VoIP Infrastructure Guide
VoIP Monitoring Tools
8 min read · Updated April 2026
The right VoIP monitoring tools make troubleshooting fast and systematic. From packet capture to SIP trace visualization to call quality dashboards, here are the tools every VoIP engineer needs to know.
1. Packet capture tools
tcpdump — command-line capture
; Capture SIP and RTP
tcpdump -i eth0 -w /tmp/voip.pcap port 5060 or portrange 10000-20000
; Capture with rotation (100MB files, keep last 10)
tcpdump -i eth0 -w /tmp/voip-%Y%m%d%H%M.pcap -G 3600 -C 100 -W 10 port 5060
; Capture specific call by IP
tcpdump -i eth0 -w /tmp/call.pcap host 203.0.113.1
; Filter SIP INVITE only
tcpdump -i eth0 -A 'port 5060 and (udp or tcp)' | grep INVITE
Wireshark — GUI packet analysis
Wireshark is the standard for offline PCAP analysis. For VoIP:
- Telephony → SIP → SIP Flows — shows all SIP dialogs with call-flow diagrams
- Telephony → RTP → RTP Streams — shows RTP streams with packet loss and jitter stats
- Telephony → VoIP Calls — combined view of SIP and RTP per call
- Filter: sip.Method == "INVITE" — filter for specific SIP methods
- Filter: rtcp.fraction_lost > 0 — find calls with RTP packet loss
2. SIP trace analysis tools
sngrep — real-time SIP monitor
sngrep is a terminal-based SIP capture and display tool. It shows live SIP dialogs with color-coded message flows — the fastest way to see what is happening on a SIP server in real time.
; Install sngrep
apt-get install sngrep ; Debian/Ubuntu
yum install sngrep ; CentOS/RHEL
; Monitor live SIP traffic
sngrep
; Filter for specific extension
sngrep -I /tmp/capture.pcap -f "sip:1001@"
; Capture to file
sngrep -O /tmp/capture.pcap
sipsak — SIP testing and OPTIONS ping
; Test SIP server reachability
sipsak -s sip:sip.provider.com
; Verbose REGISTER test
sipsak -s sip:1001@pbx.example.com -u 1001 -p password -v
; Send OPTIONS ping
sipsak -s sip:sip.provider.com -O sip:probe
3. Call quality monitoring tools
VoIPmonitor — open source CDR and quality
VoIPmonitor captures SIP and RTP, calculates per-call MOS scores, and provides a web dashboard for call quality analysis. It runs as a daemon on your PBX server and provides historical quality data.
; Install VoIPmonitor
wget https://www.voipmonitor.org/download-latest
# Follow installation instructions at voipmonitor.org
; Key features:
; - Per-call MOS score from RTCP
; - SIP trace storage and search
; - CDR generation
; - Web dashboard at port 80
; - API for integration
RTCP-based quality measurement
; Wireshark - extract RTCP quality stats from PCAP
tshark -r voip.pcap -Y rtcp -T fields -e rtcp.ssrc -e rtcp.fraction_lost -e rtcp.inter_arrival_jitter -e rtcp.lsr -e frame.time
; Convert RTCP fraction_lost to percentage
; fraction_lost is 8-bit integer: 255 = 100% loss
; percentage = (fraction_lost / 255) * 100
4. Homer SIP capture platform
Homer is the open source standard for SIP capture and storage at scale. It stores SIP traces in a searchable database and provides a web UI for call flow visualization. Production deployments use Homer for compliance, troubleshooting, and capacity planning.
; Homer architecture:
; HEP Agent (on PBX) -> Homer Capture Server -> Homer Web UI
; Configure Kamailio to send HEP to Homer
loadmodule "siptrace.so"
modparam("siptrace", "duplicate_uri", "sip:homer-server:9060")
modparam("siptrace", "hep_mode_on", 1)
; Configure Asterisk to send HEP to Homer
; /etc/asterisk/hep.conf
[general]
enabled = yes
capture_address = homer-server:9060
capture_password = myhomerpassword
uuid_type = call-id
Homer provides: call search by Call-ID, From, To, or timerange; visual call flow diagrams; PCAP export per call; CDR statistics; and API access for integration with other tools.
5. Commercial VoIP monitoring platforms
| Tool | Focus | Best for |
|---|
| VIAVI Observer | Network + VoIP quality | Enterprise network monitoring |
| NetScout nGeniusONE | Application performance | Large enterprise, carrier |
| Empirix Hammer | VoIP testing and monitoring | Contact center testing |
| IR Prognosis | UC monitoring | Teams, Cisco, Avaya monitoring |
| Anritsu CQM | Carrier-grade monitoring | Telco, carrier deployments |
6. AI-powered SIP analysis
Traditional monitoring tools surface metrics but require engineer expertise to interpret them. AI-powered analysis interprets the SIP trace and provides actionable findings directly.
SIPSymposium provides AI-powered SIP trace analysis: paste a SIP trace or upload a PCAP and get expert-level findings — severity-ranked issues, RFC compliance checks, codec analysis, NAT detection, encryption validation, and multi-endpoint correlation — in seconds.
Capabilities:
- SIP signaling analysis: response codes, timer behavior, dialog state, auth flows
- SDP analysis: codec negotiation, ptime mismatch, ICE candidates, SRTP configuration
- RTP quality: packet loss from RTCP reports, jitter measurement, MOS estimation
- Multi-endpoint correlation: compare SDP across multiple endpoints in a single call
- Compliance checking: HIPAA, PCI-DSS, SOC 2 evidence from SIP traces
; Example workflow: automated quality monitoring
; 1. Capture PCAP on failed or low-quality calls
; 2. Submit to SIPSymposium for analysis
; 3. Receive structured findings with recommendations
; 4. Alert on critical findings automatically
; Coming soon: SIPSymposium API for programmatic access
; See: sipsymposium.com/guides/voip-api-integration-guide
Frequently asked questions
What is the best tool for SIP trace analysis?
The best tools for SIP trace analysis depend on your use case: sngrep for real-time terminal monitoring on a live server, Wireshark for detailed offline PCAP analysis with call flow visualization, Homer for scalable production SIP capture and storage, and SIPSymposium for AI-powered analysis that interprets findings without requiring deep SIP expertise.
How do I measure VoIP call quality?
Measure VoIP call quality using RTCP Receiver Reports which contain packet loss fraction, inter-arrival jitter, and round-trip time. In Wireshark: Telephony → RTP → RTP Streams. For production monitoring, deploy VoIPmonitor for automatic per-call MOS scoring. Target MOS above 4.0, packet loss below 1%, and jitter below 30ms.
What is Homer SIP and how does it work?
Homer is an open source SIP capture and storage platform. HEP agents on your SIP servers (Asterisk, Kamailio, FreeSWITCH) send copies of SIP messages to the Homer Capture Server via the HEP protocol. Homer stores them in a database searchable by Call-ID, number, or time range. The web UI shows call flow diagrams and allows PCAP export per call.
Want AI-powered SIP trace analysis?
Paste your SIP trace or upload a PCAP into SIPSymposium. Get expert-level findings on signaling errors, codec mismatches, RTP quality, and compliance issues in seconds.