A sample call and how to record with tcpdump and decode with tcpdump, ethereal, and ipgrab.
Running /usr/local/vocal/bin/sipset as user 1010 on a linux PC named "tlclab01" (which will have the SIP URL sip:1010@192.168.194.24) and making a call to 1010@172.18.194.18 (which will have the SIP URL sip:1010@172.18.194.18). Thus user 1010 on tlclab01 makes a call, which user 1010 on 172.18.194.18 (a Cisco ATA 186) answers. At the end of the call, the user on tlclab01 hangs up.
Both of the above reports appear here with permission of the authors.
Stefano Ventura, VoIP & Security for EnterpriseLinks to an external site., Séminaire Grifes, Institute of Information and Communication Technologies (IICT), Haute Ecole d'Ingénierie et de Gestion du Canton de Vaud (HEIG-VD), Yverdon Switzerland, 8.11.2005 - a very nice introduction to VoIP security (in french)