### Description
Captured sip on a server using Captagent, when using UDP the destination_ip is parsed from the message itself when using TCP the destination_ip and destination_port is of the server running Kamailio.
### Troubleshooting
#### Reproduction
Sipcapture using Kamailio on TCP
#### SIP Traffic
<!-- If the issue is exposed by processing specific SIP messages, grab them with ngrep or save in a pcap file, then add them next, or attach to issue, or provide a link to download them (e.g., to a pastebin site). -->
``` T 10.203.134.187:10398 -> 10.203.134.194:9060 [AP] HEP3.@................................... Z&..... . ................ .........
........
.........myhep......SIP/2.0 487 Request cancelled. Via: SIP/2.0/UDP 10.203.134.187;received=10.203.134.187;rport=5060;branch=z9hG4bKUgUv1StZ9HmgF. From: "bal bal" sip:17325559837@10.203.134.187;tag=ZSNe61tKX2gFp. To: sip:VH111@call.net;tag=eee99bc01afb99338debc1f2a2cfb1a1-c5c8. Call-ID: 3ed76454-5479-1236-b8a0-0688e01b7b70. CSeq: 115908963 INVITE. Server: OpenSIPS (2.2.5 (x86_64/linux)). Content-Length: 0. .
##```
### Possible Solutions
<!-- If you found a solution or workaround for the issue, describe it. Ideally, provide a pull request with a fix. --> ``` Using the parsed header, something like: $var(dstip) = $hep(0x004); ``` ### Additional Information
* **Kamailio Version** - output of `kamailio -v`
``` version: kamailio 5.2.0-dev0 (x86_64/linux) ```
* **Operating System**:
<!-- Details about the operating system, the type: Linux (e.g.,: Debian 8.4, Ubuntu 16.04, CentOS 7.1, ...), MacOS, xBSD, Solaris, ...; Kernel details (output of `uname -a`) -->
``` Debian 8.4 ```