No. Time Source Destination Protocol Length Info 406 2013-03-13 02:11:48.221070 172.16.1.1 80.12.12.165 SIP 616 Request: OPTIONS sip:pcscfgm.orange-obs.fr | Frame 406: 616 bytes on wire (4928 bits), 616 bytes captured (4928 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:11:48.221070000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137108.221070000 seconds [Time delta from previous captured frame: 0.282790000 seconds] [Time delta from previous displayed frame: 60.000379000 seconds] [Time since reference or first frame: 84.421307000 seconds] Frame Number: 406 Frame Length: 616 bytes (4928 bits) Capture Length: 616 bytes (4928 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6), Dst: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Destination: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 172.16.1.1 (172.16.1.1), Dst: 80.12.12.165 (80.12.12.165) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 602 Identification: 0x906e (36974) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xde02 [correct] [Good: True] [Bad: False] Source: 172.16.1.1 (172.16.1.1) Destination: 80.12.12.165 (80.12.12.165) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: winpcs (5060), Dst Port: sip (5060) Source port: winpcs (5060) Destination port: sip (5060) Length: 582 Checksum: 0xabf3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (OPTIONS) Request-Line: OPTIONS sip:pcscfgm.orange-obs.fr SIP/2.0 Method: OPTIONS Request-URI: sip:pcscfgm.orange-obs.fr Request-URI Host Part: pcscfgm.orange-obs.fr [Resent Packet: False] Message Header Via: SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK0570db07;rport Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK0570db07 RPort: rport Max-Forwards: 70 From: "qitelephonie" ;tag=as432cff81 SIP Display info: "qitelephonie" SIP from address: sip:qitelephonie@111.111.111.111:5060 SIP from address User Part: qitelephonie SIP from address Host Part: 111.111.111.111 SIP from address Host Port: 5060 SIP from tag: as432cff81 To: SIP to address: sip:pcscfgm.orange-obs.fr SIP to address Host Part: pcscfgm.orange-obs.fr Contact: Contact URI: sip:qitelephonie@111.111.111.111:5060 Contact URI User Part: qitelephonie Contact URI Host Part: 111.111.111.111 Contact URI Host Port: 5060 Call-ID: 28fb0c2d323b72b6514e34ba17fb88e8@111.111.111.111:5060 CSeq: 102 OPTIONS Sequence Number: 102 Method: OPTIONS User-Agent: FPBX-2.10.1(1.8.15) Date: Wed, 13 Mar 2013 01:11:48 GMT Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH Supported: replaces, timer Content-Length: 0 No. Time Source Destination Protocol Length Info 407 2013-03-13 02:11:48.260306 80.12.12.165 172.16.1.1 SIP 514 Status: 200 OK | Frame 407: 514 bytes on wire (4112 bits), 514 bytes captured (4112 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:11:48.260306000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137108.260306000 seconds [Time delta from previous captured frame: 0.039236000 seconds] [Time delta from previous displayed frame: 0.039236000 seconds] [Time since reference or first frame: 84.460543000 seconds] Frame Number: 407 Frame Length: 514 bytes (4112 bits) Capture Length: 514 bytes (4112 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00), Dst: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Destination: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 80.12.12.165 (80.12.12.165), Dst: 172.16.1.1 (172.16.1.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xb8 (DSCP 0x2e: Expedited Forwarding; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 1011 10.. = Differentiated Services Codepoint: Expedited Forwarding (0x2e) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 500 Identification: 0x4be5 (19429) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: UDP (17) Header checksum: 0xea99 [correct] [Good: True] [Bad: False] Source: 80.12.12.165 (80.12.12.165) Destination: 172.16.1.1 (172.16.1.1) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: sip (5060), Dst Port: winpcs (5060) Source port: sip (5060) Destination port: winpcs (5060) Length: 480 Checksum: 0xb582 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (200) Status-Line: SIP/2.0 200 OK Status-Code: 200 [Resent Packet: False] [Request Frame: 406] [Response Time (ms): 39] Message Header v:SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK0570db07;rport=50037;received=10.200.112.85 Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK0570db07 RPort: 50037 Received: 10.200.112.85 f:"qitelephonie";tag=as432cff81 SIP Display info: "qitelephonie" SIP from address: sip:qitelephonie@111.111.111.111:5060 SIP from address User Part: qitelephonie SIP from address Host Part: 111.111.111.111 SIP from address Host Port: 5060 SIP from tag: as432cff81 t:;tag=198240728 SIP to address: sip:pcscfgm.orange-obs.fr SIP to address Host Part: pcscfgm.orange-obs.fr SIP to tag: 198240728 i:28fb0c2d323b72b6514e34ba17fb88e8@111.111.111.111:5060 CSeq:102 OPTIONS Sequence Number: 102 Method: OPTIONS Accept:*/* Accept-Language:en Allow:ACK,BYE,CANCEL,INVITE,MESSAGE,NOTIFY,PUBLISH,REGISTER,SUBSCRIBE,OPTIONS,PRACK,UPDATE,INFO,REFER k:100rel,path,pref,privacy l:0 No. Time Source Destination Protocol Length Info 479 2013-03-13 02:11:56.040951 172.16.1.1 80.12.12.165 SIP/SDP 919 Request: INVITE sip:0296401610@pcscfgm.orange-obs.fr | , with session description Frame 479: 919 bytes on wire (7352 bits), 919 bytes captured (7352 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:11:56.040951000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137116.040951000 seconds [Time delta from previous captured frame: 0.015994000 seconds] [Time delta from previous displayed frame: 7.780645000 seconds] [Time since reference or first frame: 92.241188000 seconds] Frame Number: 479 Frame Length: 919 bytes (7352 bits) Capture Length: 919 bytes (7352 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip:sdp] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6), Dst: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Destination: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 172.16.1.1 (172.16.1.1), Dst: 80.12.12.165 (80.12.12.165) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 905 Identification: 0x906f (36975) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xdcd2 [correct] [Good: True] [Bad: False] Source: 172.16.1.1 (172.16.1.1) Destination: 80.12.12.165 (80.12.12.165) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: winpcs (5060), Dst Port: sip (5060) Source port: winpcs (5060) Destination port: sip (5060) Length: 885 Checksum: 0x78c3 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (INVITE) Request-Line: INVITE sip:0296401610@pcscfgm.orange-obs.fr SIP/2.0 Method: INVITE Request-URI: sip:0296401610@pcscfgm.orange-obs.fr Request-URI User Part: 0296401610 Request-URI Host Part: pcscfgm.orange-obs.fr [Resent Packet: False] Message Header Via: SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK182527ca;rport Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK182527ca RPort: rport Max-Forwards: 70 From: "Max Sauer" ;tag=as05feadfa SIP Display info: "Max Sauer" SIP from address: sip:33296999999@orange-obs.fr SIP from address User Part: 33296999999 SIP from address Host Part: orange-obs.fr SIP from tag: as05feadfa To: SIP to address: sip:0296401610@pcscfgm.orange-obs.fr SIP to address User Part: 0296401610 SIP to address Host Part: pcscfgm.orange-obs.fr Contact: Contact URI: sip:33296999999@111.111.111.111:5060 Contact URI User Part: 33296999999 Contact URI Host Part: 111.111.111.111 Contact URI Host Port: 5060 Call-ID: 0d37d34c33da6e5f1b0f418117761ef0@orange-obs.fr CSeq: 102 INVITE Sequence Number: 102 Method: INVITE User-Agent: FPBX-2.10.1(1.8.15) Date: Wed, 13 Mar 2013 01:11:56 GMT Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH Supported: replaces, timer Content-Type: application/sdp Content-Length: 269 Message Body Session Description Protocol Session Description Protocol Version (v): 0 Owner/Creator, Session Id (o): root 923614593 923614593 IN IP4 111.111.111.111 Owner Username: root Session ID: 923614593 Session Version: 923614593 Owner Network Type: IN Owner Address Type: IP4 Owner Address: 111.111.111.111 Session Name (s): Asterisk PBX 1.8.15-cert1 Connection Information (c): IN IP4 111.111.111.111 Connection Network Type: IN Connection Address Type: IP4 Connection Address: 111.111.111.111 Time Description, active time (t): 0 0 Session Start Time: 0 Session Stop Time: 0 Media Description, name and address (m): audio 40778 RTP/AVP 0 8 101 Media Type: audio Media Port: 40778 Media Protocol: RTP/AVP Media Format: ITU-T G.711 PCMU Media Format: ITU-T G.711 PCMA Media Format: DynamicRTP-Type-101 Media Attribute (a): rtpmap:0 PCMU/8000 Media Attribute Fieldname: rtpmap Media Format: 0 MIME Type: PCMU Sample Rate: 8000 Media Attribute (a): rtpmap:8 PCMA/8000 Media Attribute Fieldname: rtpmap Media Format: 8 MIME Type: PCMA Sample Rate: 8000 Media Attribute (a): rtpmap:101 telephone-event/8000 Media Attribute Fieldname: rtpmap Media Format: 101 MIME Type: telephone-event Sample Rate: 8000 Media Attribute (a): fmtp:101 0-16 Media Attribute Fieldname: fmtp Media Format: 101 [telephone-event] Media format specific parameters: 0-16 Media Attribute (a): ptime:20 Media Attribute Fieldname: ptime Media Attribute Value: 20 Media Attribute (a): sendrecv No. Time Source Destination Protocol Length Info 480 2013-03-13 02:11:56.080582 80.12.12.165 172.16.1.1 SIP 354 Status: 482 Loop Detected | Frame 480: 354 bytes on wire (2832 bits), 354 bytes captured (2832 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:11:56.080582000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137116.080582000 seconds [Time delta from previous captured frame: 0.039631000 seconds] [Time delta from previous displayed frame: 0.039631000 seconds] [Time since reference or first frame: 92.280819000 seconds] Frame Number: 480 Frame Length: 354 bytes (2832 bits) Capture Length: 354 bytes (2832 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00), Dst: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Destination: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 80.12.12.165 (80.12.12.165), Dst: 172.16.1.1 (172.16.1.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xb8 (DSCP 0x2e: Expedited Forwarding; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 1011 10.. = Differentiated Services Codepoint: Expedited Forwarding (0x2e) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 340 Identification: 0x4be6 (19430) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: UDP (17) Header checksum: 0xeb38 [correct] [Good: True] [Bad: False] Source: 80.12.12.165 (80.12.12.165) Destination: 172.16.1.1 (172.16.1.1) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: sip (5060), Dst Port: winpcs (5060) Source port: sip (5060) Destination port: winpcs (5060) Length: 320 Checksum: 0x9d2c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (482) Status-Line: SIP/2.0 482 Loop Detected Status-Code: 482 [Resent Packet: False] [Request Frame: 479] [Response Time (ms): 39] Message Header v:SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK182527ca;rport=50037;received=10.200.112.85 Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK182527ca RPort: 50037 Received: 10.200.112.85 f:"Max Sauer";tag=as05feadfa SIP Display info: "Max Sauer" SIP from address: sip:33296999999@orange-obs.fr SIP from address User Part: 33296999999 SIP from address Host Part: orange-obs.fr SIP from tag: as05feadfa t:;tag=162870119 SIP to address: sip:0296401610@pcscfgm.orange-obs.fr SIP to address User Part: 0296401610 SIP to address Host Part: pcscfgm.orange-obs.fr SIP to tag: 162870119 i:0d37d34c33da6e5f1b0f418117761ef0@orange-obs.fr CSeq:102 INVITE Sequence Number: 102 Method: INVITE l:0 No. Time Source Destination Protocol Length Info 481 2013-03-13 02:11:56.080737 172.16.1.1 80.12.12.165 SIP 477 Request: ACK sip:0296401610@pcscfgm.orange-obs.fr | Frame 481: 477 bytes on wire (3816 bits), 477 bytes captured (3816 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:11:56.080737000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137116.080737000 seconds [Time delta from previous captured frame: 0.000155000 seconds] [Time delta from previous displayed frame: 0.000155000 seconds] [Time since reference or first frame: 92.280974000 seconds] Frame Number: 481 Frame Length: 477 bytes (3816 bits) Capture Length: 477 bytes (3816 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6), Dst: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Destination: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 172.16.1.1 (172.16.1.1), Dst: 80.12.12.165 (80.12.12.165) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 463 Identification: 0x9070 (36976) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xde8b [correct] [Good: True] [Bad: False] Source: 172.16.1.1 (172.16.1.1) Destination: 80.12.12.165 (80.12.12.165) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: winpcs (5060), Dst Port: sip (5060) Source port: winpcs (5060) Destination port: sip (5060) Length: 443 Checksum: 0x8172 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (ACK) Request-Line: ACK sip:0296401610@pcscfgm.orange-obs.fr SIP/2.0 Method: ACK Request-URI: sip:0296401610@pcscfgm.orange-obs.fr Request-URI User Part: 0296401610 Request-URI Host Part: pcscfgm.orange-obs.fr [Resent Packet: False] [Request Frame: 479] [Response Time (ms): 39] Message Header Via: SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK182527ca;rport Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK182527ca RPort: rport Max-Forwards: 70 From: "Max Sauer" ;tag=as05feadfa SIP Display info: "Max Sauer" SIP from address: sip:33296999999@orange-obs.fr SIP from address User Part: 33296999999 SIP from address Host Part: orange-obs.fr SIP from tag: as05feadfa To: ;tag=162870119 SIP to address: sip:0296401610@pcscfgm.orange-obs.fr SIP to address User Part: 0296401610 SIP to address Host Part: pcscfgm.orange-obs.fr SIP to tag: 162870119 Contact: Contact URI: sip:33296999999@111.111.111.111:5060 Contact URI User Part: 33296999999 Contact URI Host Part: 111.111.111.111 Contact URI Host Port: 5060 Call-ID: 0d37d34c33da6e5f1b0f418117761ef0@orange-obs.fr CSeq: 102 ACK Sequence Number: 102 Method: ACK User-Agent: FPBX-2.10.1(1.8.15) Content-Length: 0 No. Time Source Destination Protocol Length Info 2097 2013-03-13 02:14:31.948273 172.16.1.1 80.12.12.165 SIP 725 Request: REGISTER sip:orange-obs.fr | Frame 2097: 725 bytes on wire (5800 bits), 725 bytes captured (5800 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:14:31.948273000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137271.948273000 seconds [Time delta from previous captured frame: 0.286497000 seconds] [Time delta from previous displayed frame: 15.370665000 seconds] [Time since reference or first frame: 248.148510000 seconds] Frame Number: 2097 Frame Length: 725 bytes (5800 bits) Capture Length: 725 bytes (5800 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6), Dst: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Destination: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 172.16.1.1 (172.16.1.1), Dst: 80.12.12.165 (80.12.12.165) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 711 Identification: 0x9075 (36981) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0xdd8e [correct] [Good: True] [Bad: False] Source: 172.16.1.1 (172.16.1.1) Destination: 80.12.12.165 (80.12.12.165) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: winpcs (5060), Dst Port: sip (5060) Source port: winpcs (5060) Destination port: sip (5060) Length: 691 Checksum: 0x6b14 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (REGISTER) Request-Line: REGISTER sip:orange-obs.fr SIP/2.0 Method: REGISTER Request-URI: sip:orange-obs.fr Request-URI Host Part: orange-obs.fr [Resent Packet: False] Message Header Via: SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK76c4b01e;rport Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK76c4b01e RPort: rport Max-Forwards: 70 From: ;tag=as62dd347e SIP from address: sip:+33296999999@orange-obs.fr SIP from address User Part: +33296999999 SIP from address Host Part: orange-obs.fr SIP from tag: as62dd347e To: SIP to address: sip:+33296999999@orange-obs.fr SIP to address User Part: +33296999999 SIP to address Host Part: orange-obs.fr Call-ID: 1bca95b6085ae76977335bfe62e622bd@172.16.1.1 CSeq: 104 REGISTER Sequence Number: 104 Method: REGISTER User-Agent: FPBX-2.10.1(1.8.15) [truncated] Authorization: Digest username="YYYYYYYYYYYY@orange-obs.fr", realm="orange-obs.fr", algorithm=MD5, uri="sip:orange-obs.fr", nonce="1ec2b294513fd1da2621dad155cea8708e104b7ee2ca5ab8d3aa42", response="c447a3d75fb5597998d2b4e59de90 Authentication Scheme: Digest username="YYYYYYYYYYYY@orange-obs.fr" realm="orange-obs.fr" algorithm=MD5 uri="sip:orange-obs.fr" nonce="1ec2b294513fd1da2621dad155cea8708e104b7ee2ca5ab8d3aa42" response="c447a3d75fb5597998d2b4e59de90d31" qop=auth cnonce="73705fd0" nc=00000002 Expires: 3600 Contact: Contact URI: sip:+33296999999@111.111.111.111:5060 Contact URI User Part: +33296999999 Contact URI Host Part: 111.111.111.111 Contact URI Host Port: 5060 Content-Length: 0 No. Time Source Destination Protocol Length Info 2098 2013-03-13 02:14:31.990007 80.12.12.165 172.16.1.1 SIP 375 Status: 200 (1 bindings) | Frame 2098: 375 bytes on wire (3000 bits), 375 bytes captured (3000 bits) WTAP_ENCAP: 1 Arrival Time: Mar 13, 2013 02:14:31.990007000 Paris, Madrid [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1363137271.990007000 seconds [Time delta from previous captured frame: 0.041734000 seconds] [Time delta from previous displayed frame: 0.041734000 seconds] [Time since reference or first frame: 248.190244000 seconds] Frame Number: 2098 Frame Length: 375 bytes (3000 bits) Capture Length: 375 bytes (3000 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:sip] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00), Dst: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Destination: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) Address: 0e:52:31:bd:b3:e6 (0e:52:31:bd:b3:e6) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) Address: Oneacces_e0:4c:00 (00:12:ef:e0:4c:00) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 80.12.12.165 (80.12.12.165), Dst: 172.16.1.1 (172.16.1.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0xb8 (DSCP 0x2e: Expedited Forwarding; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 1011 10.. = Differentiated Services Codepoint: Expedited Forwarding (0x2e) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 361 Identification: 0x20f7 (8439) Flags: 0x02 (Don't Fragment) 0... .... = Reserved bit: Not set .1.. .... = Don't fragment: Set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 56 Protocol: UDP (17) Header checksum: 0x1613 [correct] [Good: True] [Bad: False] Source: 80.12.12.165 (80.12.12.165) Destination: 172.16.1.1 (172.16.1.1) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] User Datagram Protocol, Src Port: sip (5060), Dst Port: winpcs (5060) Source port: sip (5060) Destination port: winpcs (5060) Length: 341 Checksum: 0xa4d9 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Session Initiation Protocol (200) Status-Line: SIP/2.0 200 Status-Code: 200 [Resent Packet: False] [Request Frame: 2097] [Response Time (ms): 41] Message Header v:SIP/2.0/UDP 111.111.111.111:5060;branch=z9hG4bK76c4b01e;rport=50037;received=10.200.112.85 Transport: UDP Sent-by Address: 111.111.111.111 Sent-by port: 5060 Branch: z9hG4bK76c4b01e RPort: 50037 Received: 10.200.112.85 f:;tag=as62dd347e SIP from address: sip:+33296999999@orange-obs.fr SIP from address User Part: +33296999999 SIP from address Host Part: orange-obs.fr SIP from tag: as62dd347e t:;tag=36147 SIP to address: sip:+33296999999@orange-obs.fr SIP to address User Part: +33296999999 SIP to address Host Part: orange-obs.fr SIP to tag: 36147 i:1bca95b6085ae76977335bfe62e622bd@172.16.1.1 CSeq:104 REGISTER Sequence Number: 104 Method: REGISTER m:;expires=300 Contact URI: sip:+33296999999@111.111.111.111:5060 Contact URI User Part: +33296999999 Contact URI Host Part: 111.111.111.111 Contact URI Host Port: 5060 Contact parameter: expires=300\r\n l:0