packet capture tools
SIP Call Flow Analyzer
The SIP Call Flow Analyzer turns SIP packets from a local PCAP into a call-flow view. Instead of reading hundreds of packet lines, you can see call groups, ladder direction, first failed responses, timing gaps, and the headers behind each message.
What It Shows
- SIP requests such as INVITE, REGISTER, OPTIONS, ACK, BYE, and CANCEL.
- SIP responses such as 100 Trying, 180 Ringing, 200 OK, 4xx, 5xx, and 6xx results.
- Call-ID grouping with a focused call list.
- Source and destination IP/port lanes for signaling direction.
- Detected issues such as failed responses, long gaps, auth loops, and missing ACK after answer.
- SDP codec hints when media negotiation is present.
Common Use Cases
Use it when a call fails, rings forever, drops after answer, receives a 488/503/403, or has an unexpected routing path.
Tips
- If the PCAP has multiple calls, use the Call-ID filter or select a call from the analyzer list.
- Click any ladder arrow to inspect the SIP headers behind that message.
- Look for the first non-success response before chasing later symptoms.
- Pair this with RTP Health Analyzer when signaling succeeds but audio is poor.
How To Read Results
- Read the ladder from top to bottom and find the first unexpected response.
- A 100 Trying only confirms that signaling moved forward; it does not mean the call is answered.
- A 180 or 183 response can include early media behavior, depending on the SDP and provider path.
- A 200 OK should be followed by an ACK. Missing ACKs often point to routing, NAT, or dialog mismatch problems.
- If the call connects but audio is bad, compare the SDP media addresses and codecs with RTP Health Analyzer results.
How To Use SIP Call Flow Analyzer
- Upload a PCAP or PCAPNG with SIP signaling.
- Filter to the relevant Call-ID when the capture contains multiple calls.
- Read top to bottom and find the first failed response or missing request.
- Use RTP Health Analyzer when signaling completes but users report poor or one-way audio.
Troubleshooting Flow
Example Result
INVITE -> 100 Trying -> 180 Ringing
200 OK -> ACK
RTP media starts after answer
BYE -> 200 OK
- The first non-success response often explains a failed call.
- A clean SIP ladder does not prove RTP media quality.
- Use the RTP Health Analyzer when the call connects but audio is bad.
INVITE -> 100 Trying -> 180 Ringing
200 OK repeats
No ACK from caller
Call clears shortly after
- Missing ACK often points to routing, NAT, dialog mismatch, or contact/header reachability issues.
- Repeated 200 OK messages are a clue that the answering side is waiting for confirmation.
- Compare Via, Contact, Record-Route, and SDP addresses.
What Good And Bad Results Look Like
- INVITE receives expected provisional responses and a 200 OK.
- ACK follows the 200 OK.
- BYE teardown is clean and expected.
- A 4xx or 5xx appears before answer.
- 200 OK is sent but ACK never arrives.
- SDP offer and answer do not share a usable codec or media policy.
Common Mistakes
- Starting at the last error instead of the first failed response.
- Ignoring SDP because the SIP response code looks obvious.
- Forgetting to filter by Call-ID when the capture contains multiple calls.
Practical Troubleshooting Workflow
- Filter to the call you care about.
- Read the ladder top to bottom.
- Find the first unexpected response or missing request.
- Use RTP Health Analyzer when signaling succeeds but audio does not.
FAQ
What does a SIP ladder diagram show?
A SIP ladder diagram shows signaling messages between endpoints over time. It makes it easier to see INVITE, responses, ACK, BYE, and failure codes without reading packet rows one by one.
Can a clean SIP ladder still have bad audio?
Yes. SIP signaling can complete while RTP media still has jitter, packet loss, codec mismatch, NAT issues, or one-way routing problems.
Why should I filter by Call-ID?
A PCAP can contain several calls. Filtering by Call-ID keeps the ladder focused on the specific call you are troubleshooting.