Overview
The Skinny Client Control Protocol (SCCP), also known as Skinny, is a proprietary, application-layer signaling protocol developed by Cisco for VoIP call control and device management. It operates in a client–server architecture over TCP port 2000, between IP phones (SCCP clients) and a call agent — most commonly Cisco Unified Communications Manager (CUCM). Supported protocol versions run up to version 20. Use cases: device registration, call setup/teardown, feature control (hold, transfer, conferencing), and media session negotiation — voice/video transport itself is carried separately over RTP.
Protocol Stacks
------------------------------------ IP Telephony Endpoint
| Call Control Application | <= CUCM / SCCP Call Agent
|------------------------------------|
| Skinny (SCCP) Signaling | <= Call control & device control
|------------------------------------|
| TCP |
|------------------------------------|
| IP |
------------------------------------
Protocol Structure
The Skinny Client Control Protocol (SCCP) uses a binary protocol design featuring a fixed 12-byte header consisting of three 32-bit fields: data length, header version, and message ID, followed by message-specific parameters. Below example structure is for RegisterReq
RegisterReq
|
0715
|
||||||||||||||||
| 0 | Data Length | Header Version | Message ID | Device Name | ||||||||||||
| 16 | Device Name | Reserved | ||||||||||||||
| 32 | Instance | Station IPv4 Address | Device Type | Max Concurrent RTP Streams | ||||||||||||
| 48 | Active RTP Streams | Proto Ver | Reserved | Phone Features | Max Concurrent Conferences | Active Conferences | ||||||||||
| 64 | MAC Address | Reserved / Padding | IPv4 Address Scope | |||||||||||||
| 80 | Max Number of Lines | Station IPv6 Address | ||||||||||||||
| 96 | Station IPv6 Address | IPv6 Address Scope | Firmware Load Name | |||||||||||||
| 112 | Firmware Load Name | |||||||||||||||
| 128 | Firmware Load Name | |||||||||||||||
Common Message ID
Station → CallManager (Client → CUCM)
| No. | Message Name | Value | No. | Message Name | Value |
|---|---|---|---|---|---|
| 1 | KeepAlive | 0x0000 |
7 | HookFlashMessage | 0x0008 |
| 2 | RegisterMessage | 0x0001 |
8 | SoftKeyEventMessage | 0x0026 |
| 3 | IpPortMessage | 0x0002 |
9 | UnregisterMessage | 0x0027 |
| 4 | StimulusMessage | 0x0005 |
10 | DeviceToUserDataMessage | 0x002E |
| 5 | OffHookMessage | 0x0006 |
11 | MediaTransmissionFailure | 0x002A |
| 6 | OnHookMessage | 0x0007 |
12 | RegisterTokenReq | 0x0029 |
CallManager → Station (CUCM → Client)
| No. | Message Name | Value | No. | Message Name | Value |
|---|---|---|---|---|---|
| 1 | RegisterAckMessage | 0x0081 |
7 | StopMediaTransmission | 0x008B |
| 2 | KeepAliveAckMessage | 0x0100 |
8 | OpenReceiveChannel | 0x0105 |
| 3 | StartToneMessage | 0x0082 |
9 | OpenReceiveChannelAck | 0x0022 |
| 4 | StopToneMessage | 0x0083 |
10 | CallInfoMessage | 0x008F |
| 5 | SetRingerMessage | 0x0085 |
11 | DisplayTextMessage | 0x0099 |
| 6 | StartMediaTransmission | 0x008A |
12 | VersionMessage | 0x0098 |
Sample Hex Dump + Dissector View (RegisterReq)
Skinny Client Control Protocol
Data length: 128
Header version: Basic (0x00000000)
Message ID: RegisterReq (1)
sid
stationIpAddr: 192.168.6.50
Device Type: 7941G (0x00000073)
Maximum Number of Concurrent RTP Streams: 5
Active RTP Streams: 0
Protocol Version: 19
unknown: 0
phoneFeatures
Maximum Number of Concurrent Conferences: 1
Active Conferences: 0
Mac Address: Cisco_XX:XX:XX (00:19:2f:XX:XX:XX)
ipV4AddressScope: 3
maxNumberOfLines: 2
stationIpV6Addr: ::
ipV6AddressScope: 0
firmwareLoadName: SCCP41.9-0-3S
[Response In: 10]
0000 80 00 00 00 00 00 00 00 01 00 00 00 53 45 50 30 ............SEP0
0010 30 31 39 32 46 XX XX XX XX XX XX 00 00 00 00 00 0192FXXXXXX.....
0020 00 00 00 00 c0 a8 06 32 73 00 00 00 05 00 00 00 .......2s.......
0030 00 00 00 00 13 00 72 85 01 00 00 00 00 00 00 00 ......r.........
0040 00 19 2f XX XX XX 00 00 00 00 00 00 03 00 00 00 ../.!...........
0050 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0060 00 00 00 00 00 00 00 00 53 43 43 50 34 31 2e 39 ........SCCP41.9
0070 2d 30 2d 33 53 00 00 00 00 00 00 00 00 00 00 00 -0-3S...........
0080 00 00 00 00 00 00 00 00 ........
Reference
VoIP - Excerpt (SCCP).pdf
Wireshark Github SCCP Dissector - packet-skinny.c
Github staskobzar - Provisioning files for Cisco phones SCCP firmware