sngrep: Capture and Analyse SIP Packets on the Command Line

What is sngrep?

sngrep is a terminal tool that groups SIP (Session Initiation Protocol) Messages by Call-Id and displays them in arrow flows similar to the ones used in SIP RFCs. The aim of this tool is to make facilitate the process of learning or debugging SIP.

Features:

• Captures SIP packets from devices or read from PCAP file
• Supports UDP, TCP and TLS (partially) transports
• Allows filtering using BPF (Berkeley Packet Filter)
• Saves captured packets to PCAP file

How to Install sngrep?

To install sngrep you will need connect to the system via SSH as a root. 

Then enter the commands below in your terminal.

yum install libpcap
yum install libpcap-devel
git clone https://github.com/irontec/sngrep
cd sngrep
./bootstrap.sh
./configure
make
make install
sngrep

At this point you are ready to start using sngrep.

Call List Window insngrep

The first window that sngrep shows is Call List window and it displays the different SIP Call-Ids found in messages. The displayed columns depend on your terminal width and your custom configuration. Columns and their descriptions are given in the table below.

The Call List window is shown below.

Call List Window in sngrep

➤  Key Bindings:

Filter Option in Call List Window

In Call List window, you can filter the calls by pressing the F7 key.

The filtering options window is given below.

Filter Option in Call List Window

Call Flow Window in sngrep

The selected message payload will be displayed in the right side of the window.

Call Flow Window in sngrep

You can move between messages using arrow keys and select them using Spacebar. Selecting multiple messages will display the Message Diff Window.

➤  Key Bindings:

➤  There are several color modes to display the arrows:

➤  There are a few common messages you will see in most calls, some with simple text names:

INVITE
INVITE is used to set up a new media session between endpoints. INVITE will also typically contain session information in the form of SDP, which elaborates how to send media to/from your endpoint.

ACK
Your platform should acknowledge the 200 OK. This is important, if the 200 OK is not ACK'd the call will be torn down automatically after a short time.

BYE
On receipt of this BYE the call is hung up. BYE is a new request (like an INVITE) and therefore the other party will respond with a 200 OK just as they would to an INVITE.

➤  And some numeric codes, followed by a human-readable description:

100 Trying
This is simply an acknowledgement that indicates the request was received.

200 OK
Once your call has been answered, this is the final stage of negotiating the call setup. This looks similar to INVITE but the SDP provides information about the remote party. At this point the call is already established, and two-way audio should take place.

➤  Some of the most common (and some uncommon) codes are given below:

Tegsoft makes no representations or warranties, either express or implied, by or with respect to anything in this document, and shall not be liable for any implied warranties of merchantability or fitness for a particular purpose or for any indirect, special or consequential damages.

Copyright © 2021, Tegsoft. All rights reserved.

"Tegsoft" and Tegsoft’s products are trademarks of Tegsoft. References to other companies and their products use trademarks owned by the respective companies and are for reference purpose only.