[SOLVED] Strange Asterisk Register SIP Message Header

I found a stange SIP message header during SIP registration process.
This might also be a Wireshark -> Tshark problem of course.
Or is this a known bug in release v1.2.13 and v1.2.18 ?

Here it is:

Plz look at the challenge response from Asterisk (as a client) towards the SIP registrar…
Asterisk =, SIP registrar =

This is probably why the registration fails.

Plz look at the bold line:

Frame 5 (670 bytes on wire, 670 bytes captured)
Arrival Time: Jun 14, 2007 06:59:29.201025000
[Time delta from previous packet: 0.000428000 seconds]
[Time since reference or first frame: 0.274699000 seconds]
Frame Number: 5
Packet Length: 670 bytes
Capture Length: 670 bytes
[Frame is marked: False]
[Protocols in frame: eth:ip:udp:sip]
Ethernet II, Src: Aopen_3f:8f:92 (00:01:80:3f:8f:92), Dst: Siemens_d4:39:c2
Destination: Siemens_d4:39:c2 (00:01:e3:d4:39:c2)
Address: Siemens_d4:39:c2 (00:01:e3:d4:39:c2)
… …0 … … … … = IG bit: Individual address (unicast)
… …0. … … … … = LG bit: Globally unique address (factory
Source: Aopen_3f:8f:92 (00:01:80:3f:8f:92)
Address: Aopen_3f:8f:92 (00:01:80:3f:8f:92)
… …0 … … … … = IG bit: Individual address (unicast)
… …0. … … … … = LG bit: Globally unique address (factory
Type: IP (0x0800)
Internet Protocol, Src: (, Dst: (
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00… = Differentiated Services Codepoint: Default (0x00)
… …0. = ECN-Capable Transport (ECT): 0
… …0 = ECN-CE: 0
Total Length: 656
Identification: 0xb6a4 (46756)
Flags: 0x00
0… = Reserved bit: Not set
.0… = Don’t fragment: Not set
…0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xa8b8 [correct]
[Good: True]
[Bad : False]
Source: (
Destination: (
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Source port: sip (5060)
Destination port: sip (5060)
Length: 636
Checksum: 0xed5c [correct]
[Good Checksum: True]
[Bad Checksum: False]
Session Initiation Protocol
Request-Line: REGISTER sip: SIP/2.0
[Resent Packet: False]
Message Header
Via: SIP/2.0/UDP;branch=z9hG4bK5463983c;rport
Transport: UDP
Sent-by Address:
Sent-by port: 5060
Branch: z9hG4bK5463983c
RPort: rport
From: sip:102@;tag=as10b9a6a2
SIP from address: sip:102@
SIP tag: as10b9a6a2
To: sip:102@
SIP to address: sip:102@
Call-ID: 15fc797e7cc5257a2e85898b02240840@
Sequence Number: 103
User-Agent: Asterisk PBX
Max-Forwards: 70
Authorization: Digest username=“102”, realm=“”, algorithm=MD5,
uri=“sip:”, nonce=“0e472d364fd1437a55f95a47e25a43c5”,
opaque=“a39100dbdcb816ead32b4616190dce30”, qop=auth, cnonce=" Authentication Scheme: Digest
Username: "102"
Realm: ""
Algorithm: MD5
Authentication URI: "sip:"
Nonce Value: "0e472d364fd1437a55f95a47e25a43c5"
Digest Authentication Response: "ccd086e1d1cdc0a69a50ee3f077a1841"
Opaque Value: "a39100dbdcb816ead32b4616190dce30"
QOP: auth
CNonce Value: "50ff0948"
Nonce Count: 00000001
Expires: 3600
Contact: sip:102@
Contact Binding: sip:102@
URI: sip:102@
SIP contact address: sip:102@
Event: registration
Content-Length: 0

Anyone ?
Is this a Tshark problem ? I find it hard to believe, because other message headers are complete.


It seems it’s a Tshark problem.
Because I’ve upgrade to 1.2.18 and even 1.4.5 and both have the same output :wink:

Sorry for the post.