sipmon is a free, open-source monitor for SIP signaling and RTP media quality. It runs as a standalone Rust executable on Linux without requiring a running PBX, and supports self-hosted use. It can analyze live interface captures, pcap and pcapng files, tcpdump streams from stdin, and recorded event logs. sipmon correlates SIP calls and transactions by Call-ID and can reassemble SIP-over-TCP traffic. For media, it reports RFC3550 jitter and packet loss, RTCP round-trip time, one-way delay estimates, and estimated E-model MOS. More than 20 diagnostic rules cover areas such as Contact reachability, Record-Route, SDP/RTP consistency, one-way media, and TURN allocation or refresh. It can learn TURN servers and label client and peer relay legs. The terminal interface includes pages for call details, SIP statistics, streams, event logs, and IP statistics, along with JSONL exports and Call-ID queries. Event logs contain summaries and truncated raw SIP messages; raw RTP payload is not stored. Static binaries are available for Linux x86_64 and aarch64.
Who it is for
sipmon suits teams that need to inspect SIP and RTP traffic on Linux, whether from live captures or saved files. It is also relevant to operators using Kamailio and rtpengine capture setups.
What is good
- Runs without a PBX.
- Accepts live, file, stdin, and event-log captures.
- Reports jitter, loss, delay estimates, and MOS.
- Includes more than 20 diagnostic rules.
- Does not store raw RTP payload.
What to know first
- Linux is the listed platform.
- High-rate capture can compete with rtpengine for CPU.
- Synthetic call tests are not included.
Verdict
sipmon brings SIP correlation, media metrics, and diagnostic rules into a standalone Linux tool. On busy relay hosts, capture may need filtering or a dedicated mirrored capture box.
Get started with sipmon
- Get a prebuilt static binary for Linux x86_64 or aarch64 from GitHub Releases, or install through Cargo.
- Run sipmon with a live interface capture, an offline pcap or pcapng file, a tcpdump stream from stdin, or a recorded event log.
- Use the terminal pages to review calls, SIP statistics, streams, events and IP statistics.
- Query a Call-ID flow or export JSONL for scripting.
- For high packet rates, filter traffic or use a dedicated mirrored capture box.
Limits to know first
Documented defaults cap memory at 100,000 calls, with a 15-minute call TTL and 50,000-entry caps for RTP streams and diagnostics. On busy relay hosts, capture competes with rtpengine for CPU; filtering traffic or using a dedicated mirrored capture box is recommended at high packet rates.
Questions about sipmon
Is sipmon free?
Yes. sipmon is listed as free and open source.
Which operating systems does it support?
The listed platforms are Linux and self-hosted. Prebuilt static binaries are available for Linux x86_64 and aarch64, and Cargo installation is also documented.
Does it require a PBX?
No. sipmon runs as a standalone Rust executable without depending on a running PBX.
What capture inputs can it analyze?
It accepts live interface captures, pcap and pcapng files, tcpdump streams from stdin, and recorded event logs.
What data does sipmon retain?
The event log stores analysis summaries and truncated raw SIP messages. Raw RTP payload is not stored.
What are the default storage limits?
Documented defaults include a 100,000-call memory cap, a 15-minute call TTL, and 50,000-entry caps for RTP streams and diagnostics.
Compared on VoIP monitoring software
- MOS scoring
- Yes
- Jitter tracking
- Yes
- Packet-loss tracking
- Yes
- Synthetic call tests
- No
