This is how my sip capture looks. I am making a call from ext 1002 to 1004.

U 2013/07/02 21:13:32.876503 50.84.xxx.yyy:61472 -> 10.164.62.166:5060
SIP/2.0 180 Ringing.
Via: SIP/2.0/UDP 54.235.xxx.xxx:5060;branch=z9hG4bKb0be.e57d8ce.0.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport=5065;branch=z9hG4bKPjgBwd-5iRFfSiG7l6NyTlOMaMK5YQIqpZ.
Record-Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Contact: <sip:1004@172.10.17.88:61472;rinstance=d9e6974a58dc5882>.
To: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
From: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 INVITE.
User-Agent: 3CXPhone 6.0.26523.0.
Content-Length: 0.
.


U 2013/07/02 21:13:32.876798 10.164.62.166:5060 -> 50.84.xxx.xxx:5065
SIP/2.0 180 Ringing.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport=5065;branch=z9hG4bKPjgBwd-5iRFfSiG7l6NyTlOMaMK5YQIqpZ.
Record-Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Contact: <sip:1004@172.10.17.88:61472;alias=50.84.xxx.yyy~61472~1;rinstance=d9e6974a58dc5882>.
To: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
From: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 INVITE.
User-Agent: 3CXPhone 6.0.26523.0.
Content-Length: 0.
.

U 2013/07/02 21:13:37.185706 50.84.xxx.yyy:61472 -> 10.164.62.166:5060
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 54.235.xxx.xxx:5060;branch=z9hG4bKb0be.e57d8ce.0.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport=5065;branch=z9hG4bKPjgBwd-5iRFfSiG7l6NyTlOMaMK5YQIqpZ.
Record-Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Contact: <sip:1004@172.10.17.88:61472;rinstance=d9e6974a58dc5882>.
To: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
From: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 INVITE.
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE.
Content-Type: application/sdp.
Supported: replaces.
User-Agent: 3CXPhone 6.0.26523.0.
Content-Length: 256.
.
v=0.
o=3cxVCE 201458055 127227570 IN IP4 172.10.17.88.
s=3cxVCE Audio Call.
c=IN IP4 172.10.17.88.
t=0 0.
m=audio 40024 RTP/AVP 3 8 0 101.
a=rtpmap:3 GSM/8000.
a=rtpmap:8 PCMA/8000.
a=rtpmap:0 PCMU/8000.
a=rtpmap:101 telephone-event/8000.
a=fmtp:101 0-15.

 2(10205) NOTICE: acc [acc.c:275]: acc_log_request(): ACC: transaction answered: timestamp=1372799617;method=INVITE;from_tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5;to_tag=1718096f;call_id=yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-;code=200;reason=OK;src_user=1002;src_domain=54.235.xxx.xxx;src_ip=50.84.xxx.xxx;dst_ouser=1004;dst_user=1004;dst_domain=172.10.17.88

U 2013/07/02 21:13:37.196544 10.164.62.166:5060 -> 50.84.xxx.xxx:5065
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport=5065;branch=z9hG4bKPjgBwd-5iRFfSiG7l6NyTlOMaMK5YQIqpZ.
Record-Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Contact: <sip:1004@172.10.17.88:61472;alias=50.84.xxx.yyy~61472~1;rinstance=d9e6974a58dc5882>.
To: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
From: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 INVITE.
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE.
Content-Type: application/sdp.
Supported: replaces.
User-Agent: 3CXPhone 6.0.26523.0.
Content-Length: 276.
.
v=0.
o=3cxVCE 201458055 127227570 IN IP4 54.235.xxx.xxx.
s=3cxVCE Audio Call.
c=IN IP4 54.235.xxx.xxx.
t=0 0.
m=audio 47210 RTP/AVP 3 8 0 101.
a=rtpmap:3 GSM/8000.
a=rtpmap:8 PCMA/8000.
a=rtpmap:0 PCMU/8000.
a=rtpmap:101 telephone-event/8000.
a=fmtp:101 0-15.
a=nortpproxy:yes.


U 2013/07/02 21:13:37.437809 50.84.xxx.xxx:5065 -> 10.164.62.166:5060
ACK sip:1004@172.10.17.88:61472;alias=50.84.xxx.yyy~61472~1;rinstance=d9e6974a58dc5882 SIP/2.0.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport;branch=z9hG4bKPj7uuAnd60VwkAO19guEfMd-r5rtuCV1xN.
Max-Forwards: 70.
From: "1002" <sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
To: sip:1004@54.235.xxx.xxx:5060;tag=1718096f.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 ACK.
Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Content-Length:  0.
.


U 2013/07/02 21:13:37.438072 10.164.62.166:5060 -> 50.84.xxx.yyy:61472
ACK sip:1004@172.10.17.88:61472;rinstance=d9e6974a58dc5882 SIP/2.0.
Via: SIP/2.0/UDP 54.235.xxx.xxx:5060;branch=z9hG4bKcydzigwkX.
Via: SIP/2.0/UDP 50.84.xxx.xxx:5065;rport=5065;branch=z9hG4bKPj7uuAnd60VwkAO19guEfMd-r5rtuCV1xN.
Max-Forwards: 16.
From: "1002" <sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
To: sip:1004@54.235.xxx.xxx:5060;tag=1718096f.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 4600 ACK.
Content-Length:  0.
.


U 2013/07/02 21:13:38.157996 50.84.xxx.yyy:61472 -> 10.164.62.166:5060
BYE sip:1002@50.84.xxx.xxx:5065;ob SIP/2.0.
Via: SIP/2.0/UDP 172.10.17.88:61472;branch=z9hG4bK-d8754z-8d614214534e5b28-1---d8754z-;rport.
Max-Forwards: 70.
Route: <sip:54.235.xxx.xxx;lr;nat=yes>.
Contact: <sip:1004@172.10.17.88:61472;rinstance=d9e6974a58dc5882>.
To: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
From: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 2 BYE.
User-Agent: 3CXPhone 6.0.26523.0.
Reason: SIP;description="User Hung Up".
Content-Length: 0.
.


U 2013/07/02 21:13:38.169148 10.164.62.166:5060 -> 50.84.xxx.xxx:5065
BYE sip:1002@50.84.xxx.xxx:5065;ob SIP/2.0.
Via: SIP/2.0/UDP 54.235.xxx.xxx:5060;branch=z9hG4bKefa.00cd6586.0.
Via: SIP/2.0/UDP 172.10.17.88:61472;received=50.84.xxx.yyy;branch=z9hG4bK-d8754z-8d614214534e5b28-1---d8754z-;rport=61472.
Max-Forwards: 16.
Contact: <sip:1004@172.10.17.88:61472;alias=50.84.xxx.yyy~61472~1;rinstance=d9e6974a58dc5882>.
To: "1002"<sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
From: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
CSeq: 2 BYE.
User-Agent: 3CXPhone 6.0.26523.0.
Reason: SIP;description="User Hung Up".
Content-Length: 0.
.

 3(10206) NOTICE: acc [acc.c:275]: acc_log_request(): ACC: transaction answered: timestamp=1372799618;method=BYE;from_tag=1718096f;to_tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5;call_id=yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-;code=200;reason=OK;src_user=1004;src_domain=54.235.xxx.xxx;src_ip=50.84.xxx.yyy;dst_ouser=1002;dst_user=1002;dst_domain=50.84.xxx.xxx

U 2013/07/02 21:13:38.302085 50.84.xxx.xxx:5065 -> 10.164.62.166:5060
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 54.235.xxx.xxx:5060;received=54.235.xxx.xxx;branch=z9hG4bKefa.00cd6586.0.
Via: SIP/2.0/UDP 172.10.17.88:61472;rport=61472;received=50.84.xxx.yyy;branch=z9hG4bK-d8754z-8d614214534e5b28-1---d8754z-.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
From: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
To: "1002" <sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
CSeq: 2 BYE.
Content-Length:  0.
.


U 2013/07/02 21:13:38.302275 10.164.62.166:5060 -> 50.84.xxx.yyy:61472
SIP/2.0 200 OK.
Via: SIP/2.0/UDP 172.10.17.88:61472;rport=61472;received=50.84.xxx.yyy;branch=z9hG4bK-d8754z-8d614214534e5b28-1---d8754z-.
Call-ID: yyVVgjCpXJdhzaMpBkVfbopF1UOtRPP-.
From: <sip:1004@54.235.xxx.xxx:5060>;tag=1718096f.
To: "1002" <sip:1002@54.235.xxx.xxx:5060>;tag=ryAGHAFEBqSFh3wr9OXhLqw4TuzvwfE5.
CSeq: 2 BYE.
Content-Length:  0.