Agenten stärken
Installation vom Herausgeber. Kein PlugMCP-Endpunkt.
Host a copy with our keys and logs.
Noch kein paketiertes Release in der Registry. Folgen Sie der README des Repositorys.
Remote-URL oder ein Befehl auf Ihrem Rechner? Worin sich die beiden Installationen unterscheiden
Auf PlugMCP ausführen
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
StartenRead a SIP call and see why it failed. SIP is the signaling protocol that sets up and tears down voice calls.
sipnab is one binary with no database and no web UI to run.
You can try it without installing anything. sipnab.com/analyze reads a pcap in your browser without uploading it.
The full documentation lives at sipnab.com and in docs/. The Glossary defines the terms these pages use.
On Linux (x86_64 or aarch64) or macOS:
curl -fsSL https://sipnab.com/install.sh | sh
The script does three things:
.sha256 file./usr/local/bin. It uses sudo only if that
directory is not writable.You can read the script first. To confirm the
install, run sipnab --version. It prints the version and the features
compiled in.
Other ways in:
Here are four common starting points. Each one ends with a link to the page that goes further.
Reading a file needs no root and no network interface. So it is the easiest place to start. This sample holds one completed call and four failed ones:
curl -LO https://github.com/NormB/sipnab/raw/main/tests/pcap-samples/sip-problem-call.pcap
Open it in the TUI (text user interface), the interactive full-screen view.
F1 for the keys each view accepts.q and then y to confirm.Ctrl-C to quit at once.sipnab -I sip-problem-call.pcap
Or stay on the command line. -N skips the TUI and prints to the terminal.
List every call in the file, with its final status code, as a report table:
sipnab -N -I sip-problem-call.pcap --report --no-cli-print
Print only the messages of calls that failed or sounded poor. The output is
JSON that you can pipe into jq:
sipnab -N --json -I sip-problem-call.pcap --problems
Explain one call. A Call-ID is the SIP header that names a call. The report table above lists them:
sipnab -N -I sip-problem-call.pcap --call-report '[email protected]' --no-cli-print
Next:
Live capture on Linux needs raw-socket access. Instead of running sipnab as root, grant the binary the two capabilities once. Then run it as yourself:
sudo sipnab --setup-caps
Then capture on an interface. Replace eth0 with your interface. ip link
lists them:
sipnab -d eth0
For a stream of JSON, one SIP message per line, add -N --json:
sipnab -N -d eth0 --json
--setup-caps after each upgrade. Replacing the binary clears its
capabilities.sudo instead.Kamailio, OpenSIPS and Asterisk can each mirror their SIP traffic over HEP. Then one sipnab listener sees the calls of every node. You install nothing on the production hosts.
A listener on a routable address must do one of two things:
--hep-allow),--hep-auth-file).Otherwise sipnab refuses to start it:
sipnab -N -L 0.0.0.0:9060 --hep-allow 192.0.2.10
To try it on one machine, bind to loopback. Then replay a capture into it from a
second terminal with -H (HEP send):
sipnab -N -L 127.0.0.1:9060
sipnab -N -I sip-problem-call.pcap -H 127.0.0.1:9060
A proxy's HEP feed carries its SIP signaling, not the call audio. For audio quality, run sipnab where the media flows as well.
These guides set this up end to end, TLS transport included:
sipnab can answer other programs while it captures. Choose an API key and keep
it in the environment. sipnab reads it there, and ps cannot see it there:
export SIPNAB_API_KEY="$(openssl rand -hex 32)"
Serve the REST API and Prometheus metrics on loopback. The process keeps
serving until you press Ctrl-C:
sipnab -N -I sip-problem-call.pcap --api 127.0.0.1:8080 --metrics 127.0.0.1:9100
curl -H "Authorization: Bearer $SIPNAB_API_KEY" http://127.0.0.1:8080/v1/dialogs
MCP (Model Context Protocol) lets an AI agent, such as Claude Code, call sipnab's analysis as tools.
--mcp-transport http serves remote agents instead.sipnab --mcp -N -I sip-problem-call.pcap --mcp-tools core
The server offers 76 tools. Every tool costs the agent context before it asks anything.
--mcp-tools core loads a small set that still answers a whole call.signaling and media load other sets.Next:
sudo sipnab --setup-caps to running as root.nobody, or --user).--chroot confines it further.--api-key or --api-signing-key,--mcp-token or --mcp-signing-key,--metrics-auth.--api-tls-cert / --api-tls-key (API TLS),--mcp-tls-cert / --mcp-tls-key (MCP TLS),--metrics-tls-cert / --metrics-tls-key
(Metrics TLS),tls_cert / tls_key keys in sipnab.toml.--hep-listen-transport tls,
--hep-send-transport tls). The sender does one of two things:
--hep-tls-ca),--hep-tls-extra-ca).-H),--reverse-dns),--kill-scanner and -K. On a live interface, these answer scanners with
SIP responses. --kill-scanner-detect-only detects scanners and never
answers them.-N),--json, one message per line),--from, --to and the rest),--problems, --slow-setup, --short-calls, --one-way and
--nat-issues.--filter: codec-asym, ptime-asym, payload-asym,
duration-asym and late-media. For example:
sipnab -N -I capture.pcap --filter codec-asym.--alert,
--alert-exec).--fail2ban).--allow-action enables it.--tls-key, TLS 1.2 RSA key exchange only),a=crypto keys in the SDP, or a master-keys
file with --srtp-keys.--dtls-keylog,
RFC 5764).--uprobe-tls)..deb and .rpm.--rtpproxy-control).--rtpengine-control). sipnab labels them as the relay's report, not
sipnab's measurement.--export-vcon, Export a call as a vCon).--vcon-forward, a separate process, delivers them to a vCon store. Two
examples are vcon.store and a self-hosted conserver.
vcon feature.--vcon-forward-kind vcon-store adds vcon.store's ingest path and header.
extensions
that both vCon drafts define
(Send sipnab's vCons to vcon.store).[[vcon.rule]]) pick calls by filter. They write them
per leg or per call.[[vcon.enrich]]).encrypt_to writes the signed and encrypted form.--analyze lists every problem in a capture, worst first.--yang-analyze writes it as
RFC 7951 JSON against a
published YANG module.--lint checks RFC conformance. Each finding has a rule ID and RFC
section.--redact replaces identities, addresses and hostnames in exported vCons
with keyed pseudonyms.--redact-map writes the reverse map to a file only you can read.--user after opening its devices.--sandbox) and a seccomp
allowlist (--seccomp).--mcp-file-root.--mcp-allow-open-capture),--mcp-allow-shutdown),--mcp-allow-save-findings),--allow-action).+/-Space to compare themx or F4)Tab), audio playback, and WAV
export (F2)Keybindings lists every key, per view.
sipnab is Rust everywhere except the OS boundary.
unsafe blocks, all of them FFI.You need Rust 1.99+ (edition 2024) and the libpcap headers:
xcode-select --install)apt install libpcap-devdnf install libpcap-develcargo build --release
The binary is at target/release/sipnab.
Install with cargo installs the
published crate instead.
At run time, sipnab loads the system libpcap (libpcap.so.1 on Linux). Only
the static musl release binary carries its own.
Audio playback in the TUI also needs libasound (ALSA).
libsipnab_audio.so.Every feature:
cargo build --release --features full
A headless capture host has the HEP listener, REST API and MCP over HTTP. It has no TUI or audio:
cargo build --release --no-default-features --features native,hep,api,mcp,mcp-http
Installation covers the other builds. That includes cross-compilation.
These are step-by-step guides.
Each guide installs your SIP server: OpenSIPS, Kamailio, Asterisk or FreeSWITCH.
It installs each piece beside it.
Then it connects sipnab to it.
Every command in each guide ran on fresh virtual machines. Each page names them.
SIP proxy. OpenSIPS and Kamailio carry your calls. Every other guide builds on them.
PBX. Asterisk answers calls and places them on to the callee, as two legs.
Softswitch. FreeSWITCH answers each call. It bridges the call to the callee as a second call. The audio of both passes through it.
Call records. A vCon server keeps every call as a vCon.
sipnab --vcon-forward delivers them, to the server or to
vcon.store. It is in the gnu and macOS builds, which carry the vcon
feature.Attack blocking. TFPS stops SIP scanners and fraud in the kernel with XDP. fail2ban bans them with an nftables rule.
Media relay. rtpengine or rtpproxy anchors every call's audio. sipnab matches the media on the relay with the call it belongs to.
Call history. Homer keeps a searchable history of every call your proxy sends it over HEP. sipnab can join the same feed.
Metrics. Prometheus and Grafana graph your SIP proxy's statistics. sipnab adds its own call and media series beside them.
docs/README.md indexes every page by what you are trying to do. Here are the ones most people need:
We welcome contributions.
license/cla check passes.Found a vulnerability? Do not open a public issue. SECURITY.md gives:
--alert-exec family.Licensed under either of
at your option.
Copyright 2024-2026 Norm Brandinger
SIP & RTP capture, analysis, and security tool. One binary, one dependency (libpcap), built in Rust.
Tools
Noch keine Tool-Liste. Remote-Server erhalten eine nach dem ersten Health-Check.
FAQ
Kopieren Sie auf dieser Seite die stdio-Konfiguration für Cursor, Claude Desktop, Claude Code oder VS Code. Sie nutzt die Installation des Herausgebers, keinen PlugMCP-Proxy.
In diesem Eintrag ist keine erforderliche Umgebungsvariable aufgeführt.
Sipnab läuft lokal über stdio.
Zuletzt geprüft: 2026-10-27. SIP & RTP capture, analysis, and security tool. One binary, one dependency (libpcap), built in Rust.