VoIP.info Guide

Correlating SIP call legs with PBX events

Follow transfers and bridges without assuming one Call-ID represents the entire business call.

Reviewed 2026-09-07Wireshark 4.x / current upstream tool documentation; inspect installed versionsIntermediateDocumentation based · not lab tested

One user conversation can create many legs

A B2BUA can create independent dialogs on the endpoint and carrier sides. Transfers, queues, local channels and conferences can add further channels and bridges. A single user-visible call may therefore require several signaling traces and application events to explain. Start with a known endpoint, destination and timestamp. Find the PBX's channel identifiers and its correlation relationship, then locate the corresponding SIP dialogs. Treat timing-only matches as tentative when many calls occur concurrently.

Use the right event detail

CDR provides call-detail records, but complex call flows may need more granular events. Asterisk CEL is designed to track channel-related events and can help reconstruct a sequence when configured with appropriate events and a storage backend. Neither a CDR row nor a SIP Call-ID alone proves exactly what a participant heard. Retain the bridge and media context, especially when a call is transferred or an announcement is played before a destination answers.

Build a small incident timeline

List the incoming dialog, PBX decision, outgoing dialog, answer or failure, bridge changes and final cleanup. Include time zone and known clock offsets. Where the PBX changes identity or media parameters, note the boundary explicitly. Use the timeline to state the earliest observed failure and any remaining visibility gap. For example, the PBX may prove it sent an outbound INVITE while the carrier must confirm receipt. Avoid filling that gap with a guessed carrier cause. Redact personal identifiers consistently so the relationships remain intelligible.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.