SSCA SIP Troubleshooting & Diagnostic Tools 2 — Questions and Answers
Question 1: A SIP INVITE results in a '408 Request Timeout'. What is the most likely cause?
- The callee rejected the call
- The UAS did not respond within the transaction timeout period (Correct answer)
- The SDP body was malformed
- The From header was missing
Correct answer: The UAS did not respond within the transaction timeout period
A 408 Request Timeout indicates that the server did not receive a final response within the allowed transaction timeout period.
Question 2: Which Wireshark display filter would capture only SIP traffic on the standard port?
- sip && tcp.port==5060
- udp.port==5060 || tcp.port==5060 (Correct answer)
- ip.proto==17 && port==5060
- sip.method==INVITE
Correct answer: udp.port==5060 || tcp.port==5060
SIP can run over both UDP and TCP on port 5060, so the correct filter uses both transport protocols.
Question 3: In a SIP trace, you see a CANCEL sent after an INVITE but before a 200 OK. What does this indicate?
- The call was successfully established then torn down
- The UAC abandoned the pending INVITE transaction (Correct answer)
- The UAS rejected the INVITE with a busy signal
- A network error caused the INVITE to be retransmitted
Correct answer: The UAC abandoned the pending INVITE transaction
CANCEL is used by the UAC to abandon an INVITE transaction that has not yet received a final response.
Question 4: What does a '486 Busy Here' response code tell a SIP troubleshooter?
- The proxy could not forward the request
- The specific endpoint is currently busy (Correct answer)
- The user does not exist on the server
- The media negotiation failed
Correct answer: The specific endpoint is currently busy
486 Busy Here means the called endpoint is currently engaged and cannot accept the new call.
Question 5: Which command-line tool is commonly used on Linux to capture SIP packets and save them to a PCAP file for later analysis?
- nmap
- tcpdump (Correct answer)
- traceroute
- netstat
Correct answer: tcpdump
tcpdump is the standard Linux packet capture utility that can filter and save SIP traffic to PCAP files.
Question 6: A SIP phone registers successfully but outbound calls fail with '403 Forbidden'. The most likely issue is:
- DNS resolution failure for the proxy
- The account lacks permission to make outbound calls (Correct answer)
- The SDP offer is using an unsupported codec
- The Contact header is malformed
Correct answer: The account lacks permission to make outbound calls
403 Forbidden indicates the server understood the request but refuses to authorize it, commonly a dial plan or permission restriction.
Question 7: When analyzing a SIP ladder diagram, what does an arrow going from right to left typically represent?
- A request sent from the UAC to the UAS
- A response sent from the UAS back toward the UAC (Correct answer)
- A CANCEL message
- A retransmission
Correct answer: A response sent from the UAS back toward the UAC
In SIP ladder diagrams, responses flow from the called party (right) back to the calling party (left), shown as right-to-left arrows.
SSCA SIP Troubleshooting & Diagnostic Tools 2
A SIP INVITE results in a '408 Request Timeout'.
What is the most likely cause?