Howdy,

This is Part 2 of Lync Behind the Scene, I will continue with talking about SIP and the anatomy of the Protocol.

you can find here Lync Behind the Scene – Part 1

SIP Anatomy

SIP (Session Initiation Protocol), used in Lync is version 2 (SIPv2) which is the outcome of combining two protocols together, SIPv1 which was based on UDP,

And SCIP (Simple Conference Invitation Protocol) which is similar to HTTP and based on TCP.

SIP is an application layer protocol that is used to create, Modify and Terminate Sessions between end points (User – to – User or User – to – Server), also SIP can invite participants to an already existing session.

In Lync, SIP uses TCP port 5060 and port 5061 for SSL encrypted connection.

SIP does not carry any media or data, it’s only a signaling protocol.

SIP Basic Commands

SIP is like HTTP, it has a number of commands that is used within it, below is a list of some of those command that you will be seeing a lot in Lync when troubleshooting

Command	use
REGISTER	Used for register/ logon to the SIP server “Lync Front end or Director server”
INVITE	Initiate a session, usually include SDP part with the initiator media capability
ACK	The Reply that the command is received
BYE	Terminate the session, can be sent by any of the end points participating in the session
CANCEL	Terminate the session, usually sent by the Initiator of the session
OPTIONS	Queries the capability of the other device or Server.

Those are the basic command shipped with SIP, but it has been extended to accommodate more functionalities

SIP Extended Commands

Command	use
INFO	Gives mid-session related information
MESSAGE	Used for IM
NOTIFY	Publish the outcome of events
PUBLISH	Publish the status information as in presence
SUBSCRIBE	Used to get information of receipt E.g. get the presence of your contact list
UPDATE	Modify session parameters

SIP Responses

To finish the SIP Anatomy section, I will end it with listing the different SIP responses.

Response Code	Response Type	Example
1xx	Information	100 – trying180 – ringing
2xx	Success or “OK”	200 – OK
3xx	Redirect	301 – moved permanently
4xx	Client Error	401 – Unauthorized
5xx	Server Error	500 – Internal server error
6xx	Global Error	603 – decline

For the full list of the responses of SIP you can check this article on Wikipedia http://en.wikipedia.org/wiki/List_of_SIP_response_codes

Talk SIP

Now let’s talk some basic SIP signaling, this should help you read and understand the Lync SIP Stack logs for better troubleshooting in the future.

Lync SIP signaling

The REGISTER

The REGISTER command sent when the user try to logon to the Lync client. It consist of

(REGISTER “method”+ “SIP-domain” + “Protocol version”)

REGISTER sip:lyncdude.net SIP/2.0

And this is what you going to see on Snooper

And usually you might see a number of (401 Unauthorized) responses before it manage to agree on an authentication method “Encryption”

The INVITE

The INVITE command is the Initiation of the SIP session, usually SDP is carried in the INVITE.

The line usually consist of “a method” + “URI” + “Protocol version” , something line the following:

INVITE sip:lyncdude@lyncdude.net SIP/2.0

And the answer if status is ok should be like:

SIP/2.0 200 OK

If you use the new Lync 2013 snooper and choice the ladder diagram you should see this:

So the above screenshot is taken for an IM session invitation, this part is between the user initiating the session and the SIP Server “Lync Front End server”,

Which then forward the request to the user “Lyncdude@lyncdude.net” and get the response from the user and forward it back to the creator of the session.

I didn’t want to use self-drawn diagram for two reasons, first I wanted to show you directly what you will be seeing in the Snooper, second I was lazy to do so :p

The ACK

As you see in the previous screenshot, the fourth line is the ACK line, it is required for any request sent in a SIP session to get a response back that it is acknowledge, because the INVITE request might take longer than expected to receive a response, for example the user might not by near his laptop or PC.

If there is multiple devices that the users is logged in Lync from (forking), then multiple ACK responses will be received, also ACK can carry additional information within its SDP.

The CANCEL

The CANCEL command is used to cancel any pending INVITE(s) requests, usually it’s sent by the Creator of the session and it look like following, this screenshot is for a CANCEL of a call session:

As you can see above, like the INVITE request, CANCEL also get a reply 200 ok and “4xx server response” in this case “487 Request terminated”

Then it also need to be Acknowledged with an ACK reply.

The BYE

The BYE command is used to close (Disconnect) a live session

Response expected is 200 OK in case of success.

wait in Part-3 where I will explain how SIP work with different scenarios, how is the SIP message syntax is written.

Lync Behind the Scene – part 3

Author: Lyncdude

A Senior Service Engineer with more than 9 years of experience in Microsoft Exchange and Microsoft Lync Server / Skype for Business. Egyptian guy lives and works in Frankfurt - Germany. what is written in this blog is my own opinion and thoughts, not my employer and does not reflect their opinion View all posts by Lyncdude