Voice over IP protocol families

There are currently four families of VoIP protocols: SIP, H.323 and H.248 based, and SIGTRAN.

Call Control

The call control protocols establish, modify and release connections.

SIP family

Based on IETF specifications:

H.323 family

Based on ITU-T specifications:

  • H323: "Packet-based multimedia communications systems"

  • H225: "call control protocol"

  • H235: "Security"

  • H245: "Media control protocol"

  • H450: "Supplementary Services"

  • Q.931: "ISDN user-network interface layer 3 specification for basic call control"

  • H223: Multiplexing protocol for circuit-based multimedia communications system

To correctly dissect these protocols preference settings of TCP, TPKT, Q.931 and H225 must be correctly set.

H.248 family

Based on IETF and ITU-T specifications:

SIGTRAN familiy

SIGTRAN is often used in connections towards PSTN.

Proprietary protocols

Cisco proprietary protocols:

  • SKINNY: Terminal control protocol.

Digium proprietary protocols:

  • IAX2: A standalone VoIP protocol primarily developed for communication between Asterisk servers.

Nortel proprietary protocols:

  • UNISTIM: A stimulus protocol for IP phones.


Both SIP and H323 uses the same RTP/RTCP transport protocols.

  • RTP: "RTP: A Transport Protocol for Real-Time Applications" RFC3550

  • RTCP: "Real-time Control Protocol", used together with RTP

  • T38: "Real-time facsimile (T.38), Fax-over-IP"

Movement toward secure communications involve these protocols

  • SRTP: "The Secure Real-time Transport Protocol (SRTP)" RFC3711

  • MIKEY: "MIKEY: Multimedia Internet KEYing" RFC3830

Authentication, Authorization and Accounting


As far as I know MGCP is a VoIP family too. So you should put MGCP + H248 in call control section.- Cedric MILLET

Imported from https://wiki.wireshark.org/VOIPProtocolFamily on 2020-08-11 23:27:12 UTC