packet 1 & 4: SIP/SDP INVITE from
firewall
to ulam2, containing a Connection Address of 10.213.119.31. This is a
behind-the-NAT address; ulam2 can
not
reach it. There is also a port specified (
16472), and multiple media formats
(G.729, G.711, G.721, G.722, ....).
packet 6 & 10: SIP INVITE from ulam2 to sip.flowroute.com
(216.115.69.144), specifying Connection Address = ulam2 (ie
not 10.213.119.31 or 10.38.2.42),
and port
19116; G.729 is the
only codec offered
packets 13-15: These look like early RTP packets from the far end.
At this point ulam2 has no idea who they are from, as flowroute has not
yet notified ulam2.
packet 16: This is the first SIP/SDP packet from sip.flowroute.com to
ulam2, identifying the remote end as 68.68.120.43 /
9998, identified by
ip2location.com as being in
Morgantown, WV.
packet 17: SIP/SDP from ulam2 to the firewall, specifying the
connection as 147.126.65.47 /
19098;
that is, ulam2 again.