sngrep
Interactive SIP traffic analyzer
TLDR
SYNOPSIS
sngrep [-d device] [-I file] [-O file] [options] [filter]
DESCRIPTION
sngrep is a terminal-based tool for capturing and analyzing SIP (Session Initiation Protocol) traffic used in VoIP systems. It provides an interactive ncurses interface that displays active SIP dialogs, call flow diagrams with directional arrows, and full message content including headers and body.The tool captures SIP packets in real time from network interfaces or reads previously captured pcap files for offline analysis. Filters narrow results by SIP method, source or destination address, and custom BPF expressions. Captured traffic can be saved to pcap format for later review or sharing with other analysis tools.Call flow visualization is the tool's standout feature, showing the sequence of SIP messages (INVITE, 200 OK, ACK, BYE) between endpoints with timing information. This makes it particularly effective for diagnosing VoIP call setup failures, registration problems, and codec negotiation issues.
PARAMETERS
-d DEVICE
Capture device (or comma-separated list).-I FILE
Read packets from pcap file.-O FILE
Save captured packets to pcap file.-c
Only display dialogs starting with INVITE.-l LIMIT
Maximum number of dialogs to capture.-N
No interface mode (capture only).-q
Quiet mode (suppress output in no-interface mode).-r
Capture RTP packet payloads.-R
Rotate calls when capture limit is reached.-k FILE
RSA private key for TLS decryption.-B SIZE
Pcap buffer size in MB (default: 2).-H URL
Send captured packets to Homer sipcapture URL.-f FILE
Load specific configuration file.-D
Print active configuration and exit.
INTERFACE CONTROLS
Arrow keys - NavigateEnter - Show detailsF2 - SaveF7 - FilterF10/q - Quit
CAVEATS
Requires root for capture. TLS traffic needs decryption. High-volume may miss packets.
HISTORY
sngrep was created by Irontec for VoIP troubleshooting. It provides visual SIP analysis in the terminal.
