTF-8 charset (RFC 2279 [7]).”
Read the section ↗

2. SIP looks like HTTP. Request line, headers, an empty line, a body; status codes such as 200 OK and 404 Not Found. Point at any line below to find its partner.

Family resemblance

An HTTP message and a SIP message, side by side

HTTP

POST /calls HTTP/1.1
Host: api.atlanta.example
User-Agent: ExampleApp/1.0
Accept: application/json
Content-Type: application/json
Content-Length: 27
(empty line)
{"to":"bob@biloxi.example"}

SIP

INVITE sip:bob@biloxi.example SIP/2.0
Via: SIP/2.0/UDP 192.0.2.10:5060;branch=z9hG4bK74bf9
Max-Forwards: 70
From: Alice <sip:alice@atlanta.example>;tag=9fxced76sl
To: Bob <sip:bob@biloxi.example>
Call-ID: 3848276298220188511@192.0.2.10
CSeq: 1 INVITE
Contact: <sip:alice@192.0.2.10:5060>
User-Agent: ExamplePhone/1.0
Accept: application/sdp
Content-Type: application/sdp
Content-Length: 134
(empty line)
v=0
o=alice 2890844526 2890844526 IN IP4 192.0.2.10
s=-
c=IN IP4 192.0.2.10
t=0 0
m=audio 49170 RTP/AVP 0
a=rtpmap:0 PCMU/8000
In both

Same shape in both. A request line has a method, a target, and a version. A status line has a version, a code, and a reason phrase. SIP uses a SIP URI as the target, not a path.

RFC 3261 §7.3 · Header Fields
“SIP header fields are similar to HTTP header fields in both syntax and semantics.”
Read the section ↗

3. Requests and responses. Every exchange is a request and its responses: a transaction (Module 8).

4. Addresses like email. A user has a URI such as sip:alice@atlanta.example, independent of the device or the location.

5. Intelligence at the edges. A SIP phone is a full user agentuser agent. An endpoint that sends and receives SIP, such as a phone, a softphone, or a gateway.: it creates requests, answers them, and keeps the state of its calls. The same device acts as client (UAC) for one request and server (UAS) for the next.

6. Primitives, not services. SIP has no “transfer button” or “call waiting” built in. It has building blocks — INVITE, REFER, re-INVITE, NOTIFY — and services are built from them.

RFC 3261 §2 · Overview of SIP Functionality
“SIP does not provide services. Rather, SIP provides primitives that can be used to implement different services.”
Read the section ↗

7. Any transport. SIP runs over UDP, TCP, TLS, and WebSocket (Module 19).

8. Extensible. New methods, headers, and option tags are added by new RFCs. Two devices find out what the other supports with headers such as Allow and Supported (Module 5).

Where SIP is not like HTTP

The family resemblance is real, but the differences cause many misunderstandings:

HTTP SIP
Usual transport TCP (or QUIC) UDP, with its own retransmission timers
Roles A browser is a client; a server is a server Every user agent is both client and server
Who sends requests Only the client Both sides: Bob’s phone can send BYE to Alice
Responses per request One Zero or more provisional (1xx), then one final
State Each request stands alone Transactions and dialogs keep state for the whole call

1.4 The RFC family

SIP is not one document. RFC 3261 defines the core, and well over a hundred other RFCsRFC. A numbered document from the IETF and other groups. The SIP standards are RFCs. extend it. Some fix it, some add methods or headers, and some replace older documents completely.

Every RFC has a fixed number and a status:

  • Proposed Standard — a standard, in practice. Most SIP RFCs, including RFC 3261, have this status, and they run the world’s phone networks.
  • Best Current Practice (BCP) — advice on how to do something well. RFC 3665, the call-flow examples, is a BCP. It is still not the specification, and some of its examples have errors (see Module 13).
  • Informational — useful information, not a requirement. For example, RFC 6314 describes NAT traversal practices for SIP.
  • Historic — no longer in use.

RFCs never change after publication. Instead, a new RFC updates an old one (it changes some parts) or obsoletes it (it replaces it completely). Errors that people find are listed as errata: see the errata for RFC 3261.

Explore the RFCs that this course uses. Select an RFC to see what it does, what replaced it, and which module teaches it. Dashed boxes are RFCs that a newer RFC replaced.

RFC map

88 RFCs that this course uses, 1996–2024

199619982000200220042006200820102012201420162018202020222024SIP coreSIP extensionsMediaNAT traversalSecurity and identityWebRTC and IMSGuides and examplesRFC 2543 · SIP (first version) (1999)2543RFC 2782 · DNS SRV (2000)2782RFC 3261 · SIP (2002)3261RFC 3263 · Locating SIP servers (2002)3263RFC 3581 · rport (2003)3581RFC 3966 · tel URI (2004)3966RFC 4320 · Non-INVITE fixes (2006)4320RFC 5626 · SIP Outbound (2009)5626RFC 5658 · Double Record-Route (2009)5658RFC 5922 · Domain certificates (2010)5922RFC 5923 · Connection reuse (2010)5923RFC 6026 · 2xx to INVITE fixes (2010)6026RFC 7118 · SIP over WebSocket (2014)7118RFC 3262 · PRACK (2002)3262RFC 3265 · Events (first version) (2002)3265RFC 3311 · UPDATE (2002)3311RFC 3312 · Preconditions (2002)3312RFC 3323 · Privacy (2002)3323RFC 3325 · P-Asserted-Identity (2002)3325RFC 3326 · Reason header (2002)3326RFC 3327 · Path (2002)3327RFC 3428 · MESSAGE (2002)3428RFC 3398 · ISUP mapping (2002)3398RFC 3515 · REFER (2003)3515RFC 3608 · Service-Route (2003)3608RFC 3842 · Message waiting (2004)3842RFC 3891 · Replaces (2004)3891RFC 3903 · PUBLISH (2004)3903RFC 4028 · Session timers (2005)4028RFC 4235 · Dialog events (2005)4235RFC 4488 · REFER without subscription (2006)4488RFC 5627 · GRUU (2009)5627RFC 6086 · INFO (2011)6086RFC 6432 · Q.850 in responses (2011)6432RFC 6665 · Events (2012)6665RFC 7044 · History-Info (2014)7044RFC 7647 · REFER clarifications (2015)7647RFC 1889 · RTP (first version) (1996)1889RFC 2327 · SDP (first version) (1998)2327RFC 3264 · Offer/answer (2002)3264RFC 3550 · RTP and RTCP (2003)3550RFC 3551 · RTP/AVP profile (2003)3551RFC 3611 · RTCP XR (2003)3611RFC 3711 · SRTP (2004)3711RFC 4566 · SDP (second version) (2006)4566RFC 4585 · RTCP feedback (2006)4585RFC 4568 · SDES (2006)4568RFC 4733 · DTMF in RTP (2006)4733RFC 5761 · rtcp-mux (2010)5761RFC 5763 · DTLS-SRTP framework (2010)5763RFC 5764 · DTLS-SRTP (2010)5764RFC 6189 · ZRTP (2011)6189RFC 8866 · SDP (2021)8866RFC 4787 · NAT behaviour (2007)4787RFC 5389 · STUN (second version) (2008)5389RFC 5766 · TURN (first version) (2010)5766RFC 5245 · ICE (first version) (2010)5245RFC 6314 · NAT practices for SIP (2011)6314RFC 8445 · ICE (2018)8445RFC 8489 · STUN (2020)8489RFC 8656 · TURN (2020)8656RFC 2617 · HTTP Digest (old) (1999)2617RFC 4474 · SIP Identity (old) (2006)4474RFC 5630 · SIPS (2009)5630RFC 7616 · HTTP Digest (2015)7616RFC 8224 · Identity header (2018)8224RFC 8225 · PASSporT (2018)8225RFC 8588 · SHAKEN extension (2019)8588RFC 8760 · Digest algorithms for SIP (2020)8760RFC 8946 · Diverted calls (2021)8946RFC 3310 · Digest AKA (2002)3310RFC 3329 · Security agreement (2003)3329RFC 3455 · 3GPP P-headers (old) (2003)3455RFC 7315 · 3GPP P-headers (2014)7315RFC 8825 · WebRTC overview (2021)8825RFC 8829 · JSEP (first version) (2021)8829RFC 8838 · Trickle ICE (2021)8838RFC 8843 · BUNDLE (first version) (2021)8843RFC 9143 · BUNDLE (2022)9143RFC 9429 · JSEP (2024)9429RFC 2119 · Key words (1997)2119RFC 3665 · Basic call flows (2004)3665RFC 3725 · Third-party call control (2004)3725RFC 5359 · Service examples (2008)5359RFC 5853 · SBC requirements (2010)5853RFC 6141 · re-INVITE handling (2011)6141RFC 7092 · B2BUA taxonomy (2013)7092RFC 8174 · Key words (update) (2017)8174
  • Replaced (obsoleted)
  • Obsoletes
  • Updates
  • SIP
  • SDP
  • RTP
  • RTCP
  • DNS, STUN, ICE

Reading MUST, SHOULD, and MAY

RFCs use a few words with a precise meaning, defined in RFC 2119. They matter: a device that ignores a MUST is broken; a device that ignores a SHOULD may have a good reason.

RFC 2119 §1 · MUST
“This word, or the terms "REQUIRED" or "SHALL", mean that the definition is an absolute requirement of the specification.”
Read the section ↗
RFC 2119 §3 · SHOULD
“This word, or the adjective "RECOMMENDED", mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.”
Read the section ↗
RFC 2119 §5 · MAY
“This word, or the adjective "OPTIONAL", mean that an item is truly optional.”
Read the section ↗
RFC 8174 §1 · Introduction
“This document updates RFC 2119 by clarifying that only UPPERCASE usage of the key words have the defined special meanings.”
Read the section ↗

This course highlights these key words in every RFC quote.

1.5 Where SIP runs today

SIP is in more places than desk phones. You meet it in all of these:

Office phone systems (PBX)

Desk phones and softphones register to a PBX. The PBX connects internal calls and sends outside calls to a SIP trunk.

Typical elementsIP phones, PBX (often a B2BUA), voicemail

12 Registration21 Basic call flows25 Proxies, B2BUAs, and SBCs

SIP trunks

A company connects its PBX to a carrier over SIP instead of physical phone lines. Numbers, caller ID, and fraud protection matter here.

Typical elementsPBX, SBC, carrier proxy, PSTN gateway

24 PSTN interworking and SIP trunks14 SIP security

Carrier networks

Carriers exchange calls with each other over SIP. In some countries they also sign the caller identity, to fight spoofed numbers.

Typical elementsSBCs, routing proxies, STIR/SHAKEN services

25 Proxies, B2BUAs, and SBCs28 Caller identity: STIR/SHAKEN

Mobile networks (VoLTE)

Calls on 4G and 5G phones are SIP calls inside the IMS. The SIM card authenticates the phone.

Typical elementsPhone, P-CSCF, S-CSCF, media gateways

27 IMS and VoLTE

Browsers (WebRTC)

A web page can make calls. SIP often runs over WebSocket to a gateway, which connects to the normal SIP network.

Typical elementsBrowser, WebSocket proxy, media gateway

26 WebRTC and SIP19 SIP over UDP, TCP, TLS, and WebSocket

UC and contact centres

Collaboration and contact-centre platforms connect to phone networks through SBCs over SIP.

Typical elementsUC platform, SBC, SIP trunk

25 Proxies, B2BUAs, and SBCs21 Basic call flows

Common mistakes

“SIP and VoIP mean the same thing”

VoIP is the idea: voice as packets over IP. SIP is one way to set up those calls. H.323, IAX2, and many private app protocols do the same job. Many apps use their own protocols inside, and use SIP only at the edge, where they connect to the phone network.

Remember: ask “which signaling protocol?” before you troubleshoot a VoIP problem.

“SIP is only for phone calls”

SIP sets up any session: voice, video, games, or file transfer. It also carries instant messages (MESSAGE) and presence (SUBSCRIBE and NOTIFY).

Remember: the SDP body, not SIP itself, says what kind of media a session uses.

“SIP is like HTTP, so it works like HTTP”

SIP usually runs over UDP and handles its own retransmissions. One request can get several responses. Both sides send requests, and both sides keep state for the whole call.

Remember: the table “Where SIP is not like HTTP” above. Most early SIP bugs come from one of those five differences.

Trusting an old RFC, or an example

Search results often show RFC 2543, RFC 3265, or RFC 4566. All three are obsoleted. Example RFCs such as RFC 3665 are useful, but they are not the specification, and they contain known errors.

Remember: check the status and the “Obsoleted by” line at the top of every RFC, and check the errata.

“Every SIP device supports every SIP RFC”

Extensions are optional. A phone may not support PRACK, UPDATE, or REFER. When a request uses an extension that the other side does not support, the result is an error such as 420 Bad Extension or 501 Not Implemented.

Remember: look at the Allow and Supported headers in the trace before you blame the network.

Reading a lowercase “must” as a requirement

Only the capitalised key words — MUST, SHOULD, MAY — have the special RFC 2119 meaning. A lowercase “must” is ordinary English.

Remember: RFC 8174 made this rule explicit.

Summary

  • The PSTN reserves a 64 kbit/s circuit for each call. VoIP sends the voice as packets — about 50 per second — on links shared with other traffic.
  • SIP is one of several signaling protocols. H.323 and ISUP come from the telephone world; MGCP and H.248 control gateways; IAX2 links Asterisk servers.
  • SIP is text, looks like HTTP, keeps the intelligence in the endpoints, and provides primitives rather than services.
  • SIP is not HTTP: it usually runs over UDP, both sides send requests, one request can get several responses, and calls keep state.
  • SIP is a family of RFCs. Check each RFC’s status, whether it is obsoleted, and its errata. Only capitalised MUST, SHOULD, and MAY are requirements.