SSCA SIP Troubleshooting & Diagnostic Tools 3 — Questions and Answers
Question 1: A SIP call connects audio flows in one direction only. Which protocol layer should be investigated first?
- SIP signaling headers
- RTP/media path and NAT configuration (Correct answer)
- DNS SRV records
- SIP authentication credentials
Correct answer: RTP/media path and NAT configuration
One-way audio is almost always an RTP or NAT problem where media flows correctly in one direction but is blocked or misrouted in the other.
Question 2: What SIP diagnostic tool allows you to send a test OPTIONS message to check if a SIP server is reachable and responsive?
- sngrep
- sipsak (Correct answer)
- tshark
- asterisk -rx
Correct answer: sipsak
sipsak is a command-line SIP Swiss Army knife that can send OPTIONS pings and other SIP requests for testing server reachability.
Question 3: In SIP troubleshooting, what does the Max-Forwards header help diagnose?
- Media codec negotiation failures
- Routing loops or excessive proxy hops (Correct answer)
- Authentication failures
- SDP version mismatches
Correct answer: Routing loops or excessive proxy hops
Max-Forwards decrements at each hop; if it reaches zero, a 483 Too Many Hops error reveals a routing loop or misconfigured proxy chain.
Question 4: Which response code indicates that a SIP proxy could not find the user in any known location database?
- 404 Not Found (Correct answer)
- 480 Temporarily Unavailable
- 486 Busy Here
- 503 Service Unavailable
Correct answer: 404 Not Found
404 Not Found means the requested user does not exist in the domain or the proxy has no record of them.
Question 5: What is the purpose of the 'sngrep' tool in SIP troubleshooting?
- It generates synthetic SIP load for stress testing
- It provides a real-time ncurses-based SIP traffic viewer with call flow diagrams (Correct answer)
- It decrypts TLS-encrypted SIP sessions
- It converts PCAP files to text format
Correct answer: It provides a real-time ncurses-based SIP traffic viewer with call flow diagrams
sngrep is a terminal-based SIP monitor that captures live SIP traffic and displays call flow ladder diagrams in real time.
Question 6: A '401 Unauthorized' response to an INVITE is followed by the same INVITE with credentials. This pattern is called:
- SIP forking
- SIP digest authentication challenge-response (Correct answer)
- SIP redirect
- SIP re-INVITE negotiation
Correct answer: SIP digest authentication challenge-response
SIP uses HTTP-style digest authentication where the server challenges with 401, and the client resends the request with a WWW-Authenticate response.
Question 7: When a SIP REGISTER fails with '423 Interval Too Brief', what should the UAC do?
- Reduce the Contact header expiry value
- Increase the Expires value to meet the server's minimum (Correct answer)
- Retry with a different transport protocol
- Re-authenticate using the realm from the 423 response
Correct answer: Increase the Expires value to meet the server's minimum
423 Interval Too Brief means the requested registration expiry is shorter than the server's minimum; the UAC must use the Min-Expires value from the response.
SSCA SIP Troubleshooting & Diagnostic Tools 3
A SIP call connects audio flows in one direction only.
Which protocol layer should be investigated first?