So, I've been playing with SIP lately, and I managed to make an alright scanner that searches an IP range for SIP servers by sending 'options' requests at them. It can do a class B range in about 10-15 minutes in fast mode. Hope this is useful to somebody :-). https://anonfiles.com/file/a7ced3a369719e57ac54570d8a2103b7 (to compile just run make, appologies for the crappy code!)