Fundamentals
How to Read a SIP Ladder Diagram
A ladder diagram is a call drawn as time flowing downward: each participant gets a vertical line, each SIP message is an arrow between them, labeled with its method or response code. It is the single most useful visualization in VoIP — the view Wireshark, SBCs and carrier traces all offer — because it compresses an entire call's story into a shape you can judge at a glance: healthy calls have a rhythm, and faults break the rhythm in recognizable places.
This guide teaches the reading, then shows three worked ladders: a healthy call, a call the callee rejects, and a call that dies at its session refresh.
The healthy rhythm
Read top to bottom. The caller's INVITE opens; provisional responses (1xx) report progress — 100 Trying (received), 180 Ringing. The 200 OK answers, the caller's ACK completes the handshake, media flows (shown as a thick double arrow in most tools), and BYE/200 OK closes cleanly. Authentication detours (a 401 challenge and a second INVITE carrying credentials) and transfers (REFER/NOTIFY) insert extra verses without breaking the song.
Caller Platform Callee |--- INVITE ------>|--- INVITE --------->| |<-- 100 Trying ---|<-- 100 Trying ------| |<-- 180 Ringing --|<-- 180 Ringing -----| |<-- 200 OK -------|<-- 200 OK ----------| |--- ACK --------->|--- ACK ------------>| |<=========== RTP media both ways ======>| |--- BYE --------->|--- BYE ------------>| |<-- 200 OK -------|<-- 200 OK ----------|
Two broken rhythms
The rejected call: the ladder ends early with a final error response — here 486 from the callee — and an ACK acknowledging the error (note: failed INVITEs are ACKed too). No media ever flows. The code and its sender are the whole story; the code library in this site takes it from there.
Caller Platform Callee
|--- INVITE ------>|--- INVITE --------->|
|<-- 100 Trying ---|<-- 100 Trying ------|
|<-- 486 Busy -----|<-- 486 Busy Here ----|
|--- ACK --------->|--- ACK ------------>|
# Call over. The endpoint itself refused: see the 486 guide.
Reading any ladder in 30 seconds
- Find the INVITE and follow the arrows downward: does the call reach 200 OK + ACK (established) or die at a final error response? Name that code and its sender.
- Check the media band: is there an RTP section at all, and does it run until BYE (or stop abruptly mid-call — the drop signature)?
- Look for detours: 401 challenges (normal once), CANCEL (caller gave up while ringing), REFER (transfer), re-INVITEs (hold, refresh, T.38 switch) — each explains a user-visible event.
- Check who sends BYE: the polite teardown's author is diagnostic (user, endpoint, or platform) for drop tickets.
- Annotate times: gaps between arrows are post-dial delay, refresh intervals, and timeout envelopes — several fault families are visible only in the timing.
Frequently asked questions
- Where do I get a ladder diagram for my calls?
- Wireshark: capture the call, then Telephony → SIP Flows (or VoIP Calls). Hosted platforms and SBCs offer 'call ladder'/'SIP trace' views per call in their portals — ask support for the ladder when escalating; it is the artifact both sides can read.
- What's the difference between a ladder and a packet list?
- Altitude. The packet list shows every packet (including RTP and retransmissions — essential for media work); the ladder abstracts to SIP messages per actor, which is the right height for call-flow questions. Professionals move between both views of the same capture.
- Our ladder shows the same INVITE repeated. Is that a fault?
- Those are retransmissions — normal on UDP when a response is slow, and diagnostic when they never stop: a ladder full of repeated INVITEs marching toward a 408 is a path that swallows packets (see the 408 guide).