Session Initiation Protocol Raheem Muftau, firstname.lastname@example.org Computer Networks-Royal Institute of Technology .Abstract— Communication for decades now has outgrown the reachable and they include proxy, location, redirect andtraditional PSTN communication system and because, everything is registrar servers. Figure 1 shows the architecture of the SIPover IP, there is need to understand how this has evolved, the network.technology, and the mode of operation in general. This paper focuseson the basic concepts of the Session Initiation Protocol which is asignalling protocol, its data presentation formats and also how thePSTN network had been made to suitably rout over the IP networkwith the use of ENUM.Keywords— SIP, SDP, UA,URI, SIMPLE, ENUM I. INTRODUCTIONT he Session Initiation Protocol (SIP) is an application layer protocol which is an ASCII-based designed and developed by the IETF with good scalability, simpleimplementation and flexibility in mind and all SIPspecifications had been defined in the RFC3261 . The SIPsession negotiation is a request and response model between Fig. 1 SIP Architectureuser agents which can act in a dual role but will take a role ata point during a session. The functions of this servers is described thus:SIP basically is a signalling protocol, so it mainly focuses onmaking the communication possible by establishing the 1) Proxy Servers: This is the intermediate component thatsession between user agents. For a complete communication acts on behalf of the user agents. The major role of the proxysession, Real Time Protocol (RTP) and Session Description server is to ensure that session invitations are routed closer toProtocol (SDP) are employed once the session is established. the called party.  Other functions of the proxy serverThe RTP is used for the real- time multimedia data includes authorization, authentication, routing, network accesstransmissions and SDP for the description of the data so it is control, reliable request transmissions and security.easily decoded by both agents. SIP had been designed to 2) Redirect Servers: It provides the client with theprovide a better functionality compared to the traditional information of the next hop where the session will be routedPSTN because it is open to implement new serviced which over by sending a 3xx redirection response class message tomight be difficult to do in the PSTN.  the client based on the registrar’s database. II. SIP ARCHITECTURE AND ITS ELEMENTS 3) Registrar: The registrar server accepts requests from UACs for the registration of their current location. It is oftenA. SIP Architecture placed together with the location server. SIP had been designed to function as a peer-to-peer protocol 4) Location: This server provides address resolution to thethat establishes sessions between peers . The peers proxies and the redirect servers using tools such as Fingerparticipating in these sessions are referred to as User Agents protocol and RWhois. (UA). These User Agents functions as either a client or aserver at a time depending on the role it takes during the B. Call setup between two User Within a Proxysession. When the user agent initiates requests and accepts SIP calls are established in several ways, within this section,responses then it is referred to as the User Agent Client we examine the situation when the calling party and the called(UAC) and on the other round when a user agent receives party both belong to the same domain (proxy server). This callrequests and sends responses, then is referred to the User is between two user agents, Raheem and Mustafa.kpa as it isAgent Server (UAS). With this in mind, the architectural further shown from the capture of the call between them. Innetwork design of SIP can be classified as either a Client or a this case the caller is Raheem and the called is Mustafa.kpa.Server. The clients are the endpoints which primarily are the To create a session, Raheem calls the URI (Uniform Recourseuser agents that could either be UAC or UAS. The servers are Identifier) of Mustafa.kpa which is similar to an e-mail formatthose part of the network that ensures the user agents are because it has the username and the hostname part. Fort this
scenario, the URI of Mustafa.kpa being called is Call-ID:sip:email@example.com and because both parties belong to 6F6DD13843954D2FA9D6B9403410482E0xc10a279same proxy, the URI of Raheem (caller) is firstname.lastname@example.org. dMusta.kpa is called from a softphone (SJphone) which sends CSeq: 3 BYEan INVITE that a client email@example.com will like to Max-Forwards: 70connect with it. The details of the call session is described User-Agent: SJphone/1.65.377a (SJ Labs)below based on the capture with from a packet sniffer. Content-Length: 0INVITE sip:firstname.lastname@example.org SIP/2.0 The BYE method is the termination message between bothVia: SIP/2.0/UDP user agents. The messages in both cases are similar as with the184.108.40.206;branch=z9hG4bKc10a279d00000 INVITE method. With critical investigation into the two10a4cd1702b000042e700000091;rport initiation and termination process during the session, it couldFrom: "raheem" be observed that both user agents belongs to the same proxy<sip:email@example.com>;tag=9c76c6cd6 server which is iptel.org as it could be seen from the URI ofTo: <sip:firstname.lastname@example.org> both user agents (email@example.com andContact: sip:firstname.lastname@example.org Mustafa.email@example.com ).Call-ID: To every method, there is an accompanied RESPONSE with a6F6DD13843954D2FA9D6B9403410482E0xc10a279 code signifying the type of response to the request made.d Below is what the RESPONSE looks like from the packetCSeq: 1 INVITE sniffer during the session.Max-Forwards: 70 SIP/2.0 100 trying -- your call isUser-Agent: SJphone/1.65.377a (SJ Labs) important to usContent-Length: 368 Via: SIP/2.0/UDP 220.127.116.11;branch=z9hG4bKc10a279d00000The above capture illustrates the INVITE method which is 10b4cd1702b0000542700000093;rport=5060the request initiation process. The details of the INVITE is From: "raheem"further described. <sip:firstname.lastname@example.org>;tag=9c76c6cd6Via shows that the version 2 of SIP is being used together To: sip:email@example.com UDP and 18.104.22.168 as the address where raheem Call-ID:will receive all responses to its request. 6F6DD13843954D2FA9D6B9403410482E0xc10a27dFrom shows the client making the request in this case CSeq: 2 INVITERaheem and its URI, firstname.lastname@example.org with an identifier Server: ser (3.1.0-pre1 (i386/linux))called tag appended by the SJphone. Content-Length: 0To shows the username and the URI of the UAS where all SIP/2.0 180 Ringingrequests are directed which are Mustafa.kpa and Via:SIP/2.0/UDPsip:email@example.com respectively. 22.214.171.124;branch=z9hG4bKc10a279d00000Call-ID is the global unique identifier for the call generated 10b4cd1702b0000542700000093;rport=5060by the combination of the random strings and Soft phone’s From:"raheem"hostname or the IP address. <sip:firstname.lastname@example.org>;tag=9c76c6cd6The CSeq shows an integer being incremented at every To:"MZ Mustafa"request with a method name i.e INVITE. <sip:email@example.com>;tag=30676bd07Max-Forwards with a value of 70 shows that maximum Contact: sip:firstname.lastname@example.org the request could make to the server. This number Call-ID:decreases as each hop is met. 6F6DD13843954D2FA9D6B9403410482E0xc10a27dUser-Agent shows the client and soft phone from which Record-Route:the request had been made.  sip:126.96.36.199;ftag=9c76c6cd6;avp=veAD BwBhY2NvdW50AwB5ZXMDBgBzdGltZXIEADE4MDADCBYE sip:email@example.com SIP/2.0 QBkaWFsb2dfaWQWADViOTgtNGNjODdhNTItZDgxOGVia: SIP/2.0/UDP E0NDg;lr=on188.8.131.52;branch=z9hG4bKc10a279d00000 Server: SJphone/1.65.377a (SJ Labs)10d4cd170340000365000000099;rportFrom: "raheem" SIP/2.0 200 OK<sip:firstname.lastname@example.org>;tag=9c76c6cd6 Via: SIP/2.0/UDPTo: 184.108.40.206;branch=z9hG4bKc10a279d00000<sip:email@example.com>;tag=30676bd05 10b4cd1702b0000542700000093;rport=50607 From: "raheem"Contact: sip:firstname.lastname@example.org <sip:email@example.com>;tag=9c76c6cd6
To: "MZ Mustafa"<sip:firstname.lastname@example.org>;tag=30676bd07Contact: sip:email@example.comCall-ID:6F6DD13843954D2FA9D6B9403410482E0xc10a27dCSeq: 2 INVITERecord-Route:sip:220.127.116.11;ftag=9c76c6cd6;avp=veADBwBhY2NvdW50AwB5ZXMDBgBzdGltZXIEADE4MDADCQBkaWFsb2dfaWQWADViOTgtNODdhNTItZDgxOGE0NDg;lr=0It could be observed that record-route is being used during thisINVITE method; details will be discussed later in the paper.SIP/2.0 200 OKVia: SIP/2.0/UDP18.104.22.168;branch=z9hG4bKc10a279d0000010d4cd170340000365000000099;rport=5060 Fig. 1 SIP Signalling between two User agents within a Proxy ServerFrom: "raheem"<sip:firstname.lastname@example.org>;tag=9c76c6cd6 C. Signalling between two user agents on different proxyTo: "MZ Mustafa" servers and the effect of record route on it.<sip:email@example.com>;tag=30676bd07 There are two ways to use the proxy during a sessionContact: sip:firstname.lastname@example.org establishment, it is either to have record route enabled orCall-ID: disable. By Record route we mean that the proxy includes a6F6DD13843954D2FA9D6B9403410482E0xc10a27dCSeq: 3 BYE record route header field in the SIP messages during requests in other to ensure that all requests are sent through the same path sequence in this case, the proxy. This feature is oftenThe flow response from the protocol analyzer as shown above used for proxies that are providing mid-call features . Whenhas some unique status codes which signify different meaning no record route is used, then the messages needs no sendbased on its operation at a particular time. The summary of the further messages via the proxy once a communication sessioncodes is described below: had been established. Figures 3 and 4 illustrate the effect of • 1xx means provisional response e.g 100/180 the proxy servers during the session signaling. Figure 3 shows (Ringing) continuous and constant message path from the user agents • 2xx means positive final responses e.g 200 OK through the proxy servers, while the reverse is noticed in • 3xx used for redirecting the calling party figure 4 as shown, once a communication session had been • 4xx used for negative final responses established between the two user agents, then there is no need for the messages to be communicated via the proxy. • 5xx means there is a problem on the server’s side • 6xx indicates the request cannot be fulfilled at any server. It could be seen that the INVITE method has three responseswhich includes 100 (trying), 180(Ringing) and 200 (OK). The100 and 180 indicates the result of the processing is yet to beknown and immediately the server responds to the request, thestatus changes to 200 OK which connotes the final response ofthe request process. Figure 2 below shows a detailed sessionrequest between the user agents within same proxy server. Fig. 3 SIP Call Signalling between two User agents and different Proxy Servers with record route enabled.
Each client is composed of a Presence source which provides information to the presence server which makes the information available to the watchers. The watchers are the clients that requests the Presence of the other user in the communication. IV. JABBER(XMPP) Extensible Messaging and Presence Protocol (XMPP) is an extensible Message and Prescence protocol which is an open technology for instant messaging, presence multiparty chat, voice and video calls and generalised routing of XML data. . It uses TCP rather than UDP and denoted by a jabber identifier in the form email@example.com. Table ii below highlights the key difference between SIMPLE Fig. 4 SIP Call Signalling between two User agents and different ProxyServers without record route enabled and XMPP TABLE IID. Session Description Protocol, SDP SIMPLE VERSES XMPPThis protocol is meant for the description and encoding of SIMPLE XMPPsession participants which is later used for the session Uses Proxy servers No proxy requirednegotiation so that all participants are able to take part in the Uses SIP, so supports Purely XMLsession . By this all participants in the session will have signallingsame encoding schemes to understand and decode all requestsand responses. SDP is capable of describing multimedia Consumes network Small because it is purelysessions which includes the type of media to be used, resources because it text basedtransport layer protocol and possible codec for the adds SIP headerstransmission. Likely result of the SDP is described below asobtained from the packet sniffer. V. ENUM(a): rtpmap:3 GSM/8000(t): 0 0 This is a standard developed by the IETF and administers by(a): rtpmap:8 PCMA/8000 the ITU that shows the scalability of the Session Initiation(c): IN IP4 22.214.171.124 Protocol. ENUM meaning Electronic Numbering is theSDP has some basic syntax which are often appended to the mapping of telephone numbers to domain names using a DNSSDP capture of SIP, some of this is shown in table 1. based architecture. This is achieved through mapping which makes it easier to translate the common PSTN numbers to an TABLE I internet based address in the form of x.x.x.x....e164.arpa . SDP SYNTAX How this is done is shown in the table iii below. Syntax Attributes TABLE III a Attribute of the session PSTN TO IP BASED ADDRESS b Bandwidth C Connection information Rule Application o Session owner Turn the PSTN and the 234565764 country code backward v Protocol version e.g +467565432 m Media name Add points between each 126.96.36.199.188.8.131.52 t Active time number disregarding the +An application of this could be seen in a real time streaming Add .e164.arpa at the end 184.108.40.206.220.127.116.11.e164.arpamedia managed by Real Time Streaming Protocol (RTSP). The URI address 18.104.22.168.6.7.4.e164.arpa can then be used byRTSP manages media sessions between endpoints using the an internet client which will make it possible to use VoIPSDP as its presentation description format. protocols for its communication. With this, the when a user III. SIP INSTANT MESSAGING AND PRESENCE (SIMPLE) dials a PSTN number, the SIP server does an ENUM lookup as described in table II then the ENUM server detects the SIPSIMPLE as the name implies, is a SIP for Instant Messaging address which is then sent to the SIP server. .and Presence, it is an open standard which aids itsinteroperability with other protocols compared to other VI. CONCLUSIONproprietary protocols. It becomes important to know how the This paper has elaborated the Session description protocolpresence service is implemented in the SIMPLE since the SIP from a practical view because it is primarily based on ahad been extended to support the presence of users. laboratory experience being monitored from a network
analyser. The methods (INVITE , BYE ) with their responses Request-Line: BYEand the message codes were keenly observed. The effect of sip:firstname.lastname@example.org SIP/2.0proxy servers in relation to other supporting servers like the Status-Line: SIP/2.0 200 OKregistrar, location and redirecting servers were observed and As it could be seen, the request lines are mainly the plain textthey have proven to be capable of making SIP a protocol of the messages and no code attached to them.much better than the traditional PSTN. F. What’s the call ID? VII. APPENDIX Call-ID contains a globally unique identifier for this call,A. IP Address of the User Agent being used during the generated by the combination of a random string and the SJ Laboratory exercise. phone host name or IP address. 22.214.171.124 Call-ID: E07F8C8746D64E13B593B53FCDE26BD70xc10a279B. Where in the packet does it say which kind SIP message it is? G. Can you get information about the user agent and/orAll messages are on the request line of the SIP Application proxy? And is so, what?Layer.Request-Line: INVITE Yes, as it could be seen from the network analyzer, it issip:email@example.com SIP/2.0 possible to get information about the user agents and theRequest-Line: ACK proxy servers. From the trace, it is possible to get the SIPsip:firstname.lastname@example.org SIP/2.0 URI, user part, host part and IP addresses of user agents .C. Can you in the SIP message see if you are the sender or Moreso, the IP address and DNS of the proxy is seen. receiver? SIP from address: sip:email@example.comYes it is possible because it is contained in the message SIP from address User Part: raheemheader which shows the “from and to”. SIP from address Host Part: iptel.org Message Header SIP to address: sip:firstname.lastname@example.orgVia: SIP/2.0/UDP SIP to address User Part: Mustafa.kpaFrom: "raheem" SIP to address Host Part: iptel.org<sip:email@example.com>;tag=9c76c6cd6 Source: 126.96.36.199 (188.8.131.52)To: sip:firstname.lastname@example.org Destination: 184.108.40.206 (220.127.116.11)D. What’s the difference between the URI in the contact-line H. In which packet does it say what codec is going to be compared to the SIP address in the to/from-line? used?The contact shows the current IP location of the caller while The Message body of an INVITE with the session descriptionthe to/from shows the proxy server connection of the caller as contains the SDP which clearly shows the codec being usedseen from the capture. during the call session.Contact: sip:email@example.com Media Attribute (a): rtpmap:3 GSM/8000From: "raheem" <sip:firstname.lastname@example.org>;tag=9c76c6cd6 Media Attribute (a): rtpmap:101To: sip:email@example.com telephone-event/8000 Media Attribute (a): fmtp:101 0-16E. What’s the status code for the different messages? Media Attribute (a): setup:activeThe status code is contained in the status line of each SIP Media Attribute (a): sendrecvmessage generated based on requests and corresponding The above message could easily be seen from the 200 OKresponses. This is illustrated below: with session descriptionRequest-Line: INVITE I. Find the sizes of the ”200-packets”. Why does it vary?sip:firstname.lastname@example.org SIP/2.0 The sizes varied because the first 200 OK contains the sessionStatus-Line: SIP/2.0 407 Proxy description protocol which will also add its own headers. TheAuthentication Required difference is shown below:Status-Line: SIP/2.0 100 trying -- your Frame Length: 950 bytescall is important tous Protocols in frame: eth:ip:udp:sip:sdpStatus-Line: SIP/2.0 180 Ringing Frame Length: 628 bytesStatus-Line: SIP/2.0 200 OK Protocols in frame: eth:ip:udp:sipRequest-Line: ACKsip:email@example.com SIP/2.0
J. Fill in the SIP traffic between the users agents and the proxy, show the direction as well. L. Which ports are used by RTP and SIP packets? RTP Source ports 49242 Dest Port 49224 SIP 5060 M. How large are the packets? 87 bytes (RTP) SIP is from 450 to 1120 N. How much of the packet contain voice data? Payload The payload is 33 bytes. REFERENCES Fig. 5 Call Signalling between Two UA and one Server  M. brandl, D.Daskopoulos, and J.Janak, “IP telephonyK. What’s the difference in signalling between starting a call cookbook,” Terena Report March, 2004. and “un holding” a call?  Rosenberg J., Schulzrinne H., et al., “SIP: Session Several differences were observed during this scenarios, Initiation Protocol”. RFC 3261. (Standards Track). June some of which are illustrated in the table below. The 2002 major difference when compared together was based on  SIP for Instant Messaging and Presence Leveraging the previous information which the proxy server has Extensions (SIMPLE) IETF Working Group. obtained during the first call. Those information which www.ietf.org has been known earlier need not be requested again from  Interworking between the Session Initiation Protocol the user agent during the un hold period of the call. (SIP) and the Extensible Messaging and Presence Protocol (XMPP) www.xmpp.orgExample of this is information is the proxy server being used  “What is ENUM”, www.enum.orgduring the call connection.  Kevin Wallace, Cisco CVoice 3rd EditionINVITE starting a call INVITE un-holding a call  Overview of SIP, Cisco IOS SIP configuration Guide.1071 bytes 1119 bytes www.cisco.com.username@domain Username@IP from the  ENUM: e164 Number Translation. www.voipuser.org.from the Request Request Line  SIP Laboratory Manual, Computer Networks RoyalLine sip:firstname.lastname@example.org Institute of Technology, Sweden.sip:mustafa.kpa@ip 0.39.158 SIP/2.0tel.orgNo Route Field Route Field includedRequired (i.e iptel proxy server)Proxy No Proxy neededAuthentication because the locationrequired because and DNS had alreadyit is the first been resolved andcall setup and found in the databasenegotiationNo session expires Session Expired fieldField included when call is terminated.