root@router:~# tcpdump -i eth1 port 5060 and host
tel2.moscow.rt.rutcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
21:08:13.757145 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP
21:08:13.769898 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP: REGISTER sip:Onlime SIP/2.0
21:08:14.256613 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP: REGISTER sip:Onlime SIP/2.0
21:08:15.262529 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP: REGISTER sip:Onlime SIP/2.0
21:08:17.144267 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP: REGISTER sip:Onlime SIP/2.0
21:08:21.137167 IP broadband-37-110-33-XXX.ip.moscow.rt.ru.1024 > broadband-77-37-128-140.ip.moscow.rt.ru.5060: SIP: REGISTER sip:Onlime SIP/2.0
21:08:23.795520 IP broadband-77-37-128-140.ip.moscow.rt.ru.5060 > broadband-37-110-33-XXX.ip.moscow.rt.ru.1024: SIP: SIP/2.0 504 Server Time-out
^C
7 packets captured
12 packets received by filter