I am currently working on a project that collect a users login and extension information through parsing SIP header messages after capturing packets. I am currently using PCAP.net and SIPSorcery libraries to accomplish this. The project is written in C#
How it works: By using filters in PCAP.net I can zone in on the SIP related traffic. Each time a packet is captured an event is fired and I check for the packet type e.g. whether it is SIP or something else UDP related such as DNS. If this is a SIP message I parse the header pulling out the information I am interested in
The problem: Some SIP endpoints generates multiple registration packets which contains the same UID. It is hard to keep track of a single session and when the endpoint is actually finally registered (i.e. receives the 200OK from the SIP Server). I tried using Dictionary with CallID and then checking when a packet is received if it is already in the Dictionary.
The question: How do I keep track the session so I know when I receive the 200OK for that particular session, it is registered and stream is complete
A SIP endpoint sends a REGISTER request to bind its contact address(es) to an address-of-record. Such a registration is identified by the Call-ID header field.
Keep in mind that multiple REGISTER requests with the same Call-ID value can occur because:
Furthermore, a 200 response doesn't mean that the endpoint is registered. You should check the 'expires' header and/or contact parameter to know how long the registration will remain valid.