Still working on this. It took a while for support to be able to show me the cid data in the wireshark file. It's in the NOTIFY message under the Message body. It contains the cid info that goes to the phone display.

The call recording guy can see this in Wireshark. But his equipment apparently does not. So it will probably be a finger pointing match because the non-standard sip stream isn't recognized by their stuff.