Lync Behind the Scene – Part 3

this is part 3 of this series Lync Behind the Scene, you can find Part -1 and Part 2 using the following links

Lync Behind the Scene – part 1

Lync Behind the Scene – part 2

SIP Message Syntax


The SIP message Syntax is Human readable, they request line as I mentioned before  consist of “Method” , request URI and finally the Protocol “method” version.

While the Response Line consist of the version, response code and response phrase, as you saw in the previous article the response for the INVITE requests or the CANCEL requests.

Regarding Lync SIP message syntax, it has the basics syntax and a number of extended ones added by Microsoft to the SIP Message header. You will know them as they will be the ones starting with ms- .

SIP REGISTER command in Action

As you saw in previous article how REGISTER command look like, and the expected response from the server, here is a more detailed information on how it actually work step by step:


SIP INVITE command in Action

IM session

When a user want to IM with another one, you need to double click the user to open the chat window, at this second in the background a SIP-INVITE message is sent to the user whom you want to IM with, and after receiving the 200 OK  the MESSAGE SIP message will be sent to process the sending and receiving of IM.

This is the logs from Snooper for an IM session on Lync let’s talk about it


Let me go through the message with you, after the first two lines which is date and time and IP-addresses, you see the MESSAGE command of SIP being used, indicating that this is a IM session.

MESSAGE SIP:;Transport=tls

What you understand is that this is an IM using SIP protocol from the source over port 58408 using TLS.

You will also see a number of headers in the SIP message above like Via, Call-ID, Cseq….etc., let’s talk about those for a moment.

Via: the Via header is used to tell both clients on the end of the SIP session to track the SIP signaling path back to its source, Via keep track of all the hops (each proxy) that handled the request, so that all proxies that this message passed by along the way to its destination, knows who should be the next hop to forward this message to.

Via headers are added in a push/pop methodology, SIP-proxies are responsible to find the next hop that this message should be delivered to, and then forward it to the next hop but not before adding itself to the Via header, and so on each SIP-Proxy this message will pass by in the way will add itself to the header.

In the way back the SIP-Message will pass by the same hops (SIP-Proxies), and each SIP-proxy will examine the Via header till it find itself and remove the entry from the header and forward it to the next hop (SIP-Proxy).

From: contain information about the source of the MESSAGE. The SIP-URI of the Lync client.

To: contain the name and the SIP-URI of the destination of the MESSAGE

Call-ID: this header is unique for each SIP session, if the session was a call and it got transferred, then the Call-ID also get changed, this help in troubleshooting when want to track the session across different servers or systems in your infrastructure.

Cseq: this header (command sequence)  keep track of the sequence of each request within the SIP session, so for example you see in the above screenshot that the Cseq have the value:


because the MESSAGE request was the 3rd request sent in this SIP session , there was two before the MESSAGE one was sent which are:


Cseq 2 INFO

Record-Route: this header indicate a SIP-Proxy server that must stay in the return route of the SIP-Message

Route: this header indicate the return pass.

Branch-ID: this header is added by the SIP-Proxy in case of “Forking” (Multiple Lync clients that user is currently logged in to).

So now after the user sent the INVITE then the MESSAGE SIP-messages to the other users he/she want to IM with, he/she should receive the 200 OK in case of success or 4xx, 5xx or 6xx error in case of failure.

This is an example for a MESSAGE session from my lap using the Ladder view:


Call session

So how does a SIP call actually progress?

So let’s say that user1 want to make a Lync Call to user2, what happen in the background when you click “Lync Call” is the following:

    1. User1 will try to call user2 which have the phone number
    2. User1 will first resolve by asking the DNS for the IP-address of sip-domain “”
    3. User1 get reply that the  IP-address of is
    4. User1 now knows the SIP-proxy server of this SIP-domain.
    5. User1 send INVITE request to (INVITE [w/SDP]
    6. SIP-proxy check where is this phone number is registered on which device / user and which IP-address.
    7. SIP-proxy then finds out       that 123-4567 is located at the IP-address and forward the INVITE Request to it (INVITE [w/SDP] 123-4567@
    8. User2 reply back with 180 Ringing to the SIP-Proxy which forward it to user1 (180 Ringing)
    9. User2 reply back with 200 OK  [w/SDP] to the SIP-Proxy which forward it to user1 (200 OK       [w/SDP]).
    10. User1 reply back with ACK  message to SIP-Proxy which forward it to User2 (ACK
    11. One call is established, the traffic will be between both clients or phones without interfering of the Servers.

SIP SUBSCRIBE command in Action

So now that you have an idea about the different commands and requests of SIP, let’s finish this series of articles by talking about the Presence Feature and what happen behind the scene.

The header concern with providing the Lync Presence is the SUBSCRIBE and NOTIFY, of course for the user to get the presence status of another client, he/she must have the other user in their “Contact List”, the SUBSCRIBE is the message used in the background to get the contact list presence status.


Once the user has logged in to the Lync Client, Lync client will  download the Contact list from the server (Front-end) and a batch subscription will be requested for all the users in this contact list.

The NOTIFY message is used to update the Presence status of the end points to the Server. A Script is running on the server side to get the presence of the users and update them in the server. That’s why no matter how much clients you logged in from, if you are using one of them to make a call for example, server will update your presence to “In a Call” and you will be shown as in a call for the other users that have you in their contact list.

By this I finish this series of Lync Behind the Scene where I explained what happen behind the scene of Lync and the protocols used by Lync and how to read and understand them.

This will be very helpful in troubleshooting Lync.

Author: Lyncdude

A Senior Service Engineer with more than 9 years of experience in Microsoft Exchange and Microsoft Lync Server / Skype for Business. Egyptian guy lives and works in Frankfurt - Germany. what is written in this blog is my own opinion and thoughts, not my employer and does not reflect their opinion

6 thoughts on “Lync Behind the Scene – Part 3”

  1. Hi There,

    We are unable to access the part 1 and 2 of this particular post, could you please help.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: