Why did the user phone send a BYE.

[Sean Devoy]

I have reviewed my pcap file MANY times.  I have a FAILED call and a GOOD call from the same extension.  I will attempt you list the signaling below.
One oddity that jumps out at me, there are no SIP 183 packets in the call that WORKED.

It is clear that the user is hanging up, but they state the call rings 4 times, then goes to busy. The tshark command I am using is:
tshark -f "port 5060" -i any -w capturefile.pcap

How can I include RTP messages?  Will that let me see if there is early media, then busy or failure?


Call that failed signaling:
U is the User extension behind NAT.
FS is the server with public IP.
GW is gateway with public IP  (Voip Innovations).

U-> FS     INVITE
FS->U        AUTH REQ
U->FS        Request: ACK
U->FS        INVITE
FS->U       Trying
FS->GW    INVITE
GW->FS    TRYING
U->FS        Status 200
GW->FS    Status:  183 Session Progress
FS->U        Status:  183 Session Progress

1/10 Second Later
GW->FS    Status:  183 Session Progress

21 Seconds Later
GW->FS    Status:  183 Session Progress
GW->FS    Status: 200
FS->GW    Request: ACK
FS->U        Status 200
U->FS        Request ACK
FS->U        Request: UPDATE
U->FS        Status 200

3 Seconds Later   -  26 seconds total
U->FS        BYE
FS->U        Status: 200
FS->GW    BYE
GW->FS    Status: 200


Regards,
Sean Devoy
VP Operations and Development
Business Focused Internet Systems, Inc.