The headers are included in every single downlink message after initiating a call, including the downlink SIP Invite message before 100 Trying, 180 Ringing or 183 Session Progress.
If you're quick enough (or automate this with dedicated software, like an attacker might actually do), it won't even need to ring out. It's really not good.
Hello, article editor here. Many Android devices with Qualcomm chips offer the option to expose a modem diagnostics port over USB meaning a rooted device isn't even needed. It's just much easier to use NSG rooted on-device than going around with a laptop places.
It's as simple as using Scat (https://github.com/fgsect/scat) with the modem diag port enabled to view all signalling traffic to/from the network.
I've been looking for suitable SDRs in the ~£180 range for a few months now, and nowhere has one suitable for 5G NR or 4G LTE available. HackRF seems to be pretty crippled in mobile networking, and Pluto seems to not work at all on srsRAN/srsLTE.
I doubt you'd be willing to let go of your full-size LimeSDR for £180, though, and I don't blame you based on its demand level.