in reply to Re^3: dumping hashes to pcap files
in thread dumping hashes to pcap files

Sounds like these SIP packets determine when a call starts and when a call ends and that you can assign some kind of callid to that unique call.

I've seen a lot of stupid protocols, but I would be surprised if SIP, Session Initiation Protocol , didn't provide this callid, since this seems to be the entire purpose behind SIP