sipnab v0.4.1
The SIP & RTP analysis tool for people who ship voice infrastructure.
One binary. One dependency (libpcap). Interactive TUI + CLI + REST API.
Built in Rust for speed, safety, and correctness.
See It In Action
Browse SIP dialogs, select one, and drill into the call flow ladder diagram with parsed message detail.
Press m to mark any message, then navigate — the Δ badge shows exact millisecond delta.
Press / to search dialogs by Call-ID, From, or To header in real time.
Switch to a different pcap file from within the TUI — no need to restart. Data is reloaded instantly.
Press Tab to switch to RTP Streams — see SSRC, codec, jitter, packet loss, and duration for every media stream. Call flow shows RTP quality bars inline.
See Everything
Interactive TUI with multi-participant ladder diagrams, auth collapse, retransmit folding, mark+delta timing. Four timestamp modes, message diff, split view with resizable panels.
Analyze Everything
First-class RTP: jitter, loss, MOS per stream. RTCP XR. Comfort noise detection. One-way audio diagnosis. NAT mismatch detection. SDP offer/answer timeline. Post-dial delay and setup time measurement.
Export Everything
PCAP, PCAP-NG, TXT, Mermaid sequence diagrams, JSON, NDJSON, Markdown call reports, fail2ban format, Wireshark filters, tshark display filters. Pipe NDJSON to jq for custom pipelines.
Quick Start
# Build from source
git clone https://github.com/NormB/sipnab.git
cd sipnab && cargo build --release
# Capture live SIP traffic
sudo sipnab -d eth0
# Analyze a pcap file
sipnab -I capture.pcap
# CLI mode with JSON output
sipnab -N --json -I capture.pcap
# Show only problematic calls
sudo sipnab -N -d eth0 --problems
# Filter specific calls
sipnab --filter "from.user == '1001' AND rtp.mos < 3.0"
# Detailed call report
sipnab -I capture.pcap --call-report "abc123@host" --markdownWhat sipnab Does
| Capability | Details |
|---|---|
| Interactive TUI + CLI | Both modes in one binary. TUI for interactive analysis, CLI for batch/scripting. |
| RTP quality analysis | Jitter, packet loss, MOS (ITU-T G.107 E-model) per stream. RTCP XR parsing. |
| VoIP diagnosis | One-way audio detection, NAT mismatch, SDP timeline, PDD measurement. |
| Filter DSL | 30 fields, 7 operators, boolean combinators. Named aliases for common queries. |
| Security | Scanner detection, toll fraud, digest leak, registration flood. Fail2ban output. |
| TLS/SRTP decryption | TLS 1.2 + 1.3 via SSLKEYLOGFILE. SRTP auth verification (SDES key extraction). |
| Export formats | PCAP, PCAP-NG, TXT, JSON, NDJSON, CSV, HTML, Markdown, WAV audio, SIPp XML, RTP JSON. |
| HEP v2/v3 | Send and receive HEP for Homer/SIPCAPTURE integration. |
| REST API + Prometheus | Query dialogs, streams, stats via HTTP. Prometheus metrics endpoint. |
| MCP server | Drive sipnab from an AI agent (Claude Code, Claude Desktop, …) over stdio or HTTP. Eleven read-only tools cover dialogs, RTP, diagnostics, and security findings. |
| Browser analysis | Analyze pcap files in the browser via WASM. Zero upload, zero install. |
| Built in Rust | Memory-safe by construction. 1,340 automated tests. 5 MB static binary. |