The anatomy of a SIP message

Every SIP message you will ever see, no matter how long the trace, is built from the same handful of pieces. Learn to spot them and any raw log becomes readable.

Every message has the same three parts

No matter which SIP message you are looking at, an INVITE, a response, a BYE, it always has the same shape: a start line, a block of headers, a blank line, and then an optional body. Once you can spot these four pieces, any SIP message stops looking like noise.

The start line: what kind of message is this

A request starts with a method and a target, like INVITE sip:alice@example.com SIP/2.0. A response starts with a status line instead, like SIP/2.0 200 OK, using the same three-digit codes covered in the SIP response code reference.

The headers that matter most

Six headers appear in almost every message, and knowing what each one is for makes a raw trace genuinely readable:

• Via records every hop the message has passed through, so a response can find its way back the same way it came.
• From and To identify who is calling and who is being called.
• Call-ID is a unique tag shared by every message belonging to the same call, the thread ID for the whole conversation.
• CSeq numbers each request within a call, so both sides can tell which response answers which request.
• Contact gives the actual address to reach this device directly for the rest of the call.

The body: usually SDP

After a blank line, an INVITE or its 200 OK response usually carries a body describing the proposed call, almost always SDP. The blank line is not decorative, it is the exact marker that tells a parser where the headers end and the body begins.