Sorry about it, here is the plain text
I saw there are a 5524 NOTIFY after the call forward.
In this case, call flow:
1001@10.11.30.26 → (call) → 1000@10.11.30.80 → (call forward) → sip:5555@XX.XXX.XX.XX
<--- Transmitting SIP request (706 bytes) to UDP:10.11.30.26:56759 --->
REFER sip:1001@10.11.30.26:56759;ob SIP/2.0
Via: SIP/2.0/UDP 10.11.30.80:5060;rport;branch=z9hG4bKPj60da3e12-d22f-423a-a861-63603849a018
From: <sip:1000@10.11.30.80>;tag=861253b2-54ff-4312-9b16-08b479ac4b6f
To: <sip:1001@10.11.30.80>;tag=22c973b683c441419e4fe51990df640a
Contact: <sip:10.11.30.80:5060>
Call-ID: 6d805f31f53d4ad7b8ceaf7018b2c202
CSeq: 5881 REFER
Event: refer
Expires: 600
Supported: 100rel, timer, replaces, norefersub
Accept: message/sipfrag;version=2.0
Allow-Events: presence, dialog, message-summary, refer
Refer-To: sip:5555@XX.XXX.XX.XX
Referred-By: <sip:1000@10.11.30.80>
Max-Forwards: 70
User-Agent: Asterisk PBX 18.10.0~dfsg+~cs6.10.40431411-2
Content-Length: 0
<--- Received SIP response (576 bytes) from UDP:10.11.30.26:56759 --->
SIP/2.0 202 Accepted
Via: SIP/2.0/UDP 10.11.30.80:5060;rport=5060;received=10.11.30.80;branch=z9hG4bKPj60da3e12-d22f-423a-a861-63603849a018
Call-ID: 6d805f31f53d4ad7b8ceaf7018b2c202
From: <sip:1000@10.11.30.80>;tag=861253b2-54ff-4312-9b16-08b479ac4b6f
To: <sip:1001@10.11.30.80>;tag=22c973b683c441419e4fe51990df640a
CSeq: 5881 REFER
Expires: 600
Contact: <sip:1001@10.11.30.26:56759;ob>
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub, trickle-ice
Content-Length: 0
<--- Received SIP response (576 bytes) from UDP:10.11.30.26:56759 --->
SIP/2.0 202 Accepted
Via: SIP/2.0/UDP 10.11.30.80:5060;rport=5060;received=10.11.30.80;branch=z9hG4bKPj60da3e12-d22f-423a-a861-63603849a018
Call-ID: 6d805f31f53d4ad7b8ceaf7018b2c202
From: <sip:1000@10.11.30.80>;tag=861253b2-54ff-4312-9b16-08b479ac4b6f
To: <sip:1001@10.11.30.80>;tag=22c973b683c441419e4fe51990df640a
CSeq: 5881 REFER
Expires: 600
Contact: <sip:1001@10.11.30.26:56759;ob>
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Supported: replaces, 100rel, timer, norefersub, trickle-ice
Content-Length: 0
<--- Received SIP request (576 bytes) from UDP:10.11.30.26:56759 --->
NOTIFY sip:10.11.30.80:5060 SIP/2.0
Via: SIP/2.0/UDP 10.11.30.26:56759;rport;branch=z9hG4bKPj418872ed3dcf4a4a8035dffe3082ea02
Max-Forwards: 70
From: <sip:1001@10.11.30.80>;tag=22c973b683c441419e4fe51990df640a
To: <sip:1000@10.11.30.80>;tag=861253b2-54ff-4312-9b16-08b479ac4b6f
Contact: <sip:1001@10.11.30.26:56759;ob>
Call-ID: 6d805f31f53d4ad7b8ceaf7018b2c202
CSeq: 5524 NOTIFY
Event: refer
Subscription-State: active;expires=600
Allow-Events: presence, message-summary, refer
Content-Type: message/sipfrag;version=2.0
Content-Length: 20
SIP/2.0 100 Trying
Thanks a lot !