On this website, it says that

  1. This shows the source and destination IP addresses of the SIP packet. Note this information will change as the packet passes between SIP proxy servers.

I'm confused as to why this is so. I'm guessing the IP addresses are replaced by the current and next proxy server's IP addresses from hop-to-hop. Why is there a need to change the SIP packet's IP addresses as it gets forwarded from one end-point to another?

Why is it not treated as a typical packet where the source and destination IP addresses remain the same, but the routers are the ones doing the routing based on the destination IP address?

closed as off-topic by Ron Maupin Jul 20 '16 at 14:59

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, questions about protocols above OSI layer-4, e.g. SIP (an application signalling protocol), are explicitly off-topic here, as are questions about servers, e.g. proxy servers. – Ron Maupin Jul 20 '16 at 14:59

You are correct, the IP addresses will be replaced by the sending and receiving SIP proxy server IP address for that leg of session, although this isn't NAT as they are actually separate IP/UDP sessions.

SIP packets aren't treated any differently by routers, and if a packet needs to be routed between networks it will be forwarded with the source and destination IPs unchanged. SIP proxy servers are not IP routers though. SIP is just another application layer protocol transported over IP/UDP

When a SIP proxy server makes a routing decision it is actually looking at the destination SIP address (5) and not the IP destination address.

The client opens a UDP session to the first SIP proxy using its IP address as the source and SIP proxy server's IP address as the destination. The UDP payload is the SIP application layer traffic. The proxy server makes a SIP routing decision (different to IP routing) and opens a UDP session to the next SIP server and forwards the SIP traffic within that session. The IP and UDP layers for each leg are unique, but the SIP session end-to-end has the same SIP session ID and therefore is the same.

The proxy function becomes quite useful when making calls between organisations. Without the proxy server each organisation would have to have full routing information for each other's address space to make an end-to-end connection. There will likely be overlap so complicated NATs are required, which would also have to understand the SIP protocol to change any address at the application layer. With SIP proxy servers sat on the edge of each organisation the internal address space can be hidden. Clients only have to route to the SIP proxy server to reach any IP within that organisation.


Unless there is NAT in the source-destination path there won't be a change of source or destination adddress in the fields marked as 1 in the wireshark trace shown.

Proxy servers don't modify those fields, only NAT-enabled devices can modify source /destination addresses and ports.

Not the answer you're looking for? Browse other questions tagged or ask your own question.