I have reviewed my pcap file MANY times. I have a FAILED call and a GOOD call from the same extension. I will attempt you list the signaling below. One oddity that jumps out at me, there are no SIP 183 packets in the call that WORKED. It is clear that the user is hanging up, but they state the call rings 4 times, then goes to busy. The tshark command I am using is: tshark -f "port 5060" -i any -w capturefile.pcap How can I include RTP messages? Will that let me see if there is early media, then busy or failure? Call that failed signaling: U is the User extension behind NAT. FS is the server with public IP. GW is gateway with public IP (Voip Innovations). U-> FS INVITE FS->U AUTH REQ U->FS Request: ACK U->FS INVITE FS->U Trying FS->GW INVITE GW->FS TRYING U->FS Status 200 GW->FS Status: 183 Session Progress FS->U Status: 183 Session Progress 1/10 Second Later GW->FS Status: 183 Session Progress 21 Seconds Later GW->FS Status: 183 Session Progress GW->FS Status: 200 FS->GW Request: ACK FS->U Status 200 U->FS Request ACK FS->U Request: UPDATE U->FS Status 200 3 Seconds Later - 26 seconds total U->FS BYE FS->U Status: 200 FS->GW BYE GW->FS Status: 200 Regards, Sean Devoy VP Operations and Development Business Focused Internet Systems, Inc.