13:28:06.295419 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 1001) 192.168.0.36.sip > 192.168.9.35.sip: SIP, length: 973
        INVITE sip:TEST@192.168.9.35:5060;user=phone;behindnat SIP/2.0
        Max-Forwards: 19
        Session-Expires: 3600;refresher=uas
        Min-SE: 3600
        Supported: timer, 100rel
        To: <sip:3339917@192.168.9.35:5060;user=phone;behindnat>
        From: <sip:4955609595@TEST.sipXXX.ru>;tag=48550
        Call-ID: 3267161-3672469686-295059@sbc-0.sipXXX.ru
        CSeq: 1 INVITE
        Allow: PRACK
        Allow: PUBLISH
        Allow: OPTIONS
        Allow: REFER
        Allow: INFO
        Allow: MESSAGE
        Allow: UPDATE
        Allow: NOTIFY
        Allow: SUBSCRIBE
        Allow: REGISTER
        Allow: ACK
        Allow: CANCEL
        Allow: BYE
        Allow: INVITE
        Via: SIP/2.0/UDP
192.168.0.36:5060;branch=z9hG4bK391cc8d543e07e202d2712bbaca002e0
        Contact: <sip:4955609595@192.168.0.36:5060>
        Content-Type: application/sdp
        Accept: application/sdp
        P-Charging-Vector:
icid-value=8216a88c-2b21-1b21-a1ac-000e0cede232;icid-generated-at=10.100.2.92
        Content-Length: 132

        v=0
        o=sbc-0 244081663 244081663 IN IP4 192.168.0.36
        s=sip call
        c=IN IP4 192.168.0.39
        t=0 0
        m=audio 12330 RTP/AVP 8 18
        a=ptime:20

13:28:06.326319 IP (tos 0x0, ttl 62, id 23437, offset 0, flags [DF],
proto UDP (17), length 341) 192.168.9.35.sip > 192.168.0.36.sip: SIP,
length: 313
        SIP/2.0 100 Trying
        Via: SIP/2.0/UDP
192.168.0.36:5060;received=192.168.0.36;branch=z9hG4bK391cc8d543e07e202d2712bbaca002e0
        Call-ID: 3267161-3672469686-295059@sbc-0.sipXXX.ru
        From: <sip:4955609595@TEST.sipXXX.ru>;tag=48550
        To: <sip:3339917@192.168.9.35;user=phone;behindnat>
        CSeq: 1 INVITE
        Content-Length:  0


13:28:06.355124 IP (tos 0x0, ttl 62, id 23438, offset 0, flags [DF],
proto UDP (17), length 381) 192.168.9.35.sip > 192.168.0.36.sip: SIP,
length: 353
        SIP/2.0 403 Forbidden
        Via: SIP/2.0/UDP
192.168.0.36:5060;received=192.168.0.36;branch=z9hG4bK391cc8d543e07e202d2712bbaca002e0
        Call-ID: 3267161-3672469686-295059@sbc-0.sipXXX.ru
        From: <sip:4955609595@TEST.sipXXX.ru>;tag=48550
        To:
<sip:3339917@192.168.9.35;user=phone;behindnat>;tag=KpP.yjtnAlZiIB8UGMmTQvnQklD8HVGC
        CSeq: 1 INVITE
        Content-Length:  0


13:28:06.355520 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto
UDP (17), length 664) 192.168.0.36.sip > 192.168.9.35.sip: SIP, length: 636
        ACK sip:TEST@192.168.9.35:5060;user=phone;behindnat SIP/2.0
        Max-Forwards: 70
        To:
<sip:3339917@192.168.9.35:5060;user=phone;behindnat>;tag=KpP.yjtnAlZiIB8UGMmTQvnQklD8HVGC
        From: <sip:4955609595@TEST.sipXXX.ru>;tag=48550
        Call-ID: 3267161-3672469686-295059@sbc-0.sipXXX.ru
        CSeq: 1 ACK
        Via: SIP/2.0/UDP
192.168.0.36:5060;branch=z9hG4bK391cc8d543e07e202d2712bbaca002e0
        Contact: <sip:4955609595@192.168.0.36:5060>
        User-Agent: Nortel SESM 17.0.22.15
        X-nt-corr-id: 8216a88c-2b21-1b21-a1ac-000e0cede232
        X-nt-location: -1
        P-Charging-Vector:
icid-value=8216a88c-2b21-1b21-a1ac-000e0cede232;icid-generated-at=10.100.2.92
        Content-Length: 0