 parties have established a call; The IP addresses and port numbers associated with the media, allowing eavesdropping. Presence information can reveal even more private information, such as: The user's geographic location; The user's current activity level; SIP: Understanding the Session Initiation Protocol The "mood" or other personal information; As such, strong encryption and privacy mechanisms have been built into SIP that work in both single-domain networks and across the public Internet. The use of intermediary devices such as proxies and B2BUAs also make SIP security very important. SIP supports the encryption of both message bodies and message header fields. The encryption of message bodies makes it more difficult for an eaves- dropper to listen in, if the message body contains SDP information, for exam- ple. Also, an uninvited third party, knowing all the SDP information could guess the RTP SSRC number and send unwanted media to either party, so- called media spamming. Message bodies in presence and instant message mes- sages also contain private information that is only needed by the user agents, not intermediary devices in the network. Encryption can be done hop-by-hop or end-to-end. TLS can be used for the hop-by-hop but only S/MIME [10] allows end-to-end encryption. S/MIME allows UAs to discover if a third part (a proxy or B2BUA) is modifying SIP mes- sages or bodies between them. Note that allowed proxy header field modifica- tion (such as deletion of Via header fields in response routing) is allowed and not considered a security violation. Multicast Support SIP support for UDP multicast has been mentioned in previous sections. There are two main uses for multicast in SIP. SIP registration can be done using multicast, by sending the REGISTER message to the well-known "All SIP Servers" URIsip:sip.mcast.net at IP address 224.0.1.75. The second use for multicast is to send a multicast session invitation. This effectively allows a conference call to be established with a single request. An INVITE with a