How SIP and VoIP Work: REGISTER, INVITE, RTP & Toll Fraud (Animated)

Most business phones are now VoIP. SIP sets up and ends calls; RTP carries the actual voice. An internet-exposed phone system with weak extension passwords can rack up huge international call bills in a single weekend.

1. Register: the phone tells the pbx where it is

Each phone logs in to the phone system with its extension number and password, so the PBX knows where to send calls.

1. REGISTER (Desk phone 101 → Phone system (PBX)): The phone registers.
2. 401 (Phone system (PBX) → Desk phone 101): The PBX challenges it.
3. REGISTER (Desk phone 101 → Phone system (PBX)): The phone answers the challenge.
4. 200 OK (Phone system (PBX) → Desk phone 101): Registered.

Wireshark filter:

sip.Method == "REGISTER"

2. Make a call: invite, ringing, ok, ack

Phone 101 calls 102. SIP messages set up the call and agree which audio codec and ports to use (in the SDP body).

1. INVITE (Desk phone 101 → Desk phone 102): The invitation includes where to send audio.
2. 180 RINGING (Desk phone 102 → Desk phone 101): Phone 102 rings.
3. 200 OK (Desk phone 102 → Desk phone 101): Picked up.
4. ACK (Desk phone 101 → Desk phone 102): The call is established.

Wireshark filter:

sip.Method == "INVITE"

3. Voice (rtp): the audio stream

Voice travels as a steady stream of small RTP packets, about 50 a second in each direction, directly between the phones.

1. RTP (Desk phone 101 → Desk phone 102): Unencrypted RTP can be recorded and played back by anyone on the path.

Wireshark filter:

rtp

4. Toll fraud: attack: an exposed pbx with weak passwords

Bots scan the internet for SIP on port 5060 and guess extension passwords. Once one registers, criminals place calls to expensive international and premium-rate numbers, often overnight or at weekends, and the company receives the bill.

1. REGISTER (Attacker → Phone system (PBX)): Automated guessing.
2. 200 OK (Phone system (PBX) → Attacker): One weak extension password is found.
3. INVITE (Attacker → Phone system (PBX)): Expensive calls run all weekend.

Wireshark filter:

sip.Method == "REGISTER" && ip.src == 198.51.100.66

5. Harden the pbx: defence: hide it, strong secrets, limits

Don’t expose SIP to the internet (or allow only your provider’s IPs), use long random extension passwords, block repeated failures (fail2ban), restrict international dialling and set spending alerts, and use TLS and SRTP to encrypt calls.

1. REGISTER (Attacker → Phone system (PBX)): The PBX never even sees the guesses.

Pbx checklist:

Allow 5060/5061 only from your SIP trunk provider
Long random secrets · fail2ban · international calls off by default

FAQ