How SIP works, from the first ring to the error codes
In short
SIP is the set of short messages internet phones use to sign in, ring, answer and hang up. It does not carry your voice: the sound travels on a separate road, as RTP. Nearly every SIP problem is one of those two roads being blocked, and the error code tells you which.
Checked 2026-10-26 against the SIP standards (RFCs) · SimVala editorial
SIP at a glance
- SIP messages
- 5060 (UDP, TCP)
- Encrypted messages
- 5061 (TLS)
- The sound
- RTP, separate ports
- One G.711 call
- 87.2 kbps each way
- Lost ACK gives up after
- 32 seconds
The basics
What is SIP, and what is SIP calling?
Road 1: SIP messages
Port 5060 or 5061Sign in, ring, answer, hang up. Always through the provider's server.
Road 2: the sound (RTP)
Ports picked per call50 small packets a second each way. Often a different path and different ports.
Road 1 blocked: the app will not sign in, or calls fail with a code such as 408.
Road 2 blocked: the call connects, but one or both of you hear nothing.
SIP was first published in 1999, and the version every phone uses today, RFC 3261, dates from 2002. It is an open standard, which is why any SIP app can sign in to any SIP provider, and why an office phone system from one maker can use lines from another.
The messages look a lot like email. Each one has a first line saying what it is (INVITE, BYE, 200 OK), a few header lines saying who it is from and who it is for, and sometimes a short note about the sound. A whole call needs only about a dozen of them, as the walk-through below shows.
You need two things to make SIP calls: an app or phone that speaks SIP (see the best SIP apps), and a SIP account from a provider: a username, a password and a server name. The provider is what turns your internet call into a call to a real mobile or landline.
Watch one call
How a SIP call works, message by message
Sign in
Call
Talk
Hang up
Step 5 of 13 · Call
You dial a number
INVITE · Your app to Provider
The INVITE carries the number and a short note called SDP: the sound formats (codecs) your app speaks and the address and port where it wants the audio. Look at the c= line: a private 192.168 address. If the router does not fix it, the other side sends your audio nowhere.
INVITE sip:[email protected] SIP/2.0 From: <sip:[email protected]>;tag=1928301774 To: <sip:[email protected]> Call-ID: a84b4c76e66710 c=IN IP4 192.168.1.20 m=audio 49170 RTP/AVP 0 8 101
Message text shortened from the examples in RFC 3261. Numbers and addresses are examples: 192.168 addresses are private, 203.0.113 is reserved for documentation.
The parts
What a SIP server does, and how a SIP address works
Registrar
Checks your password when the app signs in, and remembers where your app can be reached right now.
Proxy
Passes each message on towards the person you called, asking for proof of who you are on the way.
Phone system (PBX)
Takes a call and makes a new one: extensions, voicemail, menus and queues. Asterisk, FreePBX and 3CX are PBXs.
Session border controller
The provider's front door. Hides its network, fixes the addresses your router got wrong, and blocks floods and scans.
Gateway
Where an internet call meets the ordinary phone network, so a SIP app can ring any mobile or landline.
What you type in the app
Only one name: the server or domain your provider gives you. The rest happens behind it.
A SIP address, part by part
A SIP address (also called a SIP URI) looks like an email address with a prefix. It says who to reach and which server knows where they are.
- Scheme
- sips: asks for encryption all the way
- User
- Your username, or a phone number
- Host
- The provider's server
- Port
- Optional. 5060 if left out, 5061 for TLS
- Parameters
- Extra rules, such as the transport
Ports
SIP ports: 5060, 5061 and the audio range
| Port | Transport | Carries | Where the number comes from |
|---|---|---|---|
| 5060 | UDP and TCP | SIP messages: sign in, ring, answer, hang up | The standard default (RFC 3261) |
| 5061 | TLS over TCP | The same messages, encrypted | The standard default for TLS (RFC 3261) |
| No fixed number | UDP | The sound itself (RTP, or SRTP when encrypted) | Each side picks from a range. Asterisk uses 5000 to 31000 out of the box; its sample config narrows it to 10000 to 20000 |
| 3478 | UDP and TCP | STUN: asks a server for your public address | The standard default (RFC 8489); 5349 for STUN over TLS |
| Any other | Provider's choice | Providers can run SIP on any port | If your provider lists a port, use it. It beats every default above |
5060
UDP and TCP
SIP messages: sign in, ring, answer, hang up
The standard default (RFC 3261)
5061
TLS over TCP
The same messages, encrypted
The standard default for TLS (RFC 3261)
No fixed number
UDP
The sound itself (RTP, or SRTP when encrypted)
Each side picks from a range. Asterisk uses 5000 to 31000 out of the box; its sample config narrows it to 10000 to 20000
3478
UDP and TCP
STUN: asks a server for your public address
The standard default (RFC 8489); 5349 for STUN over TLS
Any other
Provider's choice
Providers can run SIP on any port
If your provider lists a port, use it. It beats every default above
Do you need to open any ports?
An app on your phone or computer
No
The app connects out to the provider, and your router lets the replies back in on its own. What does need doing is turning SIP ALG off in the router, and sometimes STUN on in the app.
A phone system (PBX) behind a firewall
Often, carefully
The PBX usually needs its audio range forwarded so sound from the provider reaches it, and its public address set. Allow SIP only from your provider's addresses: a 5060 open to the whole internet gets password-guessing traffic around the clock.
Why incoming calls stop ringing: your router keeps a door open for your app only while it hears from it. The internet standard for home routers says at least two minutes for UDP, and recommends five, but some close sooner. That is why SIP apps re-register or send a keep-alive every few minutes.
Codecs
SIP codecs, and how much data a call uses
Data per call, each way, with network overhead
- G.711The phone network's own format. Works with almost every provider87.2 kbps39 MB an hour
- G.722HD voice at the same data cost as G.71187.2 kbps39 MB an hour
- G.729Squeezed for slow links; sounds a little flatter31.2 kbps14 MB an hour
- OpusModern apps. Adjusts itself to the connection; voice uses the low end6 to 510 kbit/s
What to pick: leave G.711 on in every app (it shows up as PCMU and PCMA), because almost every provider and phone network accepts it. Put Opus or G.722 first if your provider supports them, for clearer sound. Use G.729 only on a very slow link.
A whole hour on G.711 is about 78 MB in both directions, so a SIP call costs little mobile data. What matters more than speed is a steady connection: voice cannot wait for a late packet, so a busy Wi-Fi causes more trouble than a slow one.
SIP vs VoIP
SIP vs VoIP: the family and one of its members
VoIP: any phone call over the internet
SIP
The open standard. Desk phones, SIP apps, PBXs and phone carriers use it, so any SIP app works with any SIP provider.
WebRTC
Calling inside a web browser. Many web phones carry SIP messages inside it (RFC 7118).
H.323
An older standard from 1996, still found in video conference rooms.
IAX2
Asterisk's own protocol, mostly used between two Asterisk servers.
Closed app calling
WhatsApp, FaceTime, Signal. Free between users of the same app, but they cannot sign in to a SIP provider.
| VoIP | SIP | |
|---|---|---|
| What it is | A kind of call: voice over the internet | One standard for starting and ending those calls |
| Carries your voice | Yes, as a whole | No. RTP carries the sound; SIP only sets it up |
| Works across makers | Depends on the system | Yes: any SIP app with any SIP provider |
| Calls real numbers | Only through a provider that connects to phone networks | Yes, through a SIP provider |
| Examples | SIP calls, WhatsApp calls, Teams, Zoom | Linphone, desk IP phones, Asterisk, 3CX, SIP trunks |
Error codes
SIP error codes: what 401, 403, 408 and 488 mean
- 1xx: still working on it
- 2xx: done
- 4xx: something in your request
- 5xx: the server failed
- 6xx: refused everywhere
403
Forbidden
4xx: something in your requestSigning in or calling
The server understood you and refuses. Retrying the same thing will not help.
Usual causes
- Wrong password after the challenge, or too many failed sign-ins so the server blocked you for a while.
- The number you dialled is barred on the account, such as premium or some international ranges.
- No credit, or the account is suspended.
- The caller ID your app or PBX sends is a number the account does not own.
- The server only accepts your account from listed IP addresses, and your IP changed.
Try in this order
- 1Note whether every call fails or only some numbers. Only some numbers points to barring or the number format.
- 2Check the balance and account status.
- 3On a PBX, remove any custom caller ID or set it to a number on the account.
- 4If sign-in fails, re-enter the password and wait 10 to 30 minutes in case the server locked you out.
Troubleshooting
SIP troubleshooting: registration failed, one-way audio, dropped calls
I hear them, they cannot hear me
One-way audio means the call was set up fine, but the sound in one direction is going to the wrong address. Your app wrote its private home address into the call details, and the router did not fix it or did not let the reply in.
Check, in this order
- 1Turn off SIP ALG in your router. The standard for home routers says these helpers should be off for UDP, and they are a frequent cause.
- 2Turn on STUN or ICE in the app, if it has the option.
- 3Switch the app's transport to TLS, which a router cannot rewrite, or to TCP.
- 4On a PBX, set its public IP address (external address) and open its audio port range in the firewall.
Using Linphone? The Linphone setup guide has the exact settings screen by screen. Running a phone system? See SIP trunk setup for 3CX, FreePBX and Asterisk.
Security
Is SIP secure?
Your password is not sent
Sign-in uses a challenge: the app proves it knows the password without sending it. A captured sign-in can still be guessed offline if the password is short.
TLS hides the messages
Over TLS (port 5061), nobody on the network can read who you call or copy your sign-in. Plain UDP and TCP send them readable.
SRTP encrypts the sound
TLS protects the messages, not the voice. The audio is encrypted only when both your app and the provider use SRTP.
Toll fraud is the real risk
Bots scan port 5060 all day, guessing passwords to call expensive numbers on your account. Long random passwords and a prepaid balance cap the damage.
Locking down a phone system before you connect it: see the toll-fraud checklist.
Words
SIP terms explained
- SIP
- Session Initiation Protocol. The messages that start, change and end calls.
- RTP
- Real-time Transport Protocol. Carries the sound in small packets.
- SRTP
- Secure RTP: the same packets, encrypted.
- SDP
- The note inside a SIP message that lists codecs and the address for the sound.
- Codec
- The way sound is squeezed into data, such as G.711 or Opus.
- User agent
- Anything that makes or takes SIP calls: an app, a desk phone, a PBX.
- Registration
- Your app telling the server where it is, every few minutes.
- NAT
- What your router does so many devices can share one public address.
- SIP ALG
- A router feature that rewrites SIP messages. Usually does more harm than good.
- STUN
- A server your app asks: what is my public address?
- DTMF
- The tones from the keypad, for menus such as press 1 for sales.
- Trunk
- A SIP connection for a phone system, carrying many calls at once.
Try it
See it work with a real SIP login
A SimVala SIP login works in any standard SIP app or phone system. You pay for calls from a crypto balance, with no ID and no contract. Your order page lists the server, port and transport to type in.
- Any SIP app, desk phone or PBX
- 10 calls at once on one login
- Start with $5 of call credit
- Billed by the second on 155 of 202 countries
- Calls from $0.001 a minute
- Add a number that rings the login
How we checked this
Ports, timers and response codes come from the SIP standards themselves, read on 2026-10-26. Bandwidth figures come from Cisco's published table, and the audio port range from Asterisk's own configuration files. Causes and fixes for each error collect what provider help pages and phone-system forums report most often; your provider's logs are the final word for your account.
SIP questions, answered
What port does SIP use?+
5060 over UDP or TCP, and 5061 for SIP over TLS. Those carry the messages only. The sound travels separately as RTP, on ports each side picks from a range, often somewhere between 10000 and 20000. A provider can also run SIP on another port, and the port it gives you is the one to use.
Is SIP the same as VoIP?+
No. VoIP is any phone call over the internet. SIP is one standard for setting those calls up: signing in, ringing, answering and hanging up. Most VoIP phones and providers use SIP, but WhatsApp or FaceTime calls are VoIP without SIP.
What does SIP stand for?+
Session Initiation Protocol. It was first published in 1999 and today's version, RFC 3261, dates from 2002. A session is any live conversation: a voice call, a video call or a chat.
Why do my SIP calls drop after about 30 seconds?+
Because your app's ACK never reaches the other side. After the call is answered, the far end resends its answer until it gets an ACK, and gives up after 32 seconds (64 times the 500 ms SIP timer). The usual cause is the router: turn off SIP ALG, or switch the app to TCP or TLS.
What does SIP 403 Forbidden mean?+
The server understood the request and refuses it, so retrying will not help. On sign-in it usually means a wrong password or a temporary block after failed attempts. On a call it usually means the number is barred, the account is out of credit, or the caller ID is not yours.
Do I need to open ports for a SIP app?+
Not for an app on your phone or computer: it connects out, and your router lets the replies back in. A phone system in an office often needs its audio range opened, and should only accept SIP from its provider's addresses.
How much data does a SIP call use?+
On G.711, 87.2 kbps each way including network overhead, which is about 39 MB each way per hour, or 78 MB for both directions. G.729 needs 31.2 kbps each way. Opus adjusts itself and usually uses less than G.711.
Are SIP calls encrypted?+
Only if you turn it on and your provider supports it. TLS encrypts the messages (who you call, your sign-in) and SRTP encrypts the sound. Without both, calls travel readable, the same way an old landline call could be tapped.
Keep reading
CallingSIP account with cryptoOne login for any app or PBX, every country.
CallingBest SIP appsSIP softphones for phone and computer, compared.
CallingSIP trunk for your PBX10 lines for 3CX, FreePBX or Asterisk.
CallingInternational callingPrepaid minutes to 200+ countries.
Also useful: Set up Linphone · DID numbers for SIP · Cheapest way to call abroad
Product names such as Asterisk, 3CX, WhatsApp and FaceTime are trademarks of their owners. SimVala is not affiliated with any of them.