Вот кусок tcpdump почему та он начинает ломица по  6000 порту и Elastix (192.168.0.66)  посылает его на 

  . AudioCode MP-108 ip 192.168.0.249 
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 427
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 443
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 655
IP 192.168.0.66.14152 > 192.168.0.249.6000: UDP, length 172
IP 192.168.0.66.14152 > 192.168.0.249.6000: UDP, length 172
IP 192.168.0.249.sip > 192.168.0.66.sip: SIP, length: 515
IP 192.168.0.249.sip > 192.168.0.66.sip: SIP, length: 515
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 401
IP 192.168.0.249.sip > 192.168.0.66.sip: SIP, length: 847
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 426
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 442
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 409
IP 192.168.0.249.sip > 192.168.0.66.sip: SIP, length: 525
IP 192.168.0.66.sip > 192.168.0.249.sip: SIP, length: 493