How to capture a SIP trace with Twilio
Twilio's SIP Debugger (Console → Voice → Debugger) records every SIP message Twilio sees on Elastic SIP Trunks, BYOC, SIP Domains, and Programmable Voice. You can download the trace as PCAP per call, or stream errors via webhook.
When to reach for this
- You're debugging a Twilio Elastic SIP Trunk, BYOC carrier, or a SIP Domain
- The far end is *your* PBX/SBC and you want Twilio's view of the same call
- You need to file a Twilio support ticket and they ask for the SIP
Before you start
- Twilio Console access on the project that owns the trunk / SIP Domain
- The Call SID, From/To number, or approximate timestamp of the failing call
- (Optional) `twilio-cli` installed for scripted pulls
Steps
- 1
Find the call in the SIP Debugger
In the Twilio Console go to Monitor → Logs → Errors (or Voice → Debugger). Filter by date range and CallSid — or by error code if you don't know the SID.
- 2
Open the call detail
Click the row. Twilio shows the full SIP dialog as Twilio received and sent it, including any 4xx/5xx it generated and why (e.g. `13225 Voice URL returned an invalid response`).
- 3
Download the PCAP
On the call detail page, click `Download PCAP`. This is a real pcap of the SIP messages Twilio's edge saw — feed it straight into SIP Flow.
- 4
Or grab the log via the REST API
For automation, fetch the call's notifications via the REST API. `MessageDate`, `ErrorCode`, and `MoreInfo` will point you at the right Twilio docs page.
curl -G "https://api.twilio.com/2010-04-01/Accounts/$TWILIO_SID/Calls/$CALL_SID/Notifications.json" \ -u "$TWILIO_SID:$TWILIO_AUTH_TOKEN" - 5
Set up an SNS / webhook for ongoing capture
For repeat issues, configure a Status Callback on the trunk so Twilio POSTs every call's metadata + error code as it happens. Bundle that with the per-call PCAPs and you have a near- realtime trace pipeline.
Tips from people who've done this 1,000 times
- SIP Debugger retention is 30 days for most accounts — pull the PCAP before the call ages out
- Twilio's PCAP only contains *Twilio's* view of the call; pair with a tcpdump from your SBC for the full picture
- Notification ErrorCode (e.g. `32011`, `13225`) is searchable in the Twilio docs and usually points straight at the misconfig
Pitfalls
- The downloaded PCAP does not contain media — Twilio doesn't expose RTP via the debugger
- Some errors only appear under Voice → Insights, not the SIP Debugger — check both
- For SIP Trunking, IP ACL drops happen *before* the debugger sees the packet — if you see no entry at all, suspect ACL first
Got the trace? Render the ladder.
Drop your Twilio export into SIP Flow and we'll render the call flow, surface RFC issues, and (optionally) ask Gemini to explain what went wrong — all client-side by default.
Open analyzer