 Welcome to the Network Engineering video blog. I am your host, Michael Crane. In today's video, we're going to use Wireshark to look at an A calls B, A puts B on hold, call flow, and analyze what happens when you put a SIP call on hold. We will be using our SIP test bed we built in video number 65 for this testing. I will also show you how to identify the SIP transactions and SIP dialogue to help analyze our SIP call. Finally, we will dig into the SDP to see how phone A puts phone B on hold. All right, so let's get started. Okay, so let's take a look at what's going on here. I've pulled up the Wireshark trace for the call on hold test, or call hold test, I should say. And let's look at the call flow real quick. So you go under telephony, Wipe calls, and here you can see the, this is, if there was multiple calls in this trace, you would see multiple lines. But since we just have a single call or a single session, there's only one line here. So we're going to highlight this guy and look at the flow sequence, okay? So let me see if I can make this a little bigger here. Well, it's not that much bigger. But it's okay. So 192.168.1.44 is phone A. 192.168.1.46 is phone B, okay? So we'll just, we'll start from the beginning. So the first message is invite with SDP and it's listing all the different codecs that the phone supports. And here is a little comments on the site. So phone A is sending an invite to 46, phone B, right? You can see the arrow kind of go on to the right. And then phone B sends a 100 trying. And the 100 trying, and I'm sure I've said this before, it's just a receipt saying, yes, I got your invite, okay? Then it sends a ringing saying, okay, now I'm notifying the, well, I'm ringing the phone basically and so it's ringing. And then as soon as phone B answers the phone, it sends a 200 okay, all right? And then phone A acts the 200 okay. And you'll see this 200 okay has the SDP and he's saying, okay, I wanna use a G711 MULA, right? And we could dig around into the traces of this, but I don't really think we need to. This is just looking at the call flow. We'll look at the call hold here in a second. Okay, so the act comes back from A and so now we have established a phone call, all right? And this is what you would call a session, right? Because it's using SDP to establish the media, all right? And SDP has session description protocol. So once B says, okay, we're gonna use G711 MULA, that's on the list of A, you can see it's the first one listed right there. And so now they're both using, you can see this is two one-way paths from A to B and from B to A, all right? They're both using G711 MULA and the phone will not split them. So we'll do a G711 MULA one way and G729 the other way. If they can't agree on a codec, it just fails the call. Agree on a codec meaning the same codec, right? Okay, so what do we have here? We're in dialogue, okay? And we've had one whole transaction. And we can go look at that real quick because this is important to keep the terminology straight, especially when you're talking to other engineers, right? So we're going to look at this real quick and we're gonna go into the message header. Here's our, this branch ID right here, lists the transaction, that's actually the transaction ID. If you remember from the last video, this tag ID combined with the call ID, let me start over again, the tag, the from tag ID, the to tag ID, and the call ID all compose the dialogue ID. Those three things are, determines a single dialogue, okay? Hopefully you're still following, going along with me. I'm just gonna scroll down here and we're gonna keep an eye on this, this branch ID, which is actually the transaction. It branches an old term, so I'm gonna call it transaction ID. Okay, so here we go. So here's the 100 trying, 17 E9 is the last four digits. Yep, they both match. Here's the ringing, yep, 200 okay, yep. And ACK, oh, oh yeah, that's right. The ACK is actually a new transaction, even though it's its own transaction. It's just ACKing the 200 okay. Okay, so just to be clear, since I kinda screwed that up when I was talking to you, from here to the media, these two are actually me, this isn't part of the SIP protocol, but from the invite to the ACK is actually two transactions inside one dialogue, okay? And that's just up to the ACK so far. From this invite to this 200 okay is one transaction, and this ACK is its own transaction, all right? And that's the end of the transaction. So the next message we get will have its own transaction ID, but it'll still be in the same dialogue. So we had two transactions, right? The invite through the 200 okay is one transaction, ACK is a second transaction. They're all in the same dialogue. And we can look at that. So remember I was saying that the dialogue consists of the from tag, the to tag, and the call ID, right? So you notice there's no to tag here. That tag has to come from phone B and this is the initial invite. So you'll see okay on the 100 trying that he got from phone B, phone B didn't send the tag because it's basically just a receipt saying I got your invite, but I haven't done anything with it, right? I haven't processed it yet. But then you know, gosh, what is it? A nanosecond later or something like that. He sends a 180 ringing. At this point, he attaches the tag ID to the to header. Okay, so now we have a dialogue. We've got the from tag, the to tag and the call ID right here. Okay, so that's our dialogue ID. So now what's gonna happen is this invite right here is when I pushed hold on phone A. You'll see phone A here sent another invite with an SDP to phone B, which is dot 46, right? Now if we look at that, well first let's look at, okay, so he's definitely in a different transaction, right? From the previous one or the previous two. So this is a brand new transaction. It's the exact same tags. So it's in dialogue and he is sending an invite and you'll notice nothing else, right? And there's nothing in here it says hold. And that's because the hold is in the SDP down here. If we come down here and look at this, we'll see that session and connection information. Okay, yeah, so there's a couple different ways you can put a call on hold. And one is to, you can do this media attribute where he's sending send only is that he's only gonna be sending RTP. He is not going to be receiving RTP, right? This is phone A sent telling phone B this, right? And another way of doing it, this is his connection. He basically is telling phone B if you're gonna send me RTP packet, send it to this address, which is 0.0.0. And that's basically null in the SIP world or SDP world. So he's basically saying send all your RTP to null if you send me any RTP at all, right? This is how you change the RTP IP address, okay? So then phone B turns around and says, okay, no problem. And we'll see that it's in the same dialogue, oops. Okay, so 21 F0. Yeah, 21 F0, tags are the same. Call ID is the same. And his SDP saying, yeah, no problem. Here's his connection information. And he still, he didn't change his IP address, but he's going into receive only mode. So he's telling phone A, okay, I'm just gonna go into receive only mode. And then phone A after getting the 200K sends an act back and I'd have to look in the spec. I'm not exactly sure he's required to send an act back on a in dialogue invite, because that's like sending a, let me back up a little bit. Phone A could send phone B invites all day long and phone B will just respond with 200K. And it's not to set up new calls that he could be just trying to, we'll put a call on hold as a good example or like keep alive, he's just keeping the session alive. There's other ways to do it besides sending invites, but some phones do send them invites. And that's usually if the other end doesn't support like notify or something like that or option messages. Yeah, that's why I'm kind of wondering if phone A actually needed to send the act back. It doesn't hurt, right? It's a, of course it's gonna be a new transaction since it's an act. So 21F0 is our transaction ID for the invite. I'm sorry for the hold and then the act is its own transaction ID. Okay, so time goes on, you know, we put the call on hold first, I don't know what is that a couple seconds it looks like. And then we took phone A off of hold and that's what this other invite is. So now phone A sends another invite to phone B and this is of course a new transaction ID or everything, this is still the same dialogue. See this invite here and this invite up here are exact same 12C7. So we're still in the same dialogue but this time he's saying, where is it? Okay, well he fixed his IP address so he's saying, yeah, send RTP to .44, which is good. And now he's going into send receive mode. All right, so now he's expecting to receive RTP from phone B and phone B says okie dokie and sends back his 200 okay with send receive in this, in the SDP, right? And then phone A sends another act back which I still don't think needs to be there but I'm not going to go looking the expect to figure it out. And then at the end, you know, we just hung up phone A. So phone A sends a buy out and that's going to be in its own transaction ID. You see he's got a different transaction ID from the previous ones. So it's a separate transaction. Of course the tag is the same dialogue so the tags and everything are the same and says wise, yes, I'm going on hook. I'm hanging up now. And so goodbye. And phone B responds with 200 okay, see ya. And that's it. Okay, so you can see in this call we had, let's see, one, two, three, four, five, six, seven different transactions in this one dialogue or one phone call. And that'll change when we start, when we have multiple dialogue calls which will be if we put someone on hold and then initiate another call for like call transfer or something like that. And we'll get to that in the next video. Okay, so to get back to our SIP call flow here. So we looked at what happened up till we had our RTP or our media set up. Okay, then we had this invite from phone A which is dot 44 to phone B, right? Which is dot 46 where he's putting the call on hold, right? And we get the 200 okay back from phone B. I don't know why you said G7 on the telephony event but anyway, we got an act from phone A, right? From the 200 okay. And then when we took the call off hold we got another invite from phone A basically saying I'm taking the call off hold we're gonna go into send receive mode phone B sends back 200 okay. And as you'll see the leg of the media path is set up from phone B. We get the act which is kind of this trace is kind of funny the way that they haven't set it up but anyway, this act right here is for this 200 okay right here. And here's the media from A, right? And of course then we have the buy in the 200 okay. At the end, this is where phone A hangs up and he says okay. So yeah, if you noticed it was actually in if you remember when we sent this invite with SDP it was a send only and then a receive only, right? So you would think there would still be one path set up but there's not, there's no media and we can go check that real quick by looking at the RTP and our SIP trace right here. So okay, here's our initial invite. Here's the invite to put on hold, put the call on hold and here's a 200 okay. So now what I'm gonna do is I'm gonna put SIP or RTP and as you can see, here's our 200 okay. Here's our act and you can see between until we get this other invite right here there is zero media and you think there would be one way but media but there is not. And the reason why there isn't is because there's no reason for the phone to send media if he's not gonna be listening to anything, right? But theoretically it would be one way media. So like if you got that from a server, right? And let's say you wanted music on hold. Well, at this point that's where that send only receive only comes in is it'll start playing music or something. So the person on hold here is the elevator music but that's only so the phone B is listening to the elevator music and phone A is sending it, right? Or the PBX or the proxy, right? But in this case they're not phone A isn't sending anything so there's no RTP. And then here's the invite taking the phone call off hold I'm sorry taking the SIP call off hold and here's the 200 okay and here's phone B sending starting to stream its RTP here's that act that came in a little bit later and that's it don't forget you can support the network engineering video blog by donation using a credit card and PayPal or by purchasing products at the Muxall store. Details and links are in the description under this video. Well, that's it for this video. If you liked the video give it a big thumbs up that helps and hit the subscribe button that really helps. If you have any questions or comments post them in the comments under this video. Thanks for watching and I'll see you next time.