Voice protocol guides

How the machinery behind a phone call actually works — written for the engineer who has to make it work, not for a certification exam. Each guide explains the mechanism, names the interfaces and the messages, and ends with what the thing looks like in a real trace. The companion SIP failure reference covers the specific error codes; these pages cover the systems those errors come from.

IMS architecture

P-CSCF, I-CSCF, S-CSCF and the HSS: what each box decides, how a registration actually flows, and which headers betray each one in a trace.
Diameter

The protocol that runs VoLTE's back office: AVPs, applications, the interfaces that matter (Cx, Rx, Gx, S6a), and how a request finds its way home.
A VoLTE call, step by step

From attach to answer: the two bearers, the precondition dance, the Rx trigger that builds the voice bearer, and the failures each stage produces.
What an SBC actually does

Topology hiding, latching, header repair, admission control, the encryption boundary — and why a B2BUA gives every call two Call-IDs.
SIP, H.323 and Diameter

Three protocols, three different jobs. What each one carries, where they meet, and how an interworking function maps one onto another.
Lawful intercept architecture

The ETSI/3GPP model: warrants, the ADMF, X1/X2/X3, mediation and handover to the agency — the standardised system, not the mythology.
Lawful intercept in a VoIP network

Where the taps really sit in an IMS or SIP network, what encryption changes, and why the intercept is never the reason your call broke.
RTP and RTCP

How the audio actually gets there: the header fields that matter, what the receiver reports tell you, and reading call quality out of a capture.
NAT traversal: STUN, TURN and ICE

Why SIP breaks across NAT, what each fix actually fixes, latching on the carrier side — and why the SIP ALG in the router deserves its reputation.
Codecs and transcoding

Bitrates, MOS ceilings and packetisation overhead — plus what transcoding really costs, and how it quietly breaks DTMF and fax.
SS7 and ISUP

The signalling network SIP had to interwork with: MTP, ISUP call flow against its SIP equivalents, and where you still meet it today.
E.164, SIP URIs and ENUM

How a dialled number becomes a route: tel: vs sip:, RFC 3263 resolution, number portability, and what STIR/SHAKEN adds on top.
Analysing captures with your AI assistant

hiccup as an MCP server: Claude Code or Cursor reasons over your traces while hiccup supplies findings and citations it cannot hallucinate — the workflow, the prompts, and where the boundary sits.

How to read these guides

Every page follows the same shape. First the mechanism — what problem the protocol exists to solve and how it solves it, because the message flows only make sense once you know what question each message is answering. Then the concrete details: the interfaces, the tables, the timer values, the header names. Last, and deliberately last, what the thing looks like in a capture, because that is where theory either survives contact with the network or does not.

Nothing here is copied from a specification or a vendor manual. Where a standard matters it is named — RFC and 3GPP numbers are the coordinates the industry navigates by — but the text is written from the trace-reader's side of the desk: what you can observe, what you can infer, and which of the moving parts is usually the one lying to you.

hiccup is the working end of these pages: a self-hosted analyser that reads pcaps and SBC logs, pairs the legs across a B2BUA, decodes SIP, RTP, SDP, Diameter, H.323 and SIP-I/ISUP, and tells you where the call went wrong. Free for individual users.

upload a trace

Voice protocol guides

IMS architecture

Diameter

A VoLTE call, step by step

What an SBC actually does

SIP, H.323 and Diameter

Lawful intercept architecture

Lawful intercept in a VoIP network

RTP and RTCP

NAT traversal: STUN, TURN and ICE

Codecs and transcoding

SS7 and ISUP

E.164, SIP URIs and ENUM

Analysing captures with your AI assistant

How to read these guides