Your ngrep output would be correct, it is the localhost that is spawning the network request.
Sip Peers output shows the server has sent a registration request, but has not received a reply.
You haven't given the full log output from a registration request, but I suspect you probably have a few lines like:-
| Quote: |
| Jan 21 10:27:39 NOTICE[3118] chan_sip.c: -- Registration for 'rgower@sip.voipuser.org' timed out, trying again (Attempt #1301) |
The SIP server here is being a tad tempermental at present, and I suspect you are a victim of its mood swing. It should clear itself shortly