SIP
The Session Initiation Protocol (SIP) is an application-layer control (signaling) protocol for creating, modifying, and terminating sessions with one or more participants. Defined in RFC 3261 — SIP: Session Initiation Protocol, SIP is used for Internet telephone calls, multimedia distribution, and multimedia conferences.
Transport and addressing
SIP typically uses:
- Port 5060 — Unencrypted signaling over tcp or UDP
- Port 5061 — Encrypted signaling over TLS
SIP is an ASCII-based protocol with a request/response model similar to http. SIP clients use URIs with an e-mail-like format:
sip:205@192.168.1.100sip:username@pbx.comsip:205@192.168.1.100:5060
SIP requests/methods
| Method | Purpose |
|---|---|
| INVITE | Invite an account to participate in a call session |
| ACK | Acknowledge an INVITE request |
| CANCEL | Cancel a pending request |
| REGISTER | Register a user with a SIP server |
| OPTIONS | List information about the capabilities of a caller |
| BYE | Terminate a session between two users in a call |
| REFER | Indicate that the recipient should contact a third party |
| SUBSCRIBE | Request current state and state updates from a remote node |
| NOTIFY | Notify a SIP node that an event requested by SUBSCRIBE has occurred |
Example SIP INVITE request
INVITE sip:201@192.168.1.104 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.102;rport;branch=z9hG4bKvbxaoqar
Max-Forwards: 70
To: <sip:201@192.168.1.104>
From: "NightRanger" <sip:nightranger@192.168.1.102>;tag=eihgg
Call-ID: hfxsabthoymshub@backtrack
CSeq: 649 INVITE
Contact: <sip:nightranger@192.168.1.102>
Content-Type: application/sdp
Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,MESSAGE
Supported: replaces,norefersub,100rel
User-Agent: Twinkle/1.2
Content-Length: 310SIP responses
| Code | Class |
|---|---|
| 1xx | Informational |
| 2xx | Successful — action received, understood, accepted |
| 3xx | Redirection |
| 4xx | Request failure — bad syntax or cannot be fulfilled at server |
| 5xx | Server failure — valid request but server failed |
| 6xx | Global failure — cannot be fulfilled at any server |
Example SIP call flow
- Calling phone sends INVITE.
- Called phone responds 100 (Trying).
- Called phone rings and responds 180 (Ringing).
- Caller picks up; called phone responds 200 (OK).
- Calling phone sends ACK.
- Conversation begins via RTP.
- Caller hangs up; BYE is sent.
- Other party responds 200 (OK).
Security considerations
SIP is a common target for VoIP attacks: enumeration of extensions, registration hijacking, call eavesdropping, and toll fraud. Unencrypted SIP on port 5060 exposes signaling in plaintext. Tools such as svmap, svwar, and svcrack (from the SIPVicious suite) are used to scan and attack SIP infrastructure.