title: show sip user agent and ip only tcpdump
body: <p>I have been playing with some tcpdump commands and egrep </p>
  
  <pre><code>tcpdump -i eth1 port sip -l -A | egrep -i 'User-Agent'
  </code></pre>
  
  <p>i leave this running on asterisk pbx server and I can see all the useragents flow down the screen. </p>
  
  <p>What i would like to see is the user agent and the ip of the sip client
  then ignore a few different types of user-agents so that when I am done I only see ip address and user-agents coming down the screen of unknown traffic. 
  Here is a example of the full sip packets from the command without the egrep. I do not have a example in it where the user agent of sipcli/v1.8 maybe later I can get that.</p>
  
  <pre><code>07:54:24.358716 IP xxx.xx.xx.xxx.5060 &gt; 10.1.44.10.5060: SIP, length: 543
  EH.;.5..8.y..UF.&amp;..
  .....'!SSIP/2.0 401 Unauthorized
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK49b7b7d0;received=10.1.44.10;rport=5060
  From: &lt;sip:12345_3@voipprovider3.domain.com&gt;;tag=as5afba40a
  To: &lt;sip:12345_3@voipprovider3.domain.com&gt;;tag=as14777e11
  Call-ID: 0e860af7278712754385ce784282c772@127.0.1.1
  CSeq: 604 REGISTER
  Server: voip.ms
  Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
  Supported: replaces, timer
  WWW-Authenticate: Digest algorithm=MD5, realm="voipprovider3.domain.com", nonce="7810c539"
  Content-Length: 0
  
  
  07:54:24.384512 IP 10.1.44.10.5060 &gt; xxx.xx.xx.xxx.5060: SIP, length: 558
  E`.Jrn..@..S&amp;..
  .UF......6..REGISTER sip:voipprovider3.domain.com SIP/2.0
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK6ef2d7d2;rport
  Max-Forwards: 70
  From: &lt;sip:12345_3@voipprovider3.domain.com&gt;;tag=as5afba40a
  To: &lt;sip:12345_3@voipprovider3.domain.com&gt;
  Call-ID: 0e860af7278712754385ce784282c772@127.0.1.1
  CSeq: 605 REGISTER
  User-Agent: unknown
  Authorization: Digest username="12345_3", realm="voipprovider3.domain.com", algorithm=MD5, uri="sip:voipprovider3.domain.com", nonce="7810c539", response="5d6ac715deff942d1a3b22b39f83c0b1"
  Expires: 120
  Contact: &lt;sip:s@10.1.44.10:5060&gt;
  Content-Length: 0
  
  
  07:54:24.387070 IP xxx.xx.xx.xxx.5060 &gt; 10.1.44.10.5060: SIP, length: 549
  EH.A.6..8.y..UF.&amp;..
  .....-.GSIP/2.0 200 OK
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK6ef2d7d2;received=10.1.44.10;rport=5060
  From: &lt;sip:12345_3@voipprovider3.domain.com&gt;;tag=as5afba40a
  To: &lt;sip:12345_3@voipprovider3.domain.com&gt;;tag=as14777e11
  Call-ID: 0e860af7278712754385ce784282c772@127.0.1.1
  CSeq: 605 REGISTER
  Server: voip.ms
  Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
  Supported: replaces, timer
  Expires: 120
  Contact: &lt;sip:s@10.1.44.10:5060&gt;;expires=120
  Date: Tue, 22 Nov 2016 12:54:24 GMT
  Content-Length: 0
  
  
  07:54:24.813579 IP 10.1.44.10.5060 &gt; xxx.xx.xx.xxx.5060: SIP, length: 551
  E`.C_...@.0.&amp;..
  .UF....../..REGISTER sip:voipprovider.domain.com SIP/2.0
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK3b0c2176;rport
  Max-Forwards: 70
  From: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as5b82aabf
  To: &lt;sip:12345@voipprovider.domain.com&gt;
  Call-ID: 6face5f36fdd29c31d3a10182e207048@127.0.1.1
  CSeq: 604 REGISTER
  User-Agent: unknown
  Authorization: Digest username="12345", realm="voipprovider1.domain.com", algorithm=MD5, uri="sip:voipprovider.domain.com", nonce="236a06e2", response="13d3528c45792fb242a47f1c18b43879"
  Expires: 120
  Contact: &lt;sip:s@10.1.44.10:5060&gt;
  Content-Length: 0
  
  
  07:54:24.816319 IP xxx.xx.xx.xxx.5060 &gt; 10.1.44.10.5060: SIP, length: 539
  EH.7Jy..7.Ou.UF.&amp;..
  .....# .SIP/2.0 401 Unauthorized
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK3b0c2176;received=10.1.44.10;rport=5060
  From: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as5b82aabf
  To: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as15b40d21
  Call-ID: 6face5f36fdd29c31d3a10182e207048@127.0.1.1
  CSeq: 604 REGISTER
  Server: voip.ms
  Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
  Supported: replaces, timer
  WWW-Authenticate: Digest algorithm=MD5, realm="voipprovider1.domain.com", nonce="168d0f22"
  Content-Length: 0
  
  
  07:54:24.842388 IP 10.1.44.10.5060 &gt; xxx.xx.xx.xxx.5060: SIP, length: 551
  E`.C_...@.0.&amp;..
  .UF....../..REGISTER sip:voipprovider.domain.com SIP/2.0
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK69d58133;rport
  Max-Forwards: 70
  From: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as5b82aabf
  To: &lt;sip:12345@voipprovider.domain.com&gt;
  Call-ID: 6face5f36fdd29c31d3a10182e207048@127.0.1.1
  CSeq: 605 REGISTER
  User-Agent: unknown
  Authorization: Digest username="12345", realm="voipprovider1.domain.com", algorithm=MD5, uri="sip:voipprovider.domain.com", nonce="168d0f22", response="724e79293e8d587a2b8106df991486d7"
  Expires: 120
  Contact: &lt;sip:s@10.1.44.10:5060&gt;
  Content-Length: 0
  
  
  07:54:24.899968 IP xxx.xx.xx.xxx.5060 &gt; 10.1.44.10.5060: SIP, length: 545
  EH.=Jz..7.On.UF.&amp;..
  .....)..SIP/2.0 200 OK
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK69d58133;received=10.1.44.10;rport=5060
  From: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as5b82aabf
  To: &lt;sip:12345@voipprovider.domain.com&gt;;tag=as15b40d21
  Call-ID: 6face5f36fdd29c31d3a10182e207048@127.0.1.1
  CSeq: 605 REGISTER
  Server: voip.ms
  Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
  Supported: replaces, timer
  Expires: 120
  Contact: &lt;sip:s@10.1.44.10:5060&gt;;expires=120
  Date: Tue, 22 Nov 2016 12:54:24 GMT
  Content-Length: 0
  </code></pre>
  
  <p>Here is with the egrep and the line with the ip addresses on it.  i really just want to show only the lines that show a user agent. this shows without useragent also. </p>
  
  <pre><code>tcpdump -i eth1 port sip -l -A | egrep -i 'User-Agent|SIP/2.0/UDP'
  
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK6fd0af5a;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 158.85.70.151:5060;branch=z9hG4bK64939182;rport
  User-Agent: VoipProvider
  Via: SIP/2.0/UDP 158.85.70.151:5060;branch=z9hG4bK64939182;received=158.85.70.151;rport=42872
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK600d27fe;rport
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK600d27fe;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK374f1905;rport
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK374f1905;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK4ac13138;rport
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK4ac13138;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK370927b1;rport
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK370927b1;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;rport
  User-Agent: sipcli/v1.8
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK7a1517ef
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK7a1517ef;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK425ae339
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK425ae339;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK7ac74b27
  User-Agent: Asterisk PBX
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK7ac74b27;received=10.1.44.10;rport=5060
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 185.40.4.96:5070;branch=z9hG4bK-ac834e0a1d92fc96bb7b4da395a5ead5;received=185.40.4.96;rport=5070
  Via: SIP/2.0/UDP 10.1.44.10:5060;branch=z9hG4bK7723c051
  User-Agent: Asterisk PBX
  </code></pre>
  
  <p>I would like to see something like this</p>
  
  <pre><code>sipcli/v1.8 185.40.4.96
  </code></pre>