Open Source Network Packet Sniffer for VoIP/RTC Traffic Analysis

Website • Documentation • Live Demo • Download •

---

What is VoIPmonitor?

VoIPmonitor is an open source network packet sniffer with commercial frontend for SIP, RTP, RTCP, SDRS, WebRTC, T.38, MGCP, Skinny(SCCP), and other VoIP protocols running on Linux.

It is designed for VoIP troubleshooting and monitoring. VoIPmonitor captures, decodes, and analyzes VoIP traffic, saving call metadata to a database and optionally storing full packet captures and audio recordings. The sniffer is engineered for high-performance environments, capable of processing 10 Gbit traffic and handling 100,000+ concurrent calls on a single server.

Trusted by 1,000+ telecom operators, ITSPs, and contact centers worldwide. Representative vendor in Gartner's Market Guide for Unified Communications Monitoring.

---

Key Features

Protocol Support

• SIP - Full message parsing, call correlation, and ladder diagrams
• RTP/RTCP - Audio stream capture, quality analysis, and RTCP-XR
• WebRTC - Browser-based real-time communication analysis
• SIPREC - Session Recording Server (RFC 7866/7865)
• MGCP - Media Gateway Control Protocol
• SKINNY/SCCP - Cisco proprietary signaling
• T.38 - FAX over IP with PDF conversion
• Diameter, SS7, SCTP - Extended protocol support

Quality Metrics (ITU-T G.107 E-model)

• MOS (Mean Opinion Score) - Voice quality prediction on 1-5 scale
• Jitter - Packet arrival time variation
• Packet Loss - Impact on call clarity
• R-Factor - Transmission rating factor
• Delay/Latency - End-to-end delay measurement

Codec Support

G.711, G.722, G.723, G.726, G.729a, OPUS, AMR, AMR-WB, iLBC, Speex, GSM, Silk, iSAC, MP4A-LATM

Advanced Capabilities

• TLS/SRTP Decryption - Full support for encrypted VoIP traffic
• DPDK Acceleration - Kernel-bypass for 10 Gbit line-rate capture
• ARM Architecture - Native support for ARM-based servers
• Serialized Storage - Optimized format for cost-effective HDD storage
• Horizontal Scaling - Distributed sniffers with central database

---

Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                         Network Traffic                              │
│            (SPAN/RSPAN/ERSPAN/TAP/SBC Mirroring)                    │
└───────────────────────────────┬─────────────────────────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│                     VoIPmonitor Sniffer (GPL)                        │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐ │
│  │ SIP Parser  │  │ RTP Decoder │  │ Quality     │  │ Audio       │ │
│  │             │  │             │  │ Analysis    │  │ Recording   │ │
│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘ │
└───────────────────────────────┬─────────────────────────────────────┘
                                │
            ┌───────────────────┼───────────────────┐
            ▼                   ▼                   ▼
    ┌───────────────┐   ┌───────────────┐   ┌───────────────┐
    │ MySQL/MariaDB │   │ PCAP Storage  │   │ Audio Files   │
    │   (CDRs)      │   │ (SIP/RTP)     │   │ (WAV/OGG)     │
    └───────────────┘   └───────────────┘   └───────────────┘
            │                   │                   │
            └───────────────────┼───────────────────┘
                                │
                                ▼
┌─────────────────────────────────────────────────────────────────────┐
│                    VoIPmonitor WEB GUI (Commercial)                  │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐ │
│  │ Dashboards  │  │ Analytics   │  │ Alerting    │  │ Billing     │ │
│  │ & Reports   │  │ & OLAP      │  │ & Fraud     │  │ Engine      │ │
│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘ │
└─────────────────────────────────────────────────────────────────────┘

---

Quick Start

Download Static Binary (Recommended)

No dependencies required - works on any Linux distribution:

# 64-bit
wget https://www.voipmonitor.org/current-stable-sniffer-static-64bit.tar.gz
tar xzf current-stable-sniffer-static-64bit.tar.gz
cd voipmonitor-*

# Run sniffer
./voipmonitor -i eth0

Build from Source

git clone https://github.com/voipmonitor/sniffer.git
cd sniffer
./configure
make
make install

Basic Configuration

Create /etc/voipmonitor.conf:

# Network interface to sniff
interface = eth0

# MySQL database connection
mysqlhost = localhost
mysqldb = voipmonitor
mysqlusername = voipmonitor
mysqlpassword = secret

# Enable audio recording
audio_recording = yes
savesip = yes
savertp = yes

Start the sniffer:

voipmonitor --config /etc/voipmonitor.conf

---

Installation Guides

Detailed installation guides for popular distributions:

Distribution	Guide
Debian 13	Installation Guide
Debian 12	Installation Guide
Ubuntu 24.04 LTS	Installation Guide
Ubuntu 22.04 LTS	Installation Guide
Rocky Linux 10	Installation Guide
Rocky Linux 9	Installation Guide
AlmaLinux 10	Installation Guide
AlmaLinux 9	Installation Guide

---

VoIPmonitor WEB GUI

The commercial WEB GUI transforms raw sniffer data into actionable insights with:

Features

• Real-time Dashboards - 2D/3D visualizations, live call monitoring, NOC views
• CDR Analysis - Search, filter, and drill-down into any call
• SIP Ladder Diagrams - Interactive message sequence visualization
• Audio Playback - Waveform display with spectral analysis
• Quality Reports - MOS, jitter, packet loss trending and comparisons
• OLAP Analytics - Instant insights from millions of records
• Alerting - KPI thresholds, fraud detection, trend anomaly detection
• Billing Engine - Flexible price tables, revenue/cost tracking
• AI Transcription - OpenAI Whisper integration for call-to-text

Try It

• Live Demo - Explore the GUI instantly, no registration required
• 30-Day Trial - Full-featured trial license
• Cloud Option - Start in minutes, we handle everything

---

Tested Compatibility

VoIPmonitor works with any system using supported protocols. Tested with:

Category	Platforms
SIP Proxies	Kamailio, OpenSIPS
Media Servers	FreeSWITCH, Asterisk
Enterprise PBX	Cisco, Avaya, Genesys, Mitel
SBCs	AudioCodes, Ribbon, Oracle SBC, Cisco CUBE, Sangoma, Dialogic
UCaaS/CCaaS	NetSapiens, BroadSoft, Odin/Ooma

Capture Methods

• SPAN/RSPAN/ERSPAN port mirroring
• Network TAP
• SBC-native packet duplication
• Direct deployment on SBC/PBX

---

Performance

Metric	Capability
Concurrent Calls	100,000+
Calls Per Second	50,000+
Network Throughput	10 Gbit
CDR Writes/Second	50,000

Engineered for carrier-grade deployments with multi-core optimization, DPDK kernel-bypass support, and serialized I/O storage format.

---

Documentation

• Sniffer Manual - Complete sniffer configuration reference
• WEB GUI Manual - GUI features and usage
• Configuration Options - All configuration parameters
• FAQ - Frequently asked questions

---

Support

• Commercial Support - Included with WEB GUI license
• Email: support@voipmonitor.org
• Sales: info@voipmonitor.org
• GitHub Issues - For sniffer bug reports and feature requests

---

License

The sniffer is released under the GNU General Public License v2.0 (GPL-2.0).

The WEB GUI is commercial software available with monthly, quarterly, or annual subscriptions. See pricing for details.

---

About

VoIPmonitor is developed by Martin Vit in Prague, Czech Republic.

• Website: www.voipmonitor.org
• GitHub: github.com/voipmonitor