This indicator is added to the info column by Wireshark when it finds a "tag" added in one of the headers of an INVITE, SUBSCRIBE or REFER message.
Deducted from the following part of the sip dissector:
parameter_offset = offset;
while (parameter_offset < line_end_offset
&& (tvb_strneql(tvb, parameter_offset, "tag=", 4) != 0))
parameter_offset++;
if ( parameter_offset < line_end_offset ){ /* Tag found */
parameter_offset = parameter_offset + 4;
parameter_end_offset = tvb_find_guint8(tvb, parameter_offset,
(line_end_offset - parameter_offset), ';');
if ( parameter_end_offset == -1)
parameter_end_offset = line_end_offset;
parameter_len = parameter_end_offset - parameter_offset;
proto_tree_add_item(sip_element_tree, hf_sip_to_tag, tvb, parameter_offset,
parameter_len, ENC_ASCII|ENC_NA);
item = proto_tree_add_item(sip_element_tree, hf_sip_tag, tvb, parameter_offset,
parameter_len, ENC_ASCII|ENC_NA);
PROTO_ITEM_SET_HIDDEN(item);
/* Tag indicates in-dialog messages, in case we have a INVITE, SUBSCRIBE or REFER, mark it */
switch (current_method_idx) {
case SIP_METHOD_INVITE:
case SIP_METHOD_SUBSCRIBE:
case SIP_METHOD_REFER:
col_append_str(pinfo->cinfo, COL_INFO, ", in-dialog");
break;
}
}</code></pre></div><div class="answer-controls post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>answered <strong>19 Jun '13, 04:21</strong></p><img src="https://secure.gravatar.com/avatar/7901a94d8fdd1f9f47cda9a32fcfa177?s=32&d=identicon&r=g" class="gravatar" width="32" height="32" alt="SYN-bit's gravatar image" /><p><span>SYN-bit ♦♦</span><br />
17.1k●9●57●245
accept rate: 20%