Session Initiation Protocol: Call Flow, Ports and Security

SIP sets up, changes and tears down media sessions. It does not carry the audio or video itself — that is RTP's job. Keeping those two separate is the single most useful thing to understand about voice over IP, because almost every troubleshooting question and every security question turns on it.

Signalling and Media Are Different Streams

SIP negotiates. RTP delivers. They use different ports, frequently take different paths through the network, and fail independently.

That independence produces the classic symptom: the phone rings, someone answers, and neither side hears anything. Signalling worked, media did not. The fault is almost always a firewall or NAT device permitting SIP on port 5060 while dropping the dynamically negotiated RTP ports.

The Call Flow

A basic call is worth memorizing as a sequence:

1. INVITE — the caller requests a session, carrying an SDP body describing the codecs and the address it wants media sent to.
2. 100 Trying — the next hop acknowledges it is working on it.
3. 180 Ringing — the callee's phone is alerting.
4. 200 OK — the callee answered, with its own SDP answer.
5. ACK — the caller confirms. The session is established and RTP begins.
6. BYE — either party ends the call, answered with 200 OK.

The response codes follow HTTP conventions closely, because SIP was deliberately modelled on HTTP: 1xx provisional, 2xx success, 3xx redirection, 4xx client error (401 Unauthorized, 486 Busy Here, 404 Not Found), 5xx server error, 6xx global failure.

SDP — the Session Description Protocol — is the payload inside INVITE and 200 OK that actually negotiates codecs, ports and media direction. SIP moves it; SDP decides what the media will be.

The Components

• User agent — the endpoint, a phone or softphone, acting as client when originating and server when receiving.
• Proxy server — routes requests toward their destination.
• Registrar — records where a user is currently reachable, via REGISTER.
• Redirect server — returns a new location rather than forwarding.
• Back-to-back user agent — terminates and re-originates the call, which is how session border controllers insert themselves into the path.

Ports and Transport

SIP uses 5060 for unencrypted signalling over UDP or TCP, and 5061 for SIP over TLS. RTP uses a dynamic even-numbered UDP range, conventionally 16384 to 32767, with RTCP on the odd port above each.

These are worth committing to memory alongside the other exam port numbers, since SIP appears in both Network+ and Security+ questions.

Over UDP, signalling can be protected with DTLS rather than TLS.

Security Problems

Unencrypted SIP is plain text on the wire. Anyone who can capture it reads the numbers dialled, the extensions, and the digest authentication exchange. Captured RTP can be reassembled into audio with ordinary tools.

The recurring attacks:

• Toll fraud — registering as a legitimate extension and placing expensive international calls. Usually the result of default or weak SIP credentials.
• Registration hijacking — a forged REGISTER redirects a victim's calls to the attacker.
• Eavesdropping — capture and replay of unencrypted RTP.
• SIP flooding — INVITE or REGISTER floods exhausting the proxy.
• Caller ID spoofing — trivially set in the From header, which is what makes vishing convincing.

Controls

Encrypt signalling with SIP over TLS on 5061 and media with SRTP; the two are separate settings and enabling one without the other is a common misconfiguration. Put voice on its own VLAN so an ordinary workstation cannot reach the call manager. Deploy a session border controller at the SIP trunk boundary for topology hiding and rate limiting. Enforce strong per-device credentials rather than shared ones, and restrict international dialling by policy so that a successful intrusion is not also an immediate financial loss.

Exam Focus

Know 5060 and 5061. Know SIP signals while RTP carries media. Know SDP negotiates codecs inside SIP messages. Given one-way or no audio with a call that connects, answer that RTP is being blocked. Given toll fraud, answer weak SIP authentication. And know SRTP protects media while TLS protects signalling — a question naming only one of them is usually testing whether you notice the other is missing.