What Is SIP? Session Initiation Protocol Explained
Before you hear a single word of a call, a silent negotiation has already happened — two systems agreeing on who's calling, how they'll encode the audio, and where to send it. That negotiation is SIP, and if it's left unlocked, it's the first door an attacker tries.
SIP (Session Initiation Protocol) is the signalling language IP phones use to start, manage and end calls. It doesn't carry your voice — it sets up the session and then hands the audio to a media protocol like RTP.
Signalling, not voice
SIP is often mistaken for the thing that carries your call. It isn't. SIP is the choreography: REGISTER (a phone telling the server “I'm here”), INVITE (start a call), the ringing and answering, and BYE (hang up). Once both sides agree on the details, the actual audio flows over RTP, usually on a different port.
This separation is why you'll see two security settings on any serious phone system: one for signalling, one for media. Securing one without the other leaves half the call exposed.
Why SIP is a favourite target
SIP speaks over the network in plain text by default, on the well-known port 5060. That makes it trivially easy to find and, if unprotected, to abuse: attackers scan the internet for exposed SIP ports, try to register as an extension, and place fraudulent calls on your account.
The fix is to run SIP over TLS (encrypted signalling, usually port 5061), require strong per-extension credentials, and never expose a raw SIP port to the public internet. A system that ships with TLS on by default has already closed the most common door.
SIP beyond the office
SIP is also how your phone system talks to the outside world — to the telephone network through a SIP trunk, and to video room systems and softphones. Because it's an open standard, SIP equipment from different vendors interoperates, which is what lets you reuse existing handsets when you change platforms.
Frequently asked questions
What's the difference between SIP and VoIP?
VoIP is the broad idea of carrying calls over IP. SIP is the specific protocol most VoIP systems use to set those calls up. SIP is a part of how VoIP works.
What port does SIP use?
SIP uses 5060 for unencrypted signalling and 5061 for SIP over TLS (encrypted). Media (RTP) uses a separate range of ports. Exposing 5060 to the public internet is a common and avoidable risk.