Different versions of SIP packets on local and remote site?

edit

I not agree, port it refer to sip Register packet and the other is Contact information, whatever my question is regardless to Contact information because on Remote information it seem more information and Local information only a character. The only difference was on the capture software because remote and local capture have analyzed with the same WireShark. Question why have differences, by the way gateway could never make change inside of packets the only possibility could be possible by using a SBC, in this case there no SBC.

The only difference was on the capture software

And the network on which you did the capturing.

Perhaps there was different traffic on the two networks. If there was, there is no reason to expect that there won't be differences in what you capture.

Clearly the packet you showed in "Local site" and the packet you showed in "Remote site" are NOT the same packet, given that the port numbers are different. If you want to convince us that the same packet looks different in the two captures, you will have to capture the same packet and show it as captured on both machines.

I have no clue about SIP and what can be modified by hops, but the SIP element has clearly been modified as the UDP payload (presumably the SIP message) has changed from 479 bytes to 655 bytes, so modification of the SIP data you're interested in by the intervening devices seems a much more likely possibility rather than some sort of capture issue.

Reply to Guy Harris

First of all I don’t have any intention to convincing anyone, simply to found answers through this forum. Regarding to capture has been done simultaneously, it is feasible that it is not the same packet since origination from a local network and goes through the router and causes modifications in order response from remote site will return to router and not a private address.

Reply to grahamb.

As Local site is connected in LAN and configuration on SIP account is related to remote site it should send and go through router and it will modified packet causing payload change. The clincher is, host send Register message and should receive server in order to response to host with a ACK message, is a basic handshaking and clearly it happens host send Register message and server have received, but don’t reply "ACK" message because it seems on Contact Header have detect a double character "@". So on local capture on Contact Header is not seems same information it only seems a “*” character, as both packets is analyzed with the same wireshark I could not found any logical reason of why it happens.