Thanks all (especially Alex), I know now why, and it does seem that the 'NAT' device - in this case a Draytek Vigor ADSL router is rewriteing the SIP packet incorrectly. However, if I wanted to be tolerant of this, is there a way to instruct SER to re-evaluate the 'content-length' and rewrite it correctly?
(ngrep dumps below)
Internal to NAT:
U 10.0.0.212:5060 -> 213.166.5.135:5060 INVITE sip:448000664901@gk.magrathea.net;user=phone SIP/2.0..Via: SIP/ 2.0/UDP 10.0.0.212:5060..From: sip:linus@gk.magrathea.net;tag=30449371 62..To: sip:448000664901@gk.magrathea.net;user=phone..Call-ID: 10341 00418@10.0.0.212..CSeq: 1 INVITE..Contact: <sip:linus@213.162.109.118: 5060;transport=udp>..User-Agent: Cisco ATA 186 v2.16.1 ata18x (030709 a)..Expires: 300..Content-Length: 249..Content-Type: application/sdp.. ..v=0..o=linus 14148 14148 IN IP4 10.0.0.212..s=ATA186 Call..c=IN IP4 213.162.109.118..t=0 0..m=audio 16384 RTP/AVP 4 8 0 101..a=rtpmap:4 G7 23/8000/1..a=rtpmap:8 PCMA/8000/1..a=rtpmap:0 PCMU/8000/1..a=rtpmap:10 1 telephone-event/8000..a=fmtp:101 0-15..
But what actually arrives is:
U 213.162.109.118:5060 -> 213.166.5.135:5060 INVITE sip:448000664901@gk.magrathea.net;user=phone SIP/2.0..Via: SIP/2.0/UDP 213.162.109.118:5060..From: sip:linus@gk.magrathea.net;tag=3044937162..To: <si p:448000664901@gk.magrathea.net;user=phone>..Call-ID: 1034100418@213.162.109.1 18..CSeq: 1 INVITE..Contact: sip:linus@213.162.109.118:5060;transport=udp..U ser-Agent: Cisco ATA 186 v2.16.1 ata18x (030709a)..Expires: 300..Content-Leng th: 259..Content-Type: application/sdp....v=0..o=linus 14148 14148 IN IP4 213. 162.109.118..s=ATA186 Call..c=IN IP4 213.162.109.118..t=0 0..m=audio 16384 RTP /AVP 4 8 0 101..a=rtpmap:4 G723/8000/1..a=rtpmap:8 PCMA/8000/1..a=rtpmap:0 PCM U/8000/1..a=rtpmap:101 telephone-event/8000..a=fmtp:101 0-15..