When the phone is ringing, there is no INVITE in WireShark. The INVITE is not for ringing. It is typically 180 or 183.
UDP | length: 214 | Info: 31410 -> 9014 Len:172 is most likely RTP, G.711 packets. Need to verify if Wireshark UDP ports 31410 and 9014 is decode as "RTP"
When I end the call: protocol: SIP | length: 509 | Info: Request: BYE sip:[email protected]:5060
I am not sure what the 1000 means. The 192.168.111.143:5060 is the port (5060) for SIP. Verify the information in the SIP header if it was your test call then filter by Call-ID.
