What sngrep is good at
sngrep is a terminal SIP message-flow viewer. It can inspect live traffic or read existing capture files, making it useful when you need to follow registration, an INVITE transaction or a failure response without a desktop GUI. It is a signaling investigation tool, not a substitute for RTP quality analysis. A complete-looking call ladder can coexist with a broken media path. Choose Wireshark or endpoint media statistics for loss, jitter and audio-direction questions.
Use a focused evidence set
Start from a bounded authorized capture when possible. Select the affected call by identity and time, then inspect the actual message headers around the failure. Compare request methods, CSeq, tags and routing headers before interpreting a response. Live capture needs suitable permissions and the correct interface. Encrypted signaling and build-specific decryption capabilities require separate consideration; do not assume an arbitrary TLS capture will appear as decoded SIP. Avoid disabling TLS to make the display convenient.
Keep the interpretation reproducible
Record the tool version and the capture point. When a PBX regenerates Call-ID on another leg, identify that leg from PBX logs rather than expecting one flow selection to show the whole conversation. Save only the necessary evidence through the supported workflow and protect it like any other packet capture. After resolving signaling, repeat a real call with two-way media and cleanup. A successful INVITE/200/ACK ladder is one acceptance result, not the whole service test.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.