[root@H2 ~]# tcpdump -Ann -s 0 -i eth0 host sip.zadarma.com and port 5060
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
14:20:02.874416 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 630
E...s...@..NO.."%.&......~5.REGISTER sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK43910965
Max-Forwards: 70
From: <sip:880400@sip.zadarma.com>;tag=as6674c899
To: <sip:880400@sip.zadarma.com>
Call-ID: 3173b5c337ff29bb5d6b14672dc659be@[::1]
CSeq: 105 REGISTER
Supported: replaces, timer
User-Agent: Hive
Authorization: Digest username="880400", realm="sip.zadarma.com", algorithm=MD5, uri="sip:sip.zadarma.com", nonce="WnmPvFp5jpDh6WDFLtaRRXiWkXH+ewk8", response="f3fb30566a01634520e1b1f80c255630", qop=auth, cnonce="674f9b24", nc=00000003
Expires: 120
Contact: <sip:880400@79.170.152.34:5060>
Content-Length: 0


14:20:02.894890 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 382
E.......<..?%.&.O.."........SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK43910965;rport=5060
From: <sip:880400@sip.zadarma.com>;tag=as6674c899
To: <sip:880400@sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.1de7
Call-ID: 3173b5c337ff29bb5d6b14672dc659be@[::1]
CSeq: 105 REGISTER
Contact: <sip:880400@79.170.152.34:5060>;expires=120
Server: Zadarma server
Content-Length: 0


14:20:14.790928 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 824
E..Ts...@...O.."%.&......@6.INVITE sip:89154551495@sip.zadarma.com:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK1e9c3b5f
Max-Forwards: 70
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>
Contact: <sip:16479459704@79.170.152.34:5060>
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 102 INVITE
User-Agent: Hive
Date: Tue, 06 Feb 2018 11:20:14 GMT
Min-SE: 1200
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Type: application/sdp
Content-Length: 226

v=0
o=root 1484914389 1484914389 IN IP4 79.170.152.34
s=Hive
c=IN IP4 79.170.152.34
t=0 0
m=audio 12466 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=maxptime:150
a=sendrecv

14:20:14.852302 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 345
E..u....<..c%.&.O..".....a..SIP/2.0 100 trying -- your call is important to us
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK1e9c3b5f;rport=5060
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 102 INVITE
Server: Zadarma server
Content-Length: 0


14:20:15.889490 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 796
E..8....<...%.&.O..".....$..SIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;rport=5060;branch=z9hG4bK1e9c3b5f
Record-Route: <sip:37.139.38.17;lr=on;ftag=as206db1af>
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>;tag=as75a4a8a6
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 102 INVITE
Server: Zadarma Voip
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces
Contact: <sip:89154551495@37.139.38.64:5060>
Content-Type: application/sdp
Content-Length: 226

v=0
o=root 810423470 810423470 IN IP4 37.139.38.64
s=Zadarma Voip
c=IN IP4 37.139.38.64
t=0 0
m=audio 16460 RTP/AVP 8 101
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=ptime:20
a=sendrecv

14:20:15.892628 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 449
E...s...@...O.."%.&.......5CACK sip:89154551495@37.139.38.64:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK4f34ad6a
Route: <sip:37.139.38.17;lr=on;ftag=as206db1af>
Max-Forwards: 70
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>;tag=as75a4a8a6
Contact: <sip:16479459704@79.170.152.34:5060>
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 102 ACK
User-Agent: Hive
Content-Length: 0


14:20:18.195966 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 531
E../s...@...O.."%.&.......5.OPTIONS sip:sip.zadarma.com SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK36f0fdab
Max-Forwards: 70
From: "asterisk" <sip:16479459704@79.170.152.34>;tag=as0c1fd6c3
To: <sip:sip.zadarma.com>
Contact: <sip:16479459704@79.170.152.34:5060>
Call-ID: 5a9ae4047d8aa83743d5ad920e7ff71b@79.170.152.34:5060
CSeq: 102 OPTIONS
User-Agent: Hive
Date: Tue, 06 Feb 2018 11:20:18 GMT
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces, timer
Content-Length: 0


14:20:18.198818 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 402
E.......<..(%.&.O..".......lSIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK36f0fdab
From: "asterisk" <sip:16479459704@79.170.152.34>;tag=as0c1fd6c3
To: <sip:sip.zadarma.com>;tag=6d8afd3ee9eed615c4ab8afe931d20cf.50e3
Call-ID: 5a9ae4047d8aa83743d5ad920e7ff71b@79.170.152.34:5060
CSeq: 102 OPTIONS
Accept: */*
Accept-Encoding:
Accept-Language: en
Supported:
Server: Zadarma server
Content-Length: 0


14:20:18.728393 IP 79.170.152.34.5060 > 37.139.38.17.5060: SIP, length: 475
E...s...@...O.."%.&.......5]BYE sip:89154551495@37.139.38.64:5060 SIP/2.0
Via: SIP/2.0/UDP 79.170.152.34:5060;branch=z9hG4bK6474d116
Route: <sip:37.139.38.17;lr=on;ftag=as206db1af>
Max-Forwards: 70
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>;tag=as75a4a8a6
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 103 BYE
User-Agent: Hive
X-Asterisk-HangupCause: Normal Clearing
X-Asterisk-HangupCauseCode: 16
Content-Length: 0


14:20:18.738823 IP 37.139.38.17.5060 > 79.170.152.34.5060: SIP, length: 432
E.......<..     %.&.O.."......FiSIP/2.0 200 OK
Via: SIP/2.0/UDP 79.170.152.34:5060;rport=5060;branch=z9hG4bK6474d116
From: <sip:16479459704@sip.zadarma.com>;tag=as206db1af
To: <sip:89154551495@sip.zadarma.com:5060>;tag=as75a4a8a6
Call-ID: 4bb98d781eb6f1d73f641b10176f5d8b@sip.zadarma.com
CSeq: 103 BYE
Server: Zadarma Voip
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces
Content-Length: 0