:0c:f8) Internet Protocol, src: 192.168.129.19 (192.168.129.19), Dst: 192.168.129.166 (192.168.129.166) user Datagram Protocol. src Port: 5060 (5060), Dst Port: 5060 (5060) Session Initiation Protocol Request-Line: INVITE sip:1661110192.168.129.166:5060; transport=udp SIP/2.0 Message Header Record-Route: <sip:192.168.129.19; 1r=on;ftag=St20110000426> via: SIP/2.0/UDP 192.168.129.19;branch=29hG4bk5bc2.12e5bf0: via: SIP/2.0/UDP 192.168.129.50:5060:branch=29hG4bK10000427 From: sip:2351110192.168.129.19>;tag=Stz0110000426 To: <sip:1661110192.168.129.1 call-ID: 972238-100004250192.168.129.50 Cseq: 201 INVITE Max-Forwards: 69 Contact: <sip:2351110192.168.129.50:5060> user-Agent SPT simulator Content-Type: invalidmediabody Content-Length: 20 p-hint usrloc applied Message body PCMA 8000 4200\r\n\r\n 0200 69 6d 75 6C 61 74 of 72 0d oa 43 6f 6e 74 65 6e imulator Conten 6e 76 t-Type: invalid ediabody Conten t-Length : 20..P- hint: us rloc app lied. PCMA 800 0 4200\r N.. RFC 3261: Content-Type Header (sip.Content-Type), 32 bytes P:681 D:4M:0 FIGURE 8.12 Wireshark analysis: Unknown content-type test. V5.2, MGCP, and H.248. It just copies and pastes a hex dump and gets something readable. 8.3.1.3 SIP Analyzer Distributed SIP analyzer [26] is a Web-based analyzer that can (1) capture SIP messages in different subnets (Local Area Network (LAN)) and draw SIP CALL Flow, (2) calculate talking time, call setup time, and (3) compare SIP versions, log SIP sessions. It uses MySQL database to store messages and uses PHP to show the SIP messages. It is an open source freeware. 8.3.1.4 GL Communication GL Communications 27] provides an extensive SIP-based call emulation, SIP call analysis, SIP call trace, and call monitoring. Fully compliant to current SIP standards and latest codecs, this suite of products provides a comprehen- sive set of tools for network testing, monitoring, analysis, and evaluation. 8.3.1.5 Empirix Empirix [28] Hammer Call Analyzer is a tool for VoIP environments. It is VoIP aware, which enables users to quickly visu