Networking for SIP

2.1 Addresses, ports, and sockets

Every SIP message travels inside an IP packet. Three ideas explain where it goes.

• An IP addressIP address. The address of a network interface. IPv4 addresses look like 192.0.2.10; IPv6 addresses look like 2001:db8::10. identifies a network interface. IPv4 addresses have four numbers, such as 192.0.2.10. IPv6 addresses have up to eight groups of hexadecimal digits, such as 2001:db8::10.
• A portport. A number from 0 to 65535 that selects one application on a host. SIP usually listens on 5060 (5061 for TLS). selects one application on that interface. A SIP phone usually listens on port 5060.
• A socketsocket. One end of a network conversation, written as IP address and port, such as 192.0.2.10:5060. is the combination: 192.0.2.10:5060. A conversation between two sockets, over one transport, is a flow:

UDP   192.0.2.10:5060   →   198.51.100.10:5060
      source socket         destination socket

Ports you will see in SIP traces

Private and public addresses

Some IPv4 ranges are reserved for private networks: homes, offices, and the inside of data centres. Routers on the Internet do not forward packets to these addresses.

Type an address, or pick an example. The table shows which range it belongs to.

2.2 UDP and TCP, the short version

IP delivers packets, one at a time, without guarantees. A transport runs on top of it. SIP can use several transports (Module 19); the two basic ones are UDP and TCP.

Compare the two. In both flows, one packet is lost. Watch who sends it again.

UDP has one more limit. A big SIP message — an INVITE with many codecs, video, and encryption keys — may not fit in one packet. RFC 3261 says when to switch to TCP:

2.3 DNS: from names to addresses

A phone is usually configured with a name, such as proxy.atlanta.example, not an IP address. Before the first SIP packet, it asks a DNS resolverDNS resolver. The server that a device asks to look up DNS names for it. to translate the name.

• An A record holds an IPv4 address; an AAAA record holds an IPv6 address.
• Every answer has a TTL (time to live): how many seconds the answer may be cached.
• SIP also uses SRV and NAPTR records, which tell a client which server, port, and transport to use. Module 11 covers them.

2.4 What NAT does to a packet

Most phones sit behind a NATNAT. A router function that rewrites private addresses and ports into public ones, and back. router. The router lets many private addresses share one public address. For every packet that goes out, it rewrites the IP source address and the UDP source port, and remembers the change in a mapping table, so it can send replies back.

The router changes the IP and UDP headers. It does not change the addresses written inside the SIP text. Step through a registration, then turn rport off.

Two more facts explain most NAT problems in SIP:

• The mapping lasts only while packets flow. If nothing passes for a while, the router forgets it, and incoming requests can no longer get in.

• The private Contact address means that nobody outside can reach the phone directly — unless something fixes it. Module 20 covers the fixes: rport, keepalives, Contact rewriting, SIP Outbound, and media relays.

2.5 How a packet capture shows the layers

A packet capture (from Wireshark, tcpdump, or sngrep) shows each packet as a stack of layers. This is the first REGISTER from Module 13, wrapped in real Ethernet, IPv4, and UDP headers. Select a layer or a field to see its bytes; point at the bytes to find their field.

Capture tips

Where you capture changes what you see. On the phone, you see private addresses. Outside the NAT router, you see public ones. On the server, you see the server’s view. Always note where a trace was taken.

Common mistakes

Summary

• An IP address finds the host, a port finds the application, and the two together form a socket. SIP uses 5060 (UDP or TCP) and 5061 (TLS); RTP uses a range of even ports.
• Private addresses (RFC 1918) are not reachable from the Internet. In SIP, they cause trouble when they appear inside messages that leave the network.
• Over UDP, SIP retransmits lost messages itself. Over TCP, TCP does it. Large messages must use TCP.
• DNS turns names into addresses before the first SIP packet. A records hold IPv4 addresses; AAAA records hold IPv6 addresses.
• A NAT router rewrites the IP source and the UDP port, but not the addresses inside SIP. rport lets replies find their way back; mappings expire when traffic stops.
• A capture shows Ethernet, IP, UDP, and SIP. Note where it was taken, and capture wide before you filter.