During a blind transfer sequence, a UA can receive a REFER like this:
REFER sip:
207@10.1.1.171;transport=tcp SIP/2.0
Via: SIP/2.0/TCP 10.1.1.68;branch=z9hG4bK-sipXecs-00d011e0d4ff76ee2ec5d37a4c5d45a94a34
Via: SIP/2.0/TCP 10.1.1.41;branch=z9hG4bK854347abCD03BB40
From: <sip:
202@victoria.pingtel.com;user=phone>;tag=4AF6BD44-DFAC36BF
To: "207" <sip:
207@victoria.pingtel.com>;tag=9CF3C0FB-11000BF2
Cseq: 3 REFER
Call-Id:
11a781ce-1420f139-a86408b8@10.1.1.171
Contact: <sip:
202@10.1.1.41;transport=tcp>
User-Agent: PolycomSoundPointIP-SPIP_301-UA/2.2.2.0084
Refer-To: <sip:
208@victoria.pingtel.com?X-Sipx-Authidentity=%3Csip%3A202%40victoria.pingtel.com%3Bsignature%3D487CDEE7%253A%253A4a40638118bbcea615a0aaeb089a7ccd%3E>
The Polycom phone then produces an INVITE like this:
INVITE sip:
208@victoria.pingtel.com;transport=tcp?X-Sipx-Authidentity=%3Csip%3A202%40victoria.pingtel.com%3Bsignature%3D487CDEE7%253A%253A4a40638118bbcea615a0aaeb089a7ccd%3E SIP/2.0
Via: SIP/2.0/TCP 10.1.1.171;branch=z9hG4bK2be0ec80C9A4CFA3
From: "207" <sip:
207@victoria.pingtel.com>;tag=32BBB957-60F115DE
To: <sip:
208@victoria.pingtel.com?X-Sipx-Authidentity=%3Csip%3A202%40victoria.pingtel.com%3Bsignature%3D487CDEE7%253A%253A4a40638118bbcea615a0aaeb089a7ccd%3E>
CSeq: 1 INVITE
Call-ID:
44de31fa-fb5997b5-54a8b044@10.1.1.171
Contact: <sip:
207@10.1.1.171;transport=tcp>
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, INFO, MESSAGE, SUBSCRIBE, NOTIFY, PRACK, UPDATE, REFER
User-Agent: PolycomSoundPointIP-SPIP_650-UA/Grizzly.3892
Accept-Language: en
Supported: 100rel,replaces
Allow-Events: talk,hold,conference
Referred-By: <sip:
202@victoria.pingtel.com>
Max-Forwards: 70
Content-Type: application/sdp
Content-Length: 290
But the request-URI of that INVITE is incorrect. See RFC 3261 section 19.1.5. The 'header' part of the request-URI should be split off as a separate header (and have %-quoting removed):
INVITE sip:
208@victoria.pingtel.com;transport=tcp SIP/2.0
X-Sipx-Authidentity: <sip:
202@victoria.pingtel.com;signature=487CDEE7%3A%3A4a40638118bbcea615a0aaeb089a7ccd>
[etc.]
Attachment blind_xfer.pcap shows the same calls in PCAP format. The REFER is frame 21 and the INVITE is frame 23.