When looking for SIP traffic in Wireshark, you can start with the Display Filter sip. Here are a couple more specific filters.

To find a specific type of SIP packet:


Sometimes you need to match registration traffic on the server and client (two Wireshark sessions). To see matching traffic, in a SIP Message Header, find a Call-ID on one side, then use a display filter like this on both the server side and client side:


It may be helpful to combine several filters:

ip.addr = and sip.CSeq.method==REGISTER and sip.from.user==120