> ICE/STUN/TURN for the parties to find the most direct route between them From my experience, using SIP to interact with the PSTN usually means your first poi

> ICE/STUN/TURN for the parties to find the most direct route between them From my experience, using SIP to interact with the PSTN usually means your first point of entry into the PSTN also proxies the media. > do clients just not encrypt the audio stream? SIP encryption is very uncommon, and unless you use ZRTP (which is end-to-end), I believe any SIP server within the path mediates the key exchange and can thus capture the key or downgrade/disable the encryption. Given the above points, a packet capture on a switch port would give you both signalling and media traffic and is most likely how SIP lawful intercept is implemented.