How to trace SIP messages?

When we deploy VOIP network, there are always some problems blocks us, then, it will be very useful if we can capture the TCP/UDP packages to analysis the root reason. In this document, we suggest WireShark. WireShark is an excellent network protocol analyzer with rich VOIP analysis features. We can use it to capture and analysis SIP messages.

Download WireShark from and install it in your computer. For miniSIPServer users, we suggest you install WireShark on the same computer with miniSipServer.

After start WireShark, please double click the interface which you want to capture. Please refer to below figure, the interface with traffic is to be captured.

wireshark options

Then, WireShark begins to capture SIP messages.

But in the WireShark window, we can see lots of TCP/UDP packages, so we need filter them to fit our requirements.

In the main window, please set "filter" to be "SIP or RTP" and click "apply" button. Then Wireshark will only display SIP or RTP packages. If you want to capture only SIP packages, you can set the filter to be "SIP".

Capturing window

After all these steps, please try a SIP call. You should see lots of SIP messages, such as INVITE, BYE, CANCEL etc. Then, you can click menu "File->Save" to save your SIP messages.

Wireshark will save all captured packages by default. That could be huge and we may just want to save SIP messages. Please click menu "File / Export specified packages", then select "displayed" to save displayed packages.

export specified SIP packages