Thank you for your response, Martin!
Here's the output from "ngrep -T -W byline -I tcpdump.pcap z9hG4bK2689300793 port 5060" and the Graph output from Wireshark (hopefully, Outlook doesn't screw up any of the formatting):
input: tcpdump.pcap filter: (ip or ip6) and ( port 5060 ) match: z9hG4bK2689300793 ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ######################################################################## ##### U +4294720244.814738 10.27.192.94:5060 -> 10.27.193.119:5060 INVITE sip:4027160348@wic.west.com SIP/2.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Contact: sip:e514@10.27.192.94. user-agent: oSIP/wicsip-3.3.4. x-west-rg: 0:17. Content-Type: application/sdp. Content-Length: 111 . . v=0. o=WestInteractive 299 0 IN IP4 10.27.202.94. s=t1b. c=IN IP4 10.27.202.94. t=0 0. m=audio 2326 RTP/AVP 0.
# U +0.002405 10.27.193.119:5060 -> 10.27.192.94:5060 SIP/2.0 100 trying -- your call is important to us. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Server: Sip EXpress router (0.9.6 (i386/linux)). Content-Length: 0. Warning: 392 10.27.193.119:5060 "Noisy feedback tells: pid=26790 req_src_ip=10.27.192.94 req_src_port=5060 in_uri=sip:4027160348@wic.west.com out_uri=sip:9990001254027160348@10.27.202.157 via_cnt==1". .
# U +0.000082 10.27.193.119:5060 -> 10.27.202.157:5060 INVITE sip:9990001254027160348@10.27.202.157 SIP/2.0. Max-Forwards: 10. Via: SIP/2.0/UDP 10.27.193.119;branch=z9hG4bKf70c.02c6082.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Contact: sip:e514@10.27.192.94. user-agent: oSIP/wicsip-3.3.4. x-west-rg: 0:17. Content-Type: application/sdp. Content-Length: 111 . . v=0. o=WestInteractive 299 0 IN IP4 10.27.202.94. s=t1b. c=IN IP4 10.27.202.94. t=0 0. m=audio 2326 RTP/AVP 0.
# U +0.007012 10.27.202.157:5060 -> 10.27.193.119:5060 SIP/2.0 100 Trying. Via: SIP/2.0/UDP 10.27.193.119;branch=z9hG4bKf70c.02c6082.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com;tag=gK09857929. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Content-Length: 0. .
###### U +1.011362 10.27.192.94:5060 -> 10.27.193.119:5060 CANCEL sip:4027160348@wic.west.com SIP/2.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 CANCEL. Contact: sip:514+50+1215794994+24+t1b@10.27.192.94. user-agent: oSIP/wicsip-3.3.4. x-west-rg: 0:0. Content-Length: 0. .
# U +0.519930 10.27.202.157:5060 -> 10.27.193.119:5060 SIP/2.0 180 Ringing. Via: SIP/2.0/UDP 10.27.193.119;branch=z9hG4bKf70c.02c6082.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com;tag=gK09857929. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Contact: sip:9990001254027160348@10.27.202.157:5060. Allow: INVITE,ACK,CANCEL,BYE,REGISTER,REFER,INFO,SUBSCRIBE,NOTIFY,PRACK,UPDATE, OPTIONS,MESSAGE,PUBLISH. Content-Length: 181. Content-Disposition: session; handling=optional. Content-Type: application/sdp. . v=0. o=Sonus_UAC 12186 15921 IN IP4 10.27.202.157. s=SIP Media Capabilities. c=IN IP4 10.27.202.153. t=0 0. m=audio 8682 RTP/AVP 0. a=rtpmap:0 PCMU/8000. a=sendrecv. a=maxptime:20.
# U +0.000162 10.27.193.119:5060 -> 10.27.192.94:5060 SIP/2.0 180 Ringing. Max-Forwards: 10. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com;tag=gK09857929. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 INVITE. Contact: sip:9990001254027160348@10.27.202.157:5060. Allow: INVITE,ACK,CANCEL,BYE,REGISTER,REFER,INFO,SUBSCRIBE,NOTIFY,PRACK,UPDATE, OPTIONS,MESSAGE,PUBLISH. Content-Length: 181. Content-Disposition: session; handling=optional. Content-Type: application/sdp. . v=0. o=Sonus_UAC 12186 15921 IN IP4 10.27.202.157. s=SIP Media Capabilities. c=IN IP4 10.27.202.153. t=0 0. m=audio 8682 RTP/AVP 0. a=rtpmap:0 PCMU/8000. a=sendrecv. a=maxptime:20.
### U +0.796229 10.27.192.94:5060 -> 10.27.193.119:5060 CANCEL sip:4027160348@wic.west.com SIP/2.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 CANCEL. Contact: sip:514+50+1215794994+24+t1b@10.27.192.94. user-agent: oSIP/wicsip-3.3.4. x-west-rg: 0:0. Content-Length: 0. .
##################### U +2.989828 10.27.192.94:5060 -> 10.27.193.119:5060 CANCEL sip:4027160348@wic.west.com SIP/2.0. Via: SIP/2.0/UDP 10.27.192.94:5060;branch=z9hG4bK2689300793. From: sip:4027161000@10.27.192.94;tag=2553218672. To: sip:4027160348@wic.west.com. Call-ID: 514+50+1215794994+24+t1b@10.27.192.94. CSeq: 1 CANCEL. Contact: sip:514+50+1215794994+24+t1b@10.27.192.94. user-agent: oSIP/wicsip-3.3.4. x-west-rg: 0:0. Content-Length: 0. .
####exit
|Time | 10.27.192.94 | 10.27.193.119 | 10.27.202.157 | |273.380 | INVITE SDP ( g711U) | |SIP From: sip:4027161000@10.27.192.94 To:sip:4027160348@wic.west.com | |(5060) ------------------> (5060) | | |273.382 | 100 trying -- your call is important to us | |SIP Status | |(5060) <------------------ (5060) | | |273.383 | | INVITE SDP ( g711U) |SIP Request | | |(5060) ------------------> (5060) | |273.390 | | 100 Trying| |SIP Status | | |(5060) <------------------ (5060) | |274.401 | CANCEL | | |SIP Request | |(5060) ------------------> (5060) | | |274.921 | | 180 Ringing SDP ( g711U) |SIP Status | | |(5060) <------------------ (5060) | |274.921 | 180 Ringing SDP ( g711U) | |SIP Status | |(5060) <------------------ (5060) | | |275.717 | CANCEL | | |SIP Request | |(5060) ------------------> (5060) | | |278.707 | CANCEL | | |SIP Request | |(5060) ------------------> (5060) | |