caerj:~# ngrep -W byline port 5060
interface: eth0 (10.10.0.0/255.255.252.0)
filter: (ip or ip6) and ( port 5060 )
#
U 10.10.2.33:5069 -> 10.10.3.190:5060
INVITE sip:01125649284@10.10.3.190 SIP/2.0.
Route: <sip:10.10.3.190:5060;lr>.
Date: Fri, 20 Jul 2007 16:54:31 GMT.
CSeq: 1 INVITE.
Via: SIP/2.0/UDP 10.10.2.33:5069;branch=z9hG4bK2ce8cd8d-4f35-dc11-8a95-0013d44f0ad0;rport.
User-Agent: Ekiga/2.0.3.
From: "paulo arruda" <sip:paulo@10.10.3.190>;tag=b678d787-4f35-dc11-8a95-0013d44f0ad0.
Call-ID: 3c70d787-4f35-dc11-8a95-0013d44f0ad0@gsl024.
To: <sip:01125649284@10.10.3.190>.
Contact: <sip:paulo@10.10.2.33:5069;transport=udp>.
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,NOTIFY,REFER,MESSAGE.
Content-Type: application/sdp.
Content-Length: 383.
Max-Forwards: 70.
.
v=0.
o=- 1184950471 1184950471 IN IP4 10.10.2.33.
s=Opal SIP Session.
c=IN IP4 10.10.2.33.
t=0 0.
m=audio 5024 RTP/AVP 101 96 3 107 110 0 8.
a=rtpmap:101 telephone-event/8000.
a=fmtp:101 0-15.
a=rtpmap:96 SPEEX/16000.
a=rtpmap:3 GSM/8000.
a=rtpmap:107 MS-GSM/8000.
a=rtpmap:110 SPEEX/8000.
a=rtpmap:0 PCMU/8000.
a=rtpmap:8 PCMA/8000.
m=video 5026 RTP/AVP 31.
a=rtpmap:31 H261/90000.

#
U 10.10.3.190:5060 -> 10.10.2.33:5069
SIP/2.0 100 Giving a try.
CSeq: 1 INVITE.
Via: SIP/2.0/UDP 10.10.2.33:5069;branch=z9hG4bK2ce8cd8d-4f35-dc11-8a95-0013d44f0ad0;rport=5069.
From: "paulo arruda" <sip:paulo@10.10.3.190>;tag=b678d787-4f35-dc11-8a95-0013d44f0ad0.
Call-ID: 3c70d787-4f35-dc11-8a95-0013d44f0ad0@gsl024.
To: <sip:01125649284@10.10.3.190>.
Server: OpenSER (1.2.1-notls (i386/linux)).
Content-Length: 0.
.

#
U 10.10.3.190:5060 -> 10.10.2.33:5069
SIP/2.0 404 Not Found.
Via: SIP/2.0/UDP 10.10.2.33:5069;branch=z9hG4bK2ce8cd8d-4f35-dc11-8a95-0013d44f0ad0;rport=5069.
From: "paulo arruda" <sip:paulo@10.10.3.190>;tag=b678d787-4f35-dc11-8a95-0013d44f0ad0.
To: <sip:01125649284@10.10.3.190>;tag=as1016e7a4.
Call-ID: 3c70d787-4f35-dc11-8a95-0013d44f0ad0@gsl024.
CSeq: 1 INVITE.
User-Agent: Asterisk PBX.
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY.
Content-Length: 0.
.

#
U 10.10.2.33:5069 -> 10.10.3.190:5060
ACK sip:01125649284@10.10.3.190 SIP/2.0.
Route: <sip:10.10.3.190:5060;lr>.
CSeq: 1 ACK.
Via: SIP/2.0/UDP 10.10.2.33:5069;branch=z9hG4bK2ce8cd8d-4f35-dc11-8a95-0013d44f0ad0;rport.
From: "paulo arruda" <sip:paulo@10.10.3.190>;tag=b678d787-4f35-dc11-8a95-0013d44f0ad0.
Call-ID: 3c70d787-4f35-dc11-8a95-0013d44f0ad0@gsl024.
To: <sip:01125649284@10.10.3.190>;tag=as1016e7a4.
Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,NOTIFY,REFER,MESSAGE.
Content-Length: 0.
Max-Forwards: 70.
.

--------------------------------------------------------------------------------------------------------------------

caerj:/usr/local/etc/openser# ngrep -W byline port 5070
interface: eth0 (10.10.0.0/255.255.252.0)
filter: (ip or ip6) and ( port 5070 )