Connecting a PBX, contact centre stack or voice AI agent to real phone numbers usually means a SIP trunk. Before you configure one, it helps to know what the trunk actually does on each call, how many channels you need, and how it authenticates you. This post traces one call end to end and works the sizing math with real numbers.
SIP trunking connects a PBX, contact centre platform, or voice application to the public telephone network (PSTN) over IP instead of physical circuits. A SIP trunk sets up each call with SIP signalling, carries the audio separately over RTP, and limits capacity by concurrent channels rather than by wires.
This guide traces one call from INVITE to BYE, works through the channel math with real numbers, compares the authentication models, and lists the Indian rules that apply to a trunk, each linked to its source.
Note: Key takeaways
- A trunk is a configuration and a trust relationship with a carrier. It holds an address, an authentication method, and capacity limits, and no audio moves until a call starts.
- Signalling and media take separate paths. A call can connect perfectly and still carry no audio, because a firewall treats the two flows differently.
- Size channels on the busiest hour, not the average. In our worked example, 60 erlangs of traffic needs 75 channels to keep blocking under 1%.
- Registration, digest, and IP allowlisting solve different problems. Registration says where you are, while digest and IP allowlists establish who you are.
- In India, trunks fall inside TRAI's commercial calling rules. Repeat violations can disconnect every SIP trunk a sender holds, across all access providers, for one year.
What is a SIP trunk?
A SIP trunk is an arrangement between your phone system and a carrier that lets the two exchange calls over IP. The word "trunk" survives from circuit-switched telephony, where it meant a shared bundle of lines between switches.
The modern version has no wire to point at, which trips up many first-time deployments. Think of a trunk as three settings rather than a connection:
- An address. This is where each side sends call requests.
- A proof of identity. This is how the carrier knows the traffic is yours.
- A set of limits. These cap how many calls can run at once and how fast new ones can start.
Calls run in two directions, and each has its own name. Termination is your system placing a call out to the PSTN. Origination is the carrier delivering an inbound PSTN call to your system. Some providers model both on one trunk, and others keep them as separate resources.
Three counts get confused constantly, so separate them before you buy anything:
| Term | What it counts | What drives the number |
|---|---|---|
| Trunk | Separate configurations | Environments, tenants, and policy differences |
| Channel | Calls in progress at the same moment | Traffic in your busiest hour |
| DID | Phone numbers that reach you | How many numbers your business publishes |
A single trunk can carry many DID numbers, and a thousand DIDs don't imply a thousand channels. If SIP itself is new to you, start with that primer and come back.
How does SIP trunking work?
Every call on a trunk is two conversations. SIP, defined in RFC 3261, negotiates the call. RTP, defined in RFC 3550, carries the sound. The diagram follows one outbound call on a trunk that uses credentials.
The signalling plane
Your system opens with an INVITE, which names the called number and includes an SDP description of the audio it can handle. The carrier may challenge that first request, and your system then repeats it with a digest response. Once the far end answers, a 200 OK returns with the chosen codec and the address that expects audio, following the offer/answer model in RFC 3264. A final ACK closes the handshake, and a later BYE ends the call.
RFC 3261 sets the default ports at 5060 for UDP and TCP, and 5061 for TLS.
The media plane
Audio then flows directly between the addresses named in the SDP, on ports chosen for that call. With G.711 at the usual 20 ms packet interval, each direction sends 50 packets per second, each holding 160 bytes of audio. SIP never touches these packets.
Why the split matters when you debug
The separation explains most trunk failures, because each symptom points at one plane:
| What you see | Plane | Usual cause | Check first |
|---|---|---|---|
| Call connects, audio one way or none | Media | Firewall or NAT blocks RTP, or SDP advertises a private address | Media rules and the address in the SDP |
| Call connects and bills, total silence | Media | The far side requires SRTP and receives plain RTP | Media encryption setting on the trunk |
| 407 repeats after a retry | Signalling | Wrong username, password, or realm | The digest credentials |
| 401 in response to an INVITE | Signalling | A registrar or user agent answered rather than a proxy. On Vobiz, traffic has reached an endpoint registrar, not a trunk | The SIP domain you target |
| Callers hear busy | Capacity | Concurrent-channel ceiling reached | Live channel usage |
| Campaign finishes correctly but slowly | Capacity | Calls-per-second ceiling reached | Attempt rate over time |
Many deployments also place a session border controller at the network edge. RFC 5853 catalogues what these devices do in practice, including topology hiding, NAT traversal, and protocol repair. You need one when your PBX can't safely face the internet or when two SIP stacks disagree about details.
Registration vs IP authentication: which should you use?
These options are often presented as one choice, but they answer different questions. Registration answers "where are you?". Digest and IP allowlisting answer "who are you?".
| IP authentication | Digest on each call | Registration | |
|---|---|---|---|
| How it works | The carrier accepts traffic from listed source addresses | The carrier challenges the INVITE, and you answer with a hash of your password | Your system sends REGISTER so the carrier learns its current contact address |
| Question answered | Who | Who | Where, and who when challenged |
| Needs a static IP | Yes | No | No |
| Setup round trips | None added | One extra challenge per call | A recurring refresh, plus any call challenge |
| Inbound routing | To an address you configured | To an address you configured | To the address you last registered |
| Main risk | Anything sharing that address is trusted | Password guessing and leaked secrets | Same as digest, plus a lost binding when a refresh fails |
| Best fit | Data centre PBX, fixed egress | Cloud PBX, dynamic egress | Small sites behind NAT, PBX products built around it |
A few practical rules follow from that table:
- Prefer IP authentication when your egress addresses are stable. Keep the list as narrow as you can, because anything behind that NAT inherits the trust.
- Use digest when your egress moves. Autoscaled and cloud-hosted systems rarely keep one address for long.
- Use registration when the carrier must find you. It suits a site with no reachable public address. A PBX that registers many numbers at once can use the mechanism in RFC 6140.
How many channels does a SIP trunk need?
A channel is one call in progress, and a trunk needs enough of them for your busiest moment. Inbound and outbound traffic behave differently, so size them separately and then add them.
Inbound: the Erlang B method
Traffic intensity is measured in erlangs: calls per hour multiplied by the hours each call holds a channel.
Assume a support line with these figures in its busiest hour:
- Calls: 1,200 in the hour.
- Hold time: 3 minutes on average. Count IVR and queue time, because those legs occupy a channel too.
- Load: 1,200 × 3 ÷ 60 = 60 erlangs.
Sixty erlangs does not mean sixty channels. Calls arrive randomly, so some moments run well above the average. The Erlang B formula gives the share of calls that find every channel occupied:
At exactly 60 channels, about 116 of the 1,200 callers would hear busy. At 75 channels, that drops to about 10. Here is what each blocking target costs at this load:
| Blocking target | Channels needed | Headroom over 60 erlangs |
|---|---|---|
| 5% | 66 | 10% |
| 2% | 71 | 18% |
| 1% | 75 | 25% |
| 0.5% | 78 | 30% |
| 0.1% | 83 | 38% |
We calculated these figures with the Erlang B recursion. The formula assumes random arrivals and callers who give up when blocked. Treat its result as a floor when a TV spot, an outage, or an SMS blast can make callers arrive together and redial.
Pooling also matters. At a 1% target, 10 erlangs needs 18 channels, or 80% headroom, while 100 erlangs needs 117, or 17%. Large shared pools run far more efficiently than several small ones, so splitting capacity across small silos wastes channels.
Outbound: rate times hold time
Outbound load is under your control, so it needs simpler math. Concurrency equals attempts per second multiplied by the average time each attempt holds a channel.
Take 24,000 attempts in an 8-hour window, with 30% answered, 90 seconds of talk on answered calls, and 20 seconds of ringing on the rest:
- Rate: 24,000 ÷ 28,800 seconds = 0.83 calls per second.
- Channel time: (7,200 × 90) + (16,800 × 20) = 984,000 seconds.
- Concurrency: 984,000 ÷ 28,800 = about 34 channels.
That result assumes a steady pace. Each attempt holds a channel for 41 seconds on average, so a dialler that bursts at 2 calls per second needs about 82 channels while the burst lasts. Unanswered attempts account for a third of the channel time here, so they belong in the sum.
Bandwidth
TRAI's February 2025 numbering recommendations put a SIP call at about 87 kbps with G.711 and 32 kbps with G.729. The G.711 figure checks out from first principles: 64 kbps of audio, 16 kbps of IP, UDP, and RTP headers, and about 7 kbps of Ethernet framing.
If the inbound and outbound examples peak together, round the outbound 34.2 up and you need 75 + 35 = 110 channels. That is about 9.6 Mbps in each direction with G.711. SRTP's default 80-bit authentication tag adds about 4 kbps per call.
How many trunks do you need?
Usually fewer than you think. Create a new trunk when something about the configuration must differ, such as the environment, tenant, recording policy, or target for webhooks (callbacks). Capacity is rarely the reason, because channels are usually a plan setting rather than a property of the trunk.
How does a SIP trunk differ from PRI and VoIP?
A PRI circuit delivers a fixed block of channels: 23 on a North American T1 and 30 on the E1 used in India. A SIP trunk removes that block size, along with the physical tie to one site.
| PRI (E1/T1) | SIP trunk | |
|---|---|---|
| Capacity unit | Fixed block per circuit | Any number of channels your plan allows |
| Delivery | Physical circuit to a site | IP, over internet or private link |
| Numbers | Tied to the circuit | Routed in software, movable between trunks |
| Failure domain | The site and its circuit | Your IP path and SIP destination, with rerouting possible |
| Main dependency | Local exchange | Your network's loss, jitter, and bandwidth |
VoIP is the wider category of voice over IP, and a SIP trunk is one way to use it. SIP vs VoIP covers that distinction in full. A hosted PBX differs in a separate way: the provider runs the phone system, whereas with a trunk you run it and buy only the connectivity. If you have no PBX and want to control calls from code, compare SIP with WebSocket streaming before you choose.
How do you secure a SIP trunk?
An exposed trunk can spend your money, because anyone who gets through can place calls on your account. Work through these layers:
- Encrypt signalling. Use TLS transport so that numbers and headers don't cross the network in clear text.
- Encrypt media. Use SRTP, defined in RFC 3711, and confirm that both sides agree on it.
- Narrow who can connect. Keep allowlists to specific hosts, and use one credential per environment.
- Narrow where calls can go. Enable only the destinations you need, especially international routes.
- Watch for odd traffic. Alert on unusual destinations, off-hours spikes, and sudden rises in attempts.
- Rotate secrets when people leave. Treat SIP passwords like any other production credential.
What rules apply to SIP trunks in India?
India regulates what you send over a trunk as closely as how you connect it. The rules below come from TRAI and DoT documents, each linked to its source. They change often, so confirm the current text and take legal advice for your own case.
| Topic | What the rule says | Source and date |
|---|---|---|
| Promotional calls | Use the 140xx series, for an entity in any sector that has registered with its telecom provider | TRAI press release 91/2026, July 2026 |
| Service and transactional calls | Entities regulated by RBI, SEBI, IRDAI, and PFRDA, and government bodies, use the 1600xx series | TRAI press release 91/2026, July 2026 |
| Ordinary 10-digit numbers | Senders are restricted from using them for telemarketing | TRAI press release 11/2025, February 2025 |
| Violations | First instance: outgoing services barred for 15 days. Later instances: all resources, including PRI and SIP trunks, disconnected across all access providers for one year, with blacklisting | TCCCPR Second Amendment, February 2025 |
| Restoration charge | Where TRAI orders restoration, ₹5,000 per resource up to ₹5 lakh, with each DID on a trunk counted separately | TCCCPR Second Amendment, February 2025 |
| Automated calls | Once in force, senders must declare application-initiated calls and their CLI ranges to the originating provider in advance, and undeclared calls count as unsolicited. See the commencement note below | TCCCPR Third Amendment, copy hosted by MediaNama, September 2026 |
| Toll bypass | For voice BPOs that meet the Other Service Provider (OSP) definition, carrying PSTN calls between cities, or between India and abroad, over your own network is illegal, and the OSP answers for violations | DoT OSP guidelines, June 2021 |
The toll bypass text dates from 2021. Khaitan & Co reports that DoT notified new authorisation rules under the Telecommunications Act, 2023 in June 2026, and we could not confirm whether they change the OSP position.
Three of these deserve a closer look.
Enforcement reaches trunks directly. TRAI's August 2024 direction named SIP and PRI when it ordered providers to stop promotional calls from unregistered senders. Within weeks, providers reported blacklisting more than 50 entities and disconnecting over 2.75 lakh resources, including SIP DIDs.
Voice AI needs attention under the Third Amendment. The regulation defines an A2P call as one started by an application or automated platform without direct human dialling, including artificial voice. An outbound voice agent appears to match that wording, so raise it with your provider before launch. The text also lets terminating operators charge originating operators up to ₹0.05 per minute on A2P calls, and exempts the 140xx, 1600xx, and 1601xx series. TRAI announced these changes on 18 September 2026. The notification sets the A2P declaration and charge to start 60 days after Gazette publication. We could not confirm the publication date, so check whether they apply on your launch date.
The 1600 deadlines have passed for many banks. TRAI's November 2025 direction set adoption dates for RBI-regulated entities between 1 January and 1 March 2026. If you carry calls for a bank or NBFC, confirm its series before you route traffic.
TRAI has also recommended that DoT write allocation guidelines for numbers on SIP and PRI, monitor enterprise allocations above 15 numbers per Mbps, and bring in calling name presentation for SIP and PRI calls reaching mobile networks. These are recommendations rather than rules, and we could not confirm their current status, so watch for DoT's follow-up.
How Vobiz handles SIP trunks
Vobiz SIP trunking gives you outbound and inbound trunks as separate resources in the console and over the Trunks API.
- Outbound. Each outbound trunk gets its own SIP domain, shown on the trunk. You point your PBX at that hostname, using the ports on the IP whitelisting page.
- Authentication. Attach an IP Access Control List or a SIP credential. Credential trunks are challenged with 407. IP ACLs are evaluated first across your whole account, so a source address in any ACL on your account skips the challenge. Keep test traffic off those addresses when you test digest.
- Registration. Registered soft-phones and WebRTC clients use endpoints, which are a separate resource from trunks. The 3CX guide shows a trunk set up through that PBX's own registration step.
- Inbound. An inbound trunk forwards calls for its linked numbers to an origination URI, set by host, port, and transport (UDP, TCP, or TLS). The trunk docs cover primary and fallback URIs.
- Encryption. Trunk settings control signalling transport, including TLS, and SRTP for media.
- Firewalls. Allow the signalling and media ranges listed on the IP whitelisting page, which stays current as addresses change.
- Capacity. Concurrency and CPS are enforced per account, so inbound and outbound calls share one pool across all trunks. Trunks also store their own concurrency and CPS settings, but the account figures do the enforcing. Check live use with the Concurrency API, and model a campaign in the CPS and concurrency calculator.
- Per-trunk features. Recording, transcription, PII redaction, and webhooks are all set per trunk.
- Quality data. Each call detail record reports call-quality scores, jitter, packet loss, and the negotiated codec, which lets you compare the sizing above with what really happened.
- India. Calling regulations cover KYC, caller ID, and media anchoring, under which both legs of an Indian call stay in India. The UCC page explains complaint handling, and 140 and 160 series acquisition covers commercial numbers.
- Pricing and reach. Current rates are on the Vobiz pricing page. Extra capacity is a monthly subscription, and you can preview its price without being charged.
Test calls and capacity purchases are billed to your account. Run them with your own Auth ID and Auth Token, and confirm numbers and quantities first. Vobiz also connects trunks to voice AI platforms such as LiveKit and Vapi.
Frequently asked questions
FAQ
What does SIP trunk mean in simple terms?
Think of a SIP trunk as a phone line defined in software, linking your phone system to a carrier. It runs over IP rather than copper, so one connection can carry many calls at once. Your system can then place and receive ordinary phone calls through that carrier.
How does SIP trunking work?
Your system sends a SIP request to the carrier, which authenticates it and connects the call to the phone network. SIP negotiates the call, and audio then flows separately over RTP or SRTP. A final SIP message ends the call and frees the channel.
How many channels are in a SIP trunk?
A SIP trunk has no fixed channel count. You choose a number that suits your traffic, unlike an E1 PRI with its 30 channels. Calculate erlangs for your busiest hour, then apply Erlang B. For example, 60 erlangs needs 75 channels at 1% blocking.
How many SIP trunks do I need?
Most teams need one trunk per distinct configuration, such as production and staging or one per tenant. Channel count, not trunk count, sets how many calls you can run. Add a trunk when settings must differ, and add channels when traffic grows.
How is SIP different from a SIP trunk?
SIP is the signalling protocol that starts, changes, and ends sessions. A SIP trunk is a carrier service built on that protocol, connecting your system to the phone network. You can use SIP inside a company without ever buying a trunk.
Is SIP trunking legal in India?
Yes, when you use an authorised provider and follow the rules. TRAI's commercial calling rules assign number series by call type, and DoT's 2021 OSP guidelines prohibit toll bypass. Repeat spam violations can disconnect every trunk a sender holds for one year. Check current text and take legal advice.
Further reading on Vobiz
- SIP trunking concept guide · SIP trunking overview in the console · Trunks API reference
- What is SIP? · SIP vs VoIP · What is a DID number?
- Concurrency capacity · CPS capacity · CPS and concurrency calculator
- India calling regulations · DLT registration · Hangup causes
Sources
Standards
- IETF, RFC 3261: SIP: Session Initiation Protocol, June 2002.
- IETF, RFC 3264: An Offer/Answer Model with SDP, June 2002.
- IETF, RFC 3550: RTP: A Transport Protocol for Real-Time Applications, July 2003.
- IETF, RFC 3711: The Secure Real-time Transport Protocol, March 2004.
- IETF, RFC 5853: Requirements from SIP Session Border Control Deployments, April 2010.
- IETF, RFC 6140: Registration for Multiple Phone Numbers in SIP, March 2011.
- IETF, RFC 8866: SDP: Session Description Protocol, January 2021.
Indian regulators
- TRAI, Telecom Commercial Communications Customer Preference (Second Amendment) Regulations, 2025, February 2025.
- TRAI, Press release 11/2025 on the TCCCPR amendments, February 2025.
- TRAI, Recommendations on Revision of National Numbering Plan, 6 February 2025.
- TRAI, Direction on phase-wise adoption of 1600-series numbers, November 2025.
- TRAI, Press release 91/2026 on the 1600 and 140 series, July 2026.
- TRAI, Press release 119/2026 on the Third Amendment, 18 September 2026.
- TRAI, Third Amendment Regulations, 2026 (copy hosted by MediaNama), 18 September 2026.
- PIB, TRAI asks Access Service Providers to disconnect telecom resources of unregistered senders, August 2024.
- PIB, Access Providers blacklist 50 entities for spamming, September 2024.
- DoT, Revised Guidelines for Other Service Providers, 23 June 2021.
- Khaitan & Co, Update on the principal telecommunication services authorisation rules, June 2026.
Reference
- Wikipedia, "Erlang (unit)".
- Wikipedia, "G.711".
- Wikipedia, "Primary Rate Interface".
If the trunk is for voice AI agents, Vobiz provides AI-native SIP trunking, priced pay as you go per minute.
Top comments (0)