sipmon

Paid LinuxSelf-hosted

What sipmon is

sipmon is a free, open-source monitor for SIP signaling and RTP media quality. It runs as a standalone Rust executable on Linux without requiring a running PBX, and supports self-hosted use. It can analyze live interface captures, pcap and pcapng files, tcpdump streams from stdin, and recorded event logs. sipmon correlates SIP calls and transactions by Call-ID and can reassemble SIP-over-TCP traffic. For media, it reports RFC3550 jitter and packet loss, RTCP round-trip time, one-way delay estimates, and estimated E-model MOS. More than 20 diagnostic rules cover areas such as Contact reachability, Record-Route, SDP/RTP consistency, one-way media, and TURN allocation or refresh. It can learn TURN servers and label client and peer relay legs. The terminal interface includes pages for call details, SIP statistics, streams, event logs, and IP statistics, along with JSONL exports and Call-ID queries. Event logs contain summaries and truncated raw SIP messages; raw RTP payload is not stored. Static binaries are available for Linux x86_64 and aarch64.

Who it suits

sipmon suits teams that need to inspect SIP and RTP traffic on Linux, whether from live captures or saved files. It is also relevant to operators using Kamailio and rtpengine capture setups.

What it does well

Runs without a PBX.
Accepts live, file, stdin, and event-log captures.
Reports jitter, loss, delay estimates, and MOS.
Includes more than 20 diagnostic rules.
Does not store raw RTP payload.

What to know first

Linux is the listed platform.
High-rate capture can compete with rtpengine for CPU.
Synthetic call tests are not included.

Limits

Documented defaults cap memory at 100,000 calls, with a 15-minute call TTL and 50,000-entry caps for RTP streams and diagnostics. On busy relay hosts, capture competes with rtpengine for CPU; filtering traffic or using a dedicated mirrored capture box is recommended at high packet rates.

Getting started

Get a prebuilt static binary for Linux x86_64 or aarch64 from GitHub Releases, or install through Cargo.
Run sipmon with a live interface capture, an offline pcap or pcapng file, a tcpdump stream from stdin, or a recorded event log.
Use the terminal pages to review calls, SIP statistics, streams, events and IP statistics.
Query a Call-ID flow or export JSONL for scripting.
For high packet rates, filter traffic or use a dedicated mirrored capture box.

Verdict

sipmon brings SIP correlation, media metrics, and diagnostic rules into a standalone Linux tool. On busy relay hosts, capture may need filtering or a dedicated mirrored capture box.

Questions

Is sipmon free?

Yes. sipmon is listed as free and open source.

Which operating systems does it support?

The listed platforms are Linux and self-hosted. Prebuilt static binaries are available for Linux x86_64 and aarch64, and Cargo installation is also documented.

Does it require a PBX?

No. sipmon runs as a standalone Rust executable without depending on a running PBX.

What capture inputs can it analyze?

It accepts live interface captures, pcap and pcapng files, tcpdump streams from stdin, and recorded event logs.

What data does sipmon retain?

The event log stores analysis summaries and truncated raw SIP messages. Raw RTP payload is not stored.

What are the default storage limits?

Documented defaults include a 100,000-call memory cap, a 15-minute call TTL, and 50,000-entry caps for RTP streams and diagnostics.

Facts from sipmon's own pages

Call analysis: It correlates SIP transactions and calls by Call-ID and supports SIP-over-TCP reassembly. · github.com, 8 Oct 2026
Capture caveat: On busy relay hosts capture competes with rtpengine for CPU; the README recommends filtering traffic or using a dedicated mirrored capture box at high packet rates. · github.com, 4 Oct 2026
Capture inputs: It can analyze live interfaces, offline pcap/pcapng files, tcpdump streams from stdin, and recorded event logs. · github.com, 8 Oct 2026
Deployment: The README describes deployment on a mirrored port or packet-capture box, with live, record, replay, and headless modes. · github.com, 8 Oct 2026
Diagnostics: The project describes 20+ diagnostic rules covering Contact reachability, Record-Route, SDP/RTP consistency, one-way media, and TURN allocation or refresh. · github.com, 8 Oct 2026
Integration: The README documents capturing Kamailio SIP and rtpengine media together, including a topology where SIP is mirrored to the rtpengine host. · github.com, 8 Oct 2026
Integrations: The README documents piping a live tcpdump capture into sipmon and describes capture setups involving Kamailio and rtpengine. · github.com, 4 Oct 2026
Interface and exports: It provides a terminal UI with Overview, Call Detail, SIP Stats, Streams, Event Log, and IP Stats pages, plus JSONL exports and Call-ID queries. · github.com, 4 Oct 2026
Interfaces and exports: It provides a terminal UI, JSONL exports, and a query command that retrieves a Call-ID flow for scripting. · github.com, 8 Oct 2026
Linux binaries: Prebuilt static Linux binaries are offered for x86_64 and aarch64, and the README also gives a Cargo installation option. · github.com, 8 Oct 2026
Linux downloads: The README says prebuilt static binaries are available for Linux x86_64 and aarch64, with installation from GitHub Releases or Cargo. · github.com, 4 Oct 2026
Maker: The repository links to miuda.ai, whose linked About page says the company was founded by a team of telecommunications and AI experts; it does not state a founding year or headquarters. · miuda.ai, 8 Oct 2026
Media metrics: It reports RFC3550 jitter and loss, RTCP receiver-report RTT, estimated one-way delay, and estimated E-model MOS. · github.com, 8 Oct 2026
Packet data: The event log stores analysis summaries and truncated raw SIP messages, and the README says raw RTP payload is not stored. · github.com, 8 Oct 2026
Privacy and storage: The event log stores analysis summaries and truncated raw SIP messages, and the README states that raw RTP payload is not stored. · github.com, 4 Oct 2026
Purpose: sipmon is a passive SIP/RTP signaling and media quality monitor that runs as a standalone Rust executable without depending on a running PBX. · github.com, 8 Oct 2026
SIP analysis: It correlates SIP calls and transactions by Call-ID and supports SIP-over-TCP reassembly. · github.com, 4 Oct 2026
Storage limits: The documented defaults include a 100,000-call memory cap, a 15-minute call TTL, and 50,000-entry caps for RTP streams and diagnostics. · github.com, 8 Oct 2026
Support: The maker's site lists [email protected] as a contact email. · miuda.ai, 8 Oct 2026
TURN support: sipmon can automatically learn TURN servers and label turn-client and turn-peer relay legs. · github.com, 8 Oct 2026

Where sipmon stands on Freedom251

VoIP Monitoring Software#19 of 21