[root@H2 ~]# tcpdump -Ann -s 0 -i eth0 host sip.zadarma.com
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:13:31.004084 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 822
E`.R.|..@..VO.."%.&......>6.INVITE sip:74957852929@sip.zadarma.com:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK506787b7
Max-Forwards: 70
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>
Contact: <sip:83472242301@79.170.152.34:5060>
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 102 INVITE
User-Agent: Hive
Date: Fri, 18 Jan 2019 10:13:31 GMT
Min-SE: 1200
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Type: application/sdp
Content-Length: 224

v=0
o=root 788906207 788906207 IN IP4 79.170.152.34
s=Hive
c=IN IP4 79.170.152.34
t=0 0
m=audio 17474 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=maxptime:150
a=sendrecv

13:13:31.011845 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 345
E..u....<.8.%.&.O..".....aqBSIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK506787b7;rport=5060
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 102 INVITE
Server: Zadarma server
Content-Length: 0


13:13:33.727490 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 542
E..:....<.8%%.&.O..".....&=.SIP/2.0 180 Ringing
Via: SIP/2.0/UDP 79.170.152.34:5060;rport=5060;branch=z9hG4bK506787b7
Record-Route: <sip:37.139.38.17;lr=on;ftag=as678c29b4>
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>;tag=as02625c48
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 102 INVITE
Server: Zadarma Voip
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces
Contact: <sip:74957852929@37.139.38.25:5060>
Content-Length: 0


13:13:34.329246 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 798
E..:....<.7$%.&.O..".....&..SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;rport=5060;branch=z9hG4bK506787b7
Record-Route: <sip:37.139.38.17;lr=on;ftag=as678c29b4>
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>;tag=as02625c48
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 102 INVITE
Server: Zadarma Voip
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces
Contact: <sip:74957852929@37.139.38.25:5060>
Content-Type: application/sdp
Content-Length: 228

v=0
o=root 1317917417 1317917417 IN IP4 37.139.38.25
s=Zadarma Voip
c=IN IP4 37.139.38.25
t=0 0
m=audio 11882 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=sendrecv

13:13:34.329991 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 449
E`...}..@...O.."%.&.......5CACK sip:74957852929@37.139.38.25:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK2e5ed263
Route: <sip:37.139.38.17;lr=on;ftag=as678c29b4>
Max-Forwards: 70
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>;tag=as02625c48
Contact: <sip:83472242301@79.170.152.34:5060>
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 102 ACK
User-Agent: Hive
Content-Length: 0


13:13:34.412281 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 517
5.OPTIONS sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK51ff079c
Max-Forwards: 70
From: "asterisk" <sip:1234@79.170.152.34>;tag=as556d84b0
To: <sip:sip.zadarma.com>
Contact: <sip:1234@79.170.152.34:5060>
Call-ID: 75c9a8fd1b569ba077a778057b8b6465@79.170.152.34:5060
CSeq: 102 OPTIONS
User-Agent: Hive
Date: Fri, 18 Jan 2019 10:13:34 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


13:13:34.415232 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 406
E.......<.8.%.&.O.."......]$SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK51ff079c;rport=5060
From: "asterisk" <sip:1234@79.170.152.34>;tag=as556d84b0
To: <sip:sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.3e45
Call-ID: 75c9a8fd1b569ba077a778057b8b6465@79.170.152.34:5060
CSeq: 102 OPTIONS
Accept: */*
Accept-Encoding:
Accept-Language: en
Supported:
Server: Zadarma server
Content-Length: 0


13:13:37.676994 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 630
E`......@...O.."%.&......~5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK4d29ccfc
Max-Forwards: 70
From: <sip:880400@sip.zadarma.com>;tag=as71f01707
To: <sip:880400@sip.zadarma.com>
Call-ID: 463bc8157c0df1ba767b480179224486@[::1]
CSeq: 193 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="880400", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="XEGnK1xBpf91AlxIUTRHQBFDAw1wyVpg", response="f532aa03a0a0b855d340d91b40070a6b", qop=auth, cnonce="4a5b143c", nc=00000003
Expires: 120
Contact: <sip:880400@79.170.152.34:5060>
Content-Length: 0


13:13:37.677612 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 630
E`......@...O.."%.&......~5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK415e6c51
Max-Forwards: 70
From: <sip:800954@sip.zadarma.com>;tag=as2260bb07
To: <sip:800954@sip.zadarma.com>
Call-ID: 523e05391cbcfba841093ad76b97c4d2@[::1]
CSeq: 193 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="800954", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="XEGnK1xBpf91AlxIUTRHQBFDAw1wyVpg", response="bd599b5e2903e87e0798b49a64d64a57", qop=auth, cnonce="76664bb2", nc=00000003
Expires: 120
Contact: <sip:800954@79.170.152.34:5060>
Content-Length: 0


13:13:37.682200 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 382
E.......<.8.%.&.O.."........SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK4d29ccfc;rport=5060
From: <sip:880400@sip.zadarma.com>;tag=as71f01707
To: <sip:880400@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.5085
Call-ID: 463bc8157c0df1ba767b480179224486@[::1]
CSeq: 193 REGISTER
Contact: <sip:880400@79.170.152.34:5060>;expires=120
Server: Zadarma server
Content-Length: 0


13:13:37.682674 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 382
E.......<.8.%.&.O.."......).SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK415e6c51;rport=5060
From: <sip:800954@sip.zadarma.com>;tag=as2260bb07
To: <sip:800954@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.3a7f
Call-ID: 523e05391cbcfba841093ad76b97c4d2@[::1]
CSeq: 193 REGISTER
Contact: <sip:800954@79.170.152.34:5060>;expires=120
Server: Zadarma server
Content-Length: 0


13:13:40.030859 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 631
E`......@...O.."%.&.......5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK151face7
Max-Forwards: 70
From: <sip:800954@sip.zadarma.com>;tag=as6d1989fa
To: <sip:800954@sip.zadarma.com>
Call-ID: 242707e33628863561f727a346518325@[::1]
CSeq: 1039 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="800954", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="XEGmxFxBpZjF5DgWegAPKaS3E6dYJ8Uj", response="13d75fbd182c237afd9252b1f5048e8b", qop=auth, cnonce="26d0b94c", nc=00000004
Expires: 120
Contact: <sip:800954@79.170.152.34:5060>
Content-Length: 0


13:13:40.031980 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 630
E`......@...O.."%.&......~5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK179fdf18
Max-Forwards: 70
From: <sip:800954@sip.zadarma.com>;tag=as5b94c4a5
To: <sip:800954@sip.zadarma.com>
Call-ID: 3861f3731ef9135d259047d73e24d926@[::1]
CSeq: 197 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="800954", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="XEGnl1xBpmsut4YE22Yrm4RQXYXZMWm5", response="6b3053d6bd2433e31be71ab7a7e5dcd3", qop=auth, cnonce="55fdafa6", nc=00000002
Expires: 120
Contact: <sip:800954@79.170.152.34:5060>
Content-Length: 0


13:13:40.036182 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 443
E.......<.8.%.&.O.."......nNSIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK151face7;rport=5060
From: <sip:800954@sip.zadarma.com>;tag=as6d1989fa
To: <sip:800954@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.2263
Call-ID: 242707e33628863561f727a346518325@[::1]
CSeq: 1039 REGISTER
WWW-Authenticate: Digest realm="sip.zadarma.com", nonce="XEGoAFxBptTMY7c9Nbi3yrjTZlLX5szB", qop="auth"
Server: Zadarma server
Content-Length: 0


13:13:40.037064 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 631
E`......@...O.."%.&.......5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK75cc8eff
Max-Forwards: 70
From: <sip:800954@sip.zadarma.com>;tag=as6d1989fa
To: <sip:800954@sip.zadarma.com>
Call-ID: 242707e33628863561f727a346518325@[::1]
CSeq: 1040 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="800954", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="XEGoAFxBptTMY7c9Nbi3yrjTZlLX5szB", response="e7d2687a3187b1632c08430347c49cae", qop=auth, cnonce="0fe18869", nc=00000001
Expires: 120
Contact: <sip:800954@79.170.152.34:5060>
Content-Length: 0


13:13:40.046202 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 382
E.......<.8.%.&.O.."........SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK179fdf18;rport=5060
From: <sip:800954@sip.zadarma.com>;tag=as5b94c4a5
To: <sip:800954@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.b4b3
Call-ID: 3861f3731ef9135d259047d73e24d926@[::1]
CSeq: 197 REGISTER
Contact: <sip:800954@79.170.152.34:5060>;expires=120
Server: Zadarma server
Content-Length: 0


13:13:40.051447 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 383
E.......<.8.%.&.O.."......A.SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK75cc8eff;rport=5060
From: <sip:800954@sip.zadarma.com>;tag=as6d1989fa
To: <sip:800954@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.836d
Call-ID: 242707e33628863561f727a346518325@[::1]
CSeq: 1040 REGISTER
Contact: <sip:800954@79.170.152.34:5060>;expires=120
Server: Zadarma server
Content-Length: 0


13:13:43.280800 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 531
E`./....@..qO.."%.&.......5.OPTIONS sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK42d7ce0b
Max-Forwards: 70
From: "asterisk" <sip:83472242301@79.170.152.34>;tag=as652c1aaf
To: <sip:sip.zadarma.com>
Contact: <sip:83472242301@79.170.152.34:5060>
Call-ID: 1e4f698c7f8cf9cf23b3f0c84a30ba9e@79.170.152.34:5060
CSeq: 102 OPTIONS
User-Agent: Hive
Date: Fri, 18 Jan 2019 10:13:43 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


13:13:43.283795 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 413
E.......<.8.%.&.O.."........SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK42d7ce0b;rport=5060
From: "asterisk" <sip:83472242301@79.170.152.34>;tag=as652c1aaf
To: <sip:sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.35b0
Call-ID: 1e4f698c7f8cf9cf23b3f0c84a30ba9e@79.170.152.34:5060
CSeq: 102 OPTIONS
Accept: */*
Accept-Encoding:
Accept-Language: en
Supported:
Server: Zadarma server
Content-Length: 0


13:13:51.071207 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 475
E`......@...O.."%.&.......5]BYE sip:74957852929@37.139.38.25:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK70b35c96
Route: <sip:37.139.38.17;lr=on;ftag=as678c29b4>
Max-Forwards: 70
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>;tag=as02625c48
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 103 BYE
User-Agent: Hive
X-Asterisk-HangupCause: Normal Clearing
X-Asterisk-HangupCauseCode: 16
Content-Length: 0


13:13:51.075479 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 432
E.......<.8.%.&.O.."........SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;rport=5060;branch=z9hG4bK70b35c96
From: <sip:83472242301@sip.zadarma.com>;tag=as678c29b4
To: <sip:74957852929@sip.zadarma.com:5060>;tag=as02625c48
Call-ID: 2c2b07c423acec801b84edde67b56986@sip.zadarma.com
CSeq: 103 BYE
Server: Zadarma Voip
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces
Content-Length: 0


^C
21 packets captured
82 packets received by filter
27 packets dropped by kernel