The signaling protocol, defined in RFC 3261, used to set up, modify, and tear down voice and video calls over IP networks.
SIP handles the conversation about a call rather than the call audio itself. A caller sends an INVITE describing who is calling, who is being called, and what media formats it supports. The far end responds with provisional and final responses, such as 180 Ringing or 200 OK, and the media then flows separately, typically over RTP.
SIP messages are text based and structured much like HTTP, with a request line or status line, a set of headers, and an optional body. Headers such as From, To, P-Asserted-Identity, Diversion, and Identity carry the information that matters most for caller ID, routing, and authentication. Each header has defined rules about who may add or change it, and those rules are frequently bent in practice by equipment along the path.
Because SIP is flexible and extensible, implementations vary widely between vendors and carriers. Much of the practical work of running a VoIP network involves normalizing headers and behaviors so that calls interoperate cleanly across interconnects. That variation is also why authentication data can be lost in transit: a header one network relies on may be treated as optional or unknown by another.
Why it matters to carriers
Nearly every fraud signal, compliance record, and authentication result in a modern voice network lives in SIP signaling. Being able to read and interpret SIP traces is essential when diagnosing why a call failed verification, why a header disappeared, or which upstream provider sent a suspicious call.