Without seeing the sip traffic, it is hard to figure out what is going wrong. Instead of the pcap file, you can grab the sip traffic with ngrep, like:
``` ngrep -d any -qt -W byline port 5060 ```
Then replace the IP addresses and other sensitive tokens with generic values, so you can share it here.