Which tool is used to identify SIP devices and PBX servers on a target network?

• A. Nmap
• B. Svmap
• C. Masscan
• D. Netstat

Answer: (B)

Identifying SIP devices and PBX servers on a network requires a tool that specifically targets the SIP service and can interpret SIP responses to classify devices. Svmap is built for this purpose: it probes hosts likely to host SIP services (typically on ports like 5060/5061) and analyzes SIP messages to determine whether a host is a SIP endpoint or a PBX server, often revealing vendor or model information from banners. That targeted capability makes it the best fit for mapping SIP devices and PBX servers across a network.

General port scanners can show whether SIP might be running, but they don’t specialize in fingerprinting SIP devices or distinguishing PBX servers. A fast port-scanning tool focuses on reachability rather than the detailed enumeration Svmap provides. Netstat, on the other hand, looks at connections on the local machine, not across the target network, so it can’t help with discovering devices on a remote network.