SSCA SIP Troubleshooting & Diagnostic Tools 2

Question 1

A SIP INVITE results in a '408 Request Timeout'. What is the most likely cause?

Accepted Answer

The UAS did not respond within the transaction timeout period

Answer

A 408 Request Timeout indicates that the server did not receive a final response within the allowed transaction timeout period.

Question 2

Which Wireshark display filter would capture only SIP traffic on the standard port?

Accepted Answer

udp.port==5060 || tcp.port==5060

Answer

SIP can run over both UDP and TCP on port 5060, so the correct filter uses both transport protocols.

Question 3

In a SIP trace, you see a CANCEL sent after an INVITE but before a 200 OK. What does this indicate?

Accepted Answer

The UAC abandoned the pending INVITE transaction

Answer

CANCEL is used by the UAC to abandon an INVITE transaction that has not yet received a final response.

Question 4

What does a '486 Busy Here' response code tell a SIP troubleshooter?

Accepted Answer

The specific endpoint is currently busy

Answer

486 Busy Here means the called endpoint is currently engaged and cannot accept the new call.

Question 5

Which command-line tool is commonly used on Linux to capture SIP packets and save them to a PCAP file for later analysis?

Accepted Answer

tcpdump

Answer

tcpdump is the standard Linux packet capture utility that can filter and save SIP traffic to PCAP files.

(SSCA) Sip School Certified Associate Practice Test