Home

sipnab

SIP & RTP capture, analysis, and security for VoIP — one Rust binary covering an interactive TUI, CLI batch mode, NDJSON, a REST API, and an MCP server.

This wiki mirrors the in-repo docs/ directory and is regenerated automatically on every change to main. For the polished documentation site see https://sipnab.com.

Quick start

# Install: detects OS/CPU/glibc, verifies the sha256, installs to
# /usr/local/bin (see Installation for .deb, .rpm and manual options)
curl -fsSL https://sipnab.com/install.sh | sh

sudo sipnab --setup-caps      # one-time: live capture without sudo (Linux)

sipnab                        # live TUI on the default interface
sipnab -I capture.pcap        # open a pcap in the TUI
sipnab -N -I capture.pcap --problems   # headless: only problem calls

Start here

New to sipnab? Read in this order:

1. Installation — packages, capture permissions, feature flags
2. Cookbook — copy-paste recipes for triage, filtering, recording, security
3. Keybindings — driving the TUI: call list, call flow, RTP streams, search
4. Filter DSL — narrowing to the calls you care about
5. CLI Reference and Output Formats — headless use and NDJSON pipelines
6. Troubleshooting — symptom → command when a call misbehaves
7. REST API and MCP — programmatic access and AI-agent integration

All pages

Getting started

• Installation
• First CLI Triage
• Glossary
• Cookbook
• Runnable Examples
• Real World Captures
• Troubleshooting
• Tuning Capture
• Encapsulations
• Rtpengine Relays
• Backers

Using the TUI

• TUI Walkthrough
• Keybindings
• Theme Guide

CLI & automation

• CLI Reference
• Error Messages
• Filter DSL
• Output Formats
• SIP Response Codes
• SIP Methods
• SIP Header Fields
• SIP Parameters
• SIP Lint Rules
• MOS and Codecs

Configuration

• Configuration

Integrations (API & MCP)

• REST API
• Prometheus Metrics
• Authentication
• MCP
• MCP Deployment
• MCP Across an Estate
• MCP Tools
• MCP Tools Core
• MCP Tools Signaling
• MCP Tools Captures
• MCP Tools Security
• MCP Tools Media
• MCP Tools Relay
• MCP Tools TFPS
• MCP Tools Server
• MCP Tools vCon
• MCP Tools TLS
• MCP Protocol
• Uprobe Walkthrough
• Capture SIP over TLS
• WASM Plugins
• vCon Export
• vCon Capture Stack
• G729 Decoding

Your SIP server

• Use OpenSIPS as the SIP Server
• Run sipnab beside OpenSIPS
• Use Kamailio as the SIP Server
• Run sipnab beside Kamailio
• Use Asterisk as the PBX
• Run sipnab beside Asterisk
• Use FreeSWITCH in the Voice Stack
• Run sipnab beside FreeSWITCH

Add to your voice stack

• Add a vCon Server
• Send vCons to a vCon Server
• Send vCons to vcon store
• Add TFPS
• Control TFPS from sipnab
• Ban SIP Scanners with fail2ban
• Feed fail2ban from sipnab
• Add rtpengine
• Name rtpengine Media with sipnab
• Add rtpproxy
• Name rtpproxy Media with sipnab
• Add Homer
• Connect sipnab to Homer
• Add Prometheus and Grafana
• Add sipnab Metrics to Prometheus

Development & internals

• Internals Index
• Internals Subsystem Guide
• Internals Invariants
• Internals Testing
• Internals Walkthroughs
• Internals Build CI Release
• Internals Profiling
• Internals Domain Primer
• Library API
• Benchmarks
• Fault Model
• Threat Model
• Assurance Case
• Architecture
• Internals Threading
• Internals TUI Testing
• Internals Zero Copy Payloads
• Internals Uprobe Capture
• Internals Rtpengine Control Plane
• Internals Relay Control Decoding
• Internals vCon Exporter
• Internals Operator Guide Notes
• Internals Postmortems
• Internals Code Map
• Internals Lint Rules
• Internals Encapsulation Decoding
• Internals MCP Design Notes
• Internals Metrics And Output Notes