How to View Twilio SIP Call Packet Captures (PCAPs) – Twilio Support

Objective

Twilio posts packet captures (.pcap files) for calls placed and received with Elastic SIP Trunking, and SIP Domains. This guide will walk you through viewing these packet captures for your calls.

Product

SIP Calling

Environment

legacy Twilio Console

Procedure

Download Twilio SIP Call Packet Captures

Access the Call Logs page in Twilio Console.
Navigate to and click the desired SIP call.
Click the "SIP PCAP LOG" Download link.

View Packet Captures

Once downloaded, your packet capture file can be examined with software that supports .pcap files. Some examples include Wireshark, tcpdump, and more. PCAPs are retained in the Console for a maximum of 14 days and can be downloaded during this period.

Outbound Calls (SIP Termination): Your pcap should show a SIP INVITE from your SIP infrastructure (PBX, SBC, Proxy, etc.) or SIP phone IP address to Twilio. One of Twilio's SIP signaling IPs should respond back. A successfully connected call should generate a 200 OK response.

Incoming Calls (SIP Origination): Your pcap hsould show a SIP INVITE from one of Twilio's SIP signaling IPs. Your SIP infrastructure (PBX, SBC, Proxy, etc.) or SIP phone IP should respond back. A successfully connected call should generate a 200 OK response.

For a more in-depth explanation of how SIP connections work, please see the following resources:

Note: When TLS or TCP is enabled, you will no longer be able to view the SIP signaling packets in the PCAP captures within the Call Logs section.

Common Response Codes

The following table contains common SIP response codes for calls that do not complete.

SIP Response	Message	Description
401 Unauthorized 407 Proxy Authentication Required	The request requires user authentication.	These responses should be automatically responded to with an ACK and another INVITE that includes the required credentials. If not, verify your SIP Trunk or Domain credentials are correct.
403 Forbidden	The request can't be fulfilled.	Request is valid, but the destination may have rejected or blocked the incoming call. Have the callee check their side to make sure calls aren't blocked.
404 Not Found	The destination doesn't exist, or can't be found.	The destination number may not be valid, or not in service. Double check the destination number.
480 Temporarily Unavailable	The destination is currently unavailable.	The destination number is not answering, or unable to answer. They may be out of service, roaming, or not accepting calls. Often seen when calling wireless phones that don't answer and don't have voicemail. Can also occur when a carrier flags a number for spam and rejects the calls.
486 Busy Here	The destination is busy.	The destination number is returning a busy signal. Try again later.

Additional Information

More information on SIP response codes can be found at the following resources: