SIP
Session Initiation ProtocolSIP sets up the call and then gets out of the way. It finds the person you are calling wherever they are registered, negotiates what media both ends can handle, and hands the actual audio and video to RTP — signalling, never the call itself.
SIP locates the callee and negotiates the session — then the media flows directly over RTP, without it.
How it works
SIP’s job ends once both sides know where to send media and in what codec. The audio never touches the signalling path — which is why a call can sound fine while the SIP server is somewhere else entirely.
What SIP does, step by step
A phone REGISTERs its current address against its SIP URI, so it can be found later.
An INVITE carries an SDP offer listing codecs and the address media should be sent to.
Provisional responses ring the phone; 200 OK returns the SDP answer choosing from the offer.
RTP flows directly end to end; BYE ends the dialog, and re-INVITE changes it mid-call.
In cybersecurity
SIP is plain text on a well-known port and reaches the phone system, which makes it one of the most relentlessly scanned services on the internet.
A cracked extension is used to place expensive international calls, often within hours of exposure.
A forged REGISTER points someone’s number at the attacker, who then receives their calls.
TLS on 5061 for signalling, SRTP for media — plain SIP reveals who called whom, and when.
Automated tools sweep 5060 constantly, probing extensions and default passwords.
The From header is set by the caller — the whole basis of spoofed calls and vishing.
Lock accounts on repeated failures and never expose a PBX directly to the internet.