抓包分析SIP消息

I. 實驗環境

SIP服務器: Yate服務器, IP:port=10.15.3.34:5060

SIP客戶端: 移植Sipdroid的Android網絡電話軟件, IP: 10.15.3.73, Android設備型號: X16 Plus(D3A5)

抓包工具: Wireshark 1.10.0

II. 配置SIP服務器

http://blog.csdn.net/stdupanda/article/details/14165231

III. Wireshark使用

抓包和過濾

保存報文

VI. SIP消息分析

4.1 客戶端註冊請求(無認證信息)

No. Time Source Destination Protocol Length Info
648 38.155145000 10.15.3.73 10.15.3.34 SIP 408 Request: REGISTER sip:10.15.3.34 |

Session Initiation Protocol (REGISTER)

    Request-Line: REGISTER sip:10.15.3.34 SIP/2.0

Message Header
Via: SIP/2.0/UDP 10.15.3.73:5060;rport;branch=z9hG4bK52751
Max-Forwards: 70
To: <sip:123@10.15.3.34>
From: <sip:123@10.15.3.34>;tag=z9hG4bK02183212
Call-ID: 508230833273@10.15.3.73
CSeq: 1 REGISTER
Contact: <sip:123@10.15.3.73:5060;transport=udp>
Expires: 3600
User-Agent: Sipdroid/1.0.0/X16 Plus(D3A5)

(無認證信息)Authorization: Digest username="987", realm="Yate", nonce="b05a6e1b63dcb24c83bf00d28ead4a22.1482820854", uri="sip:10.15.3.34", algorithm=MD5, response="21bcb75b30f1e75307d1e3338721fa87"

Content-Length: 0 

 

4.2 註冊異常, port錯誤

找到不到端口屬於ICMP協議,不是SIP的內容, 可是包含了該SIP請求

No. Time Source Destination Protocol Length Info
663 38.286045000 10.15.3.34 10.15.3.73 ICMP 436 Destination unreachable (Port unreachable)

Internet Control Message Protocol

 Type: 3 (Destination unreachable) Code: 3 (Port unreachable)
    Checksum: 0x190d [correct]
    Internet Protocol Version 4, Src: 10.15.3.73 (10.15.3.73), Dst: 10.15.3.34 (10.15.3.34)
    User Datagram Protocol, Src Port: sip (5060), Dst Port: 50696 (50696)
    Session Initiation Protocol (REGISTER)
        Request-Line: REGISTER sip:10.15.3.34 SIP/2.0
        Message Header
            Via: SIP/2.0/UDP 10.15.3.73:5060;rport;branch=z9hG4bK52751
            Max-Forwards: 70
            To: <sip:123@10.15.3.34>
            From: <sip:123@10.15.3.34>;tag=z9hG4bK02183212
            Call-ID: 508230833273@10.15.3.73
            CSeq: 1 REGISTER
            Contact: <sip:123@10.15.3.73:5060;transport=udp>
            Expires: 3600
            User-Agent: Sipdroid/1.0.0/X16 Plus(D3A5)
            Content-Length: 0

 

4.3 註冊失敗, 未認證 

No.     Time      Source       Destination   Protocol  Length Info
403 26.643950000   10.15.3.34   10.15.3.73    SIP      505 Status: 401 Unauthorized (0 bindings) | 

Session Initiation Protocol (401)
    Status-Line: SIP/2.0 401 Unauthorized
    Message Header
        Via: SIP/2.0/UDP 10.15.3.73:5060;rport=5060;branch=z9hG4bK52571;received=10.15.3.73
        From: <sip:987@10.15.3.34>;tag=z9hG4bK59485601
        To: <sip:987@10.15.3.34>
        Call-ID: 421848292740@10.15.3.73
        CSeq: 1 REGISTER
        WWW-Authenticate: Digest realm="Yate", nonce="b05a6e1b63dcb24c83bf00d28ead4a22.1482820854", stale=FALSE, algorithm=MD5
        Server: YATE/5.5.0
        Allow: ACK, INVITE, BYE, CANCEL, REGISTER, REFER, OPTIONS, INFO
        Content-Length: 0

4.4 響應型應答1xx: 收到消息, 正在處理...

No.     Time         Source      Destination     Protocol Length Info
407 26.684087000   10.15.3.34    10.15.3.73       SIP      314    Status: 100 Trying (0 bindings) | 
 Session Initiation Protocol (100)  Status-Line: SIP/2.0 100 Trying Message Header Via: SIP/2.0/UDP 10.15.3.73:5060;rport=5060;branch=z9hG4bK92670;received=10.15.3.73 From: <sip:987@10.15.3.34>;tag=z9hG4bK59485601 To: <sip:987@10.15.3.34> Call-ID: 421848292740@10.15.3.73 CSeq: 2 REGISTER Server: YATE/5.5.0 Content-Length: 0

 

4.5 確認型應答2xx: 添加認證後從新發送註冊請求, 註冊成功

No.     Time        Source        Destination     Protocol Length Info
409 26.689106000   10.15.3.34      10.15.3.73      SIP      468 Status: 200 OK (1 bindings) | 

Session Initiation Protocol (200)
    Status-Line: SIP/2.0 200 OK
    Message Header
        Via: SIP/2.0/UDP 10.15.3.73:5060;rport=5060;branch=z9hG4bK92670;received=10.15.3.73
        From: <sip:987@10.15.3.34>;tag=z9hG4bK59485601
        To: <sip:987@10.15.3.34>;tag=1266873868
        Call-ID: 421848292740@10.15.3.73
        CSeq: 2 REGISTER
        Expires: 3600
        Contact: <sip:987@10.15.3.73:5060;transport=udp>;expires=3600
        Server: YATE/5.5.0
        Allow: ACK, INVITE, BYE, CANCEL, REGISTER, REFER, OPTIONS, INFO
        Content-Length: 0

V. UserAgent和SIP消息

/*SIP消息body相關*/
public String from_url = null;    //User的地址, 和From URL等價
public String contact_url = null; //聯繫人URL, 格式爲: sip:local_user@host_address:host_port
public String realm = null;
public String passwd = null;

/*註冊狀態相關*/
public boolean do_register = false;       //是否註冊到註冊服務器
public boolean do_unregistered = false;   //是否註銷了聯繫人地址
public boolean do_unregister_all = false; //向服務器註冊前是否註銷了全部聯繫人

/*註冊超時和TCP鏈接保活(非應用層的心跳包)*/
public int expires = 3600;         //註冊超時時間
public long keepalive_time = 0;    //默認爲0, 使能客戶端和註冊服務器之間TCP鏈接的自動保活功能

/*通話控制相關*/
public int accept_time = -1;       //自動應答時間, <0爲手動設置模式
public int hangup_time = -1;       //自動掛斷時間, <0爲手動設置模式
public int transfer_time = -1;     //呼叫無應答自動呼叫轉移時間, <0爲無自動呼叫轉移

/*音視頻相關*/
public int audio_prot = 21000;
public int[] audio_codecs = {3, 8, 0};
public int audio_sample_rate = 8000;
public int video_port = 21070;
public int video_avp = 103;

/*參數初始化相關方法*/
public UserAgentProfile(String file); //從file中初始化UserAgentProfile
public void init();                   //根據contact_url初始化realm, username, call_to等變量
//根據sip_provider初始化contact_url, 包括getViaAddress(), getPort(), getDefaultTransport()
public void initContactAddress(SipProvider sip_provider);