What is SIP (Session Initiation Protocol)?

Session Initiation Protocol (SIP) is the signalling protocol that sets up, manages, and tears down voice, video, and messaging sessions over IP networks. Standardised in RFC 3261 in 2002, it's the layer that makes a modern VoIP call possible — when one phone dials another over the internet, SIP is what handles the ring, the answer, and the hang-up. It doesn't carry the audio itself; it negotiates the connection and then media (typically RTP) flows separately. SIP runs on port 5060 unencrypted, or 5061 over TLS — that secured variant is called SIPS.

SIP, sometimes called SIP signalling, is the control language of internet telephony. Think of it like the instructions on an envelope rather than the letter inside — it tells the network who's calling whom, what kind of session they want, and how to find each other, but the actual conversation rides on a separate stream. That separation is why SIP is so flexible: the same protocol can set up a phone call, a video conference, a chat session, or a screen share, and the media format is negotiated on the fly.

How SIP actually works on a call

When you pick up a SIP phone and dial, your handset sends an INVITE message to a SIP server, which routes it to the recipient. The recipient's phone replies — first with a 100 Trying, then 180 Ringing while it rings, then 200 OK once it's answered. Your phone sends an ACK to confirm, and at that point the signalling has done its job. The two endpoints now know each other's IP address, what audio codec they've agreed on, and which port to send the audio to. Voice packets start flowing as RTP, completely separate from the SIP messages.

Hanging up is just as structured: one side sends a BYE, the other replies 200 OK, and the session ends. This whole conversation — INVITE, Ringing, OK, ACK, BYE — is what SIP does. Everything else (the actual voice quality, the call recording, the DTMF tones the caller presses) happens at a different layer.

Why SIP matters for contact centres

BT is switching off the UK's analogue and ISDN networks by January 2027, which means every contact centre still on legacy lines has to migrate. Almost all of them are migrating to SIP — usually via SIP trunking, where a provider delivers virtual phone lines over your internet connection instead of physical copper. A modern cloud contact centre is essentially a SIP-aware platform with agent software, queueing, and reporting built on top.

That matters for payments because SIP is the layer where DTMF tones — the beeps from the caller's keypad — are routed. SIP can carry DTMF two ways: in-band (as actual audio tones inside the RTP stream) or out-of-band (as SIP INFO messages or RFC 4733 named telephone events). Knowing which method a contact centre uses is the first question any DTMF-masking solution has to answer, because the masking technique is different for each.

SIP, SBCs, and security

Most enterprise SIP deployments sit behind a Session Border Controller, which acts as a firewall and traffic manager for SIP traffic. SBCs handle the messy business of NAT traversal, codec translation, and protecting the SIP infrastructure from attacks like registration floods or toll fraud. They're also frequently where DTMF masking happens at the network layer — the SBC intercepts the RTP stream during card capture, replaces the keypad tones with a flat tone for the agent and the call recorder, and forwards the real digits to the payment gateway.

Securing SIP itself means using SIPS (SIP over TLS) for the signalling and SRTP for the media. Without those, a determined attacker on the network can read the signalling messages and even reconstruct the audio. For phone payments that obviously isn't acceptable, so encrypted SIP is the baseline expectation in any PCI-relevant deployment.

SIP versus the old PSTN world

The protocol SIP is replacing — the legacy PSTN with its ISDN circuits and channel-associated signalling — was a closed system controlled by telcos. SIP is an open IETF standard, which is why it spread so fast. Any phone, any softphone, any call-centre platform can speak SIP, and they can all interoperate. The trade-off is complexity: SIP has dozens of message types, hundreds of headers, and a long list of optional extensions (RFC 3261 alone is 269 pages). Most of that complexity is hidden from end users, but if you're integrating a payment platform with a SIP-based contact centre, you'll spend a lot of time reading RFCs.