When placing a call through an Asterisk SIP server, the server will open 2 ports for every media channel:

  • 2 ports for call leg 1 video
  • 2 ports for call leg 2 video
  • 2 ports for call leg 1 audio
  • 2 ports for call leg 2 audio

Since Asterisk's media communication is bidirectional, why does it need four ports (2 video, 2 audio) for every call leg as opposed to just 2 (1 video, 1 audio)? It is indeed only using the one port for communication in a particular leg, but netstat is very clear that there are two ports open, and the second port opened (the allegedly 'unused' port) is always +1 from the used port. For example, the call leg 1 video port is 17744, but it also opens a port 17745.

Wireshark analysis of local traffic:

enter image description here

netstat analysis on Asterisk server:

enter image description here

You can see from the above (partially, I didn't include Wireshark of the other call leg - for brevity) that the same question applies to the audio and video ports of all call legs, so there are four cases of this question per call.

So: Why is there an extra port on the server for each communication path?

Is asterisk not truly bidirectional in its media communication and just forwards the traffic from one port to another?

Also, is this the usual behavior in Asterisk, or might I have something in my configuration that would affect this?


That will be your RTCP stream. See your SDP.

  • That's exactly what it is. Lesson learned to go through my SDP more carefully before looking elsewhere. Thank you. – MD-7 Jan 18 at 18:03

I’ve only ever seen SIP calls use unidirectional UDP RTP audio streams, so you would need 2 for each leg.

You've already used Wireshark to capture a SIP call - the Telphony menu offers some VoIP specific analysis tools - you could try showing SIP streams in the capture you made above - that will show the call signalling. Showing RTP streams will show the media streams you were asking about. Selecting a stream and clicking Analyze will pop up a dialog box with a lot of packet data and a button for Play Streams. You'll likely find each stream in your capture will contain one side of the conversation.

For two-way communication over a single port, I’m guessing you were thinking about IAX / IAX2, which was developed by the Asterisk project.

From https://www.voip-info.org/iax/

The IAX revision 2 protocol was developed by Asterisk team as alternative to SIP, H.323, etc. when connecting to other devices that support IAX (a limited list at the moment, but growing very rapidly). ... IAX2 uses a single UDP port 4569, and thus works well in NAT environments (the obsolete IAX1 protocol used port 5036). IAX2 uses ONLY one udp port for both control and data traffic. As outlined in point 4 of the IAX versus SIP topic with IAX you will always have audio if the control connection can be established.

  • Thank you for your well thought out answer. Your comment is interesting about the unidirectional RTP streams. If each call leg needs two ports for audio, where can I see this happening in my analysis? The wireshark flow sequence above shows the entire flow for that leg, and I only see one port (5854). Shouldn't the other port also be seen here in some way (whether it is the sending/receiving port)? – MD-7 Jan 18 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.