Session Initiation Protocol

[James Bond]

I've been playing a lot with Session Initiation Protocol (SIP).

When I would sniff a packet, I would see the information from each layer, starting with layer 1 of the OSI model:

Data
Ethernet
IP
UDP
SIP

I had been assuming the SIP operated at layer 5, session. After all, we all know that the Session layer is the layer which "creates and breaks down internet connection sessions".

I was very suprised to find out that SIP opporates at layer 7. Why would a protocol like this operate at level 7? All it does is organize sessions..

 

[cmetz]

First of all, I think you've been tricked by the academics. In text-book land, protocols all fit neatly into the idealized OSI model. In the real world, they don't, but it doesn't really matter. SIP runs on top of UDP, except when it doesn't. That's the thing you really need to know. There is no visible on the wire thing that says it's a "layer 5 protocol" or a "layer 7 protocol" - that's just the opinion of someone who is trying to slot the reality into the idealized model. It makes absolutely no difference back in the real world.

I would personally call SIP a L5 protocol (session) if I had to distinguish it. I'm not sure where you're getting that it's a L7 protocol (application). I think your source might be confused.

 

[spidey07]

heh, cmetz you are right on.

I haven't really looked into SIP that much but for the most part TCP/IP falls into the DoD model - everything above layer4 = application.

Very rarely do you have actual L5 or L6 info. But microsoft for some reason wants to use it and add overhead.

 

[dphantom]

SIP is formally defined as a L7 protocol. The "session" sometimes makes it confusing what layer the protocol does really reside at. Link
I have done work with VoIP and SIP in the past and have regarded it as a L7 protocol.

Won't disagree with cmetz or spidey though as far as where everything above 4 is application traffic.