Lync Behind the Scene – Part 2


This is Part 2 of Lync Behind the Scene, I will continue with talking about SIP and the anatomy of the Protocol.

you can find here Lync Behind the Scene – Part 1

SIP Anatomy

SIP (Session Initiation Protocol), used in Lync is version 2 (SIPv2) which is the outcome of combining two protocols together, SIPv1 which was based on UDP,

And SCIP (Simple Conference Invitation Protocol) which is similar to HTTP and based on TCP.

SIP is an application layer protocol that is used to create, Modify and Terminate Sessions between end points (User – to – User or User – to – Server), also SIP can invite participants to an already existing session.

In Lync, SIP uses TCP port 5060 and port 5061 for SSL encrypted connection.

SIP does not carry any media or data, it’s only a signaling protocol.

SIP Basic Commands

SIP is like HTTP, it has a number of commands that is used within it, below is a list of some of those command that you will be seeing a lot in Lync when troubleshooting

Command use
REGISTER Used for register/   logon to the SIP server “Lync Front end or Director server”
INVITE Initiate a   session, usually include SDP part with the initiator media capability
ACK The Reply that the   command is received
BYE Terminate the   session, can be sent by any of the end points participating in the session
CANCEL Terminate the   session, usually sent by the Initiator of the session
OPTIONS Queries the   capability of the other device or Server.

Those are the basic command shipped with SIP, but it has been extended to accommodate more functionalities

SIP Extended Commands

Command use
INFO Gives mid-session   related information
NOTIFY Publish the   outcome of events
PUBLISH Publish the status   information as in presence
SUBSCRIBE Used to get   information of receipt E.g. get the presence of your contact list
UPDATE Modify session   parameters

SIP Responses

To finish the SIP Anatomy section, I will end it with listing the different SIP responses.

Response Code Response Type Example
1xx Information 100 – trying180 – ringing
2xx Success or   “OK” 200 – OK
3xx Redirect 301 – moved   permanently
4xx Client Error 401 – Unauthorized
5xx Server Error 500 – Internal   server error
6xx Global Error 603 – decline

For the full list of the responses of SIP you can check this article on Wikipedia

Talk SIP

Now let’s talk some basic SIP signaling, this should help you read and understand the Lync SIP Stack logs for better troubleshooting in the future.

Lync SIP signaling


The REGISTER command sent when the user try to logon to the Lync client. It consist of

(REGISTER “method”+ “SIP-domain” + “Protocol version”)



And this is what you going to see on Snooper


And usually you might see a number of (401 Unauthorized) responses before  it manage to agree on an authentication method “Encryption”


The INVITE command is the Initiation of the SIP session, usually SDP is carried in the INVITE.

The line usually consist of “a method” + “URI” + “Protocol version” , something line the following:


And the answer if status is ok should be like:


SIP/2.0 200 OK

If you use the new Lync 2013 snooper and choice the ladder diagram you should see this:

So the above screenshot is taken for an IM session invitation, this part is between the user initiating the session and the SIP Server “Lync Front End server”,

Which then forward the request to the user “” and get the response from the user and forward it back to the creator of the session.

I didn’t want to use self-drawn diagram for two reasons, first I wanted to show you directly what you will be seeing in the Snooper, second I was lazy to do so :p


As you see in the previous screenshot, the fourth line is the ACK line, it is required for any request sent in a SIP session to get a response back that it is acknowledge, because the INVITE request might take longer than expected to receive a response, for example the user might not by near his laptop or PC.

If there is multiple devices that the users is logged in Lync from (forking), then multiple ACK responses will be received, also ACK can carry additional information within its SDP.


The CANCEL command is used to cancel any pending INVITE(s) requests, usually it’s sent by the Creator of the session and it look like following, this screenshot is for a CANCEL of a call session:


As you can see above, like the INVITE request, CANCEL also get a reply 200 ok and “4xx server response” in this case “487 Request terminated”

Then it also need to be Acknowledged with an ACK reply.


The BYE command is used to close (Disconnect) a live session

Response expected is 200 OK in case of success.

SIP_BYE_L - Copy

wait in Part-3 where I will explain how SIP work with different scenarios, how is the SIP message syntax is written.

Lync Behind the Scene – part 3

Author: Lyncdude

A Senior Service Engineer with more than 9 years of experience in Microsoft Exchange and Microsoft Lync Server / Skype for Business. Egyptian guy lives and works in Frankfurt - Germany. what is written in this blog is my own opinion and thoughts, not my employer and does not reflect their opinion

3 thoughts on “Lync Behind the Scene – Part 2”

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: