Glossary

The VoIP and sipnab terms the rest of these pages use, one short definition each. Every definition says what the term means in sipnab’s output, which sometimes differs from a textbook.

ACD

Average call duration. The mean talk time, in seconds, of the calls that were both answered and hung up inside the capture. A call still up when the capture ended does not count.

ASR

Answer-seizure ratio. Of the INVITEs that reached a final response, the percentage answered with a 2xx. An INVITE still ringing when the capture ended is not counted, and a REGISTER is never a call attempt.

B2BUA

Back-to-back user agent. A SIP element that ends a call on one side and starts a new call on the other, so each side (a leg) carries its own Call-ID. The TUI’s extended flow (x or F4 in the call flow) draws the legs sipnab matched as one ladder.

BPF

Berkeley Packet Filter. The kernel filter, written in tcpdump syntax, that decides which packets reach sipnab during a live capture. sipnab builds one from --portrange unless you pass your own. The eBPF uprobe backend, which reads TLS without keys, uses the same kernel machinery for a different job.

Call-ID

The SIP header that names one call. Every message in a dialog carries the same value, and sipnab keys each dialog on it, so --call-report and the REST and MCP lookups all take a Call-ID.

Dialog

One SIP conversation: every message that shares a Call-ID. The call list shows one row per dialog, and that includes registrations and other exchanges that are not calls.

HEP

Homer Encapsulation Protocol. A proxy such as Kamailio, OpenSIPS or Asterisk copies each SIP message into a HEP packet and sends it to a collector. sipnab can be that collector (-L) or a sender (-H), over UDP, TCP or TLS.

Jitter

How much the spacing between RTP packets varies, in milliseconds. sipnab computes it with the interarrival algorithm of RFC 3550.

MCP

Model Context Protocol. The protocol an AI agent uses to call tools. With --mcp, sipnab offers its analysis as MCP tools, so an agent asks the capture questions instead of parsing text output. See MCP server.

MOS

Mean opinion score. An estimate of how the audio sounded, on a scale from 1.0 (bad) to 4.5 (excellent). sipnab derives it from loss, jitter, delay and the codec with the ITU-T G.107 E-model, and gives an AMR-WB stream a second, wideband score on its own scale. Some codecs have no published basis for the score, and for those sipnab reports a flagged placeholder. MOS and codecs lists which.

NER

Network effectiveness ratio (ITU-T E.411). Of the INVITEs that reached a final response, the percentage the network delivered to the far end: answered calls plus those the callee refused with 480, 486, 487, 600 or 603. A low NER points at the network. A low ASR with a normal NER means the network reached the called phones and people chose not to answer.

Orphan stream

An RTP stream sipnab could not match to any dialog’s SDP. It has no Call-ID. Common causes are NAT rewriting the media address, or SIP that happened somewhere the capture did not see.

PDD

Post-dial delay. The time from the INVITE to the first 180 Ringing or 183 Session Progress, which is how long the caller waited before hearing anything.

R-factor

The E-model’s transmission rating, from 0 to 100, that sipnab computes the MOS from. sipnab reports its own R-factor beside the MOS, and separately shows the far end’s R-factor when that endpoint sends it in RTCP XR.

RTP and RTCP

RTP (Real-time Transport Protocol) carries the audio or video. RTCP is its control channel: each end reports the loss and delay it sees. sipnab measures RTP itself and reads RTCP as the far end’s own account.

SBC

Session border controller. The SIP element at the edge of a network, between a carrier and a PBX for example. Most SBCs act as a B2BUA, so a call crossing one shows up as two dialogs.

SDP

Session Description Protocol. The body of an INVITE or its answer that names the codecs and the address and port each side expects media on. sipnab reads it to match RTP streams to dialogs.

SIPREC, SRC and SRS

SIPREC (RFC 7866) is how a call gets recorded: the session recording client (SRC) sends the call’s media and a metadata document to a session recording server (SRS). sipnab reads that metadata, meaning who was on the call and which stream belongs to whom. It is neither an SRC nor an SRS.

SSRC

Synchronization source. The 32-bit number in every RTP header that names one media stream. Two streams on the same address and port stay apart in sipnab’s output because their SSRCs differ.

TFPS

A toll-fraud prevention system: optional separate software that decides which sources to ban and enforces that in the firewall. sipnab can ask it what it decided (the tfps_* MCP tools and the /v1/tfps/ routes) and never bans anything itself.

TUI

Text user interface. The interactive full-screen view sipnab opens when you run it without -N.

vCon

A JSON container for one conversation: parties, dialog, and optionally the audio. sipnab writes one observed dialog as a vCon with --export-vcon, unsigned and as an observer rather than a party. See Export a call as a vCon.