Protocols and Codecs
Signaling protocols
Know which device does the thinking. SCCP (Skinny) is a thin-client stimulus protocol: phones send keystrokes over TCP 2000 and CUCM keeps call state. SIP is peer-to-peer and text-based on UDP/TCP 5060 or TLS 5061: INVITE, 100 Trying, 180 Ringing, 200 OK, ACK, BYE, CANCEL, REGISTER, OPTIONS, SUBSCRIBE/NOTIFY, PRACK, UPDATE. MGCP is decomposed: CUCM acts as call agent over UDP 2727/2427. H.323 splits into RAS (UDP 1719) for registration, H.225/Q.931 (TCP 1720) for call setup, and H.245 for capability exchange.
Media transport
RTP runs over UDP in the 16384–32767 range with RTCP providing quality feedback; SRTP encrypts the same streams. DTMF is the classic trap: RFC 4733 telephone-event in RTP is preferred, but SIP INFO, KPML, in-band, and out-of-band (via MTP) exist, and mismatched methods require an MTP.
Codecs and bandwidth math
G.711 is 64 kbps payload (a-law in EMEA, mu-law in North America), about 80 kbps on the wire once 40 bytes of IP/UDP/RTP overhead is added. G.729 is 8 kbps payload but about 24 kbps on the wire because its small 20-byte payload makes header overhead proportionally larger. G.722 is wideband 64 kbps; Opus and iSAC are Jabber-native.
Worked rule of thumb: bandwidth per call = payload bitrate x (payload bytes + 40) / payload bytes. For G.729: 8 x 60/20 = 24 kbps.
Traps: counting only payload bits; assuming encrypted calls consume extra bandwidth; confusing port 5060 (SIP) with 2000 (SCCP).