{"id":4896,"date":"2019-10-24T14:33:42","date_gmt":"2019-10-24T12:33:42","guid":{"rendered":"https:\/\/nil.uniza.sk\/?p=4896"},"modified":"2021-05-13T07:29:01","modified_gmt":"2021-05-13T05:29:01","slug":"tools-for-a-quick-sip-diagnostics","status":"publish","type":"post","link":"https:\/\/nil.uniza.sk\/en\/tools-for-a-quick-sip-diagnostics\/","title":{"rendered":"Tools for a quick SIP diagnostics &#8211; ngrep, sipgrep and sngrep"},"content":{"rendered":"<p>Sometimes there is a need for simple and quick analysis or the troubleshooting of a SIP server and its call functions.  Of course, we should use the well-known <code>tcpdump<\/code>, mentioned in the article <a href=\"https:\/\/nil.uniza.sk\/en\/using-tcpdump-sip-diagnostic\/\">Using tcpdump for SIP diagnostics<\/a>. However, for some occasional Linux users this may be too difficult and unclear.  Actually there exist some simpler utilities,, that could work fine, as ngrep, and for me newer sipgrep and sngrep (love at first sight).<\/p>\n\n\n\n<p>All utils are directly available and can be installed online from Debian repo using <code>apt-get install ngrep sipgrep sngrep<\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ngrep<\/h2>\n\n\n\n<p>web:  <a href=\"https:\/\/github.com\/jpr5\/ngrep\">https:\/\/github.com\/jpr5\/ngrep<\/a> <\/p>\n\n\n\n<p>For years I have been using ngrep (described in <a href=\"https:\/\/nil.uniza.sk\/en\/ngrep-tool-voip-analysis\/\">Ngrep \u2013 a tool for VoIP analysis<\/a>). Preferred to save formatted messages to a file:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ngrep -d any -p -q -W byline port 5060 &gt; test.txt<\/pre>\n\n\n\n<p>or to watch on the fly (could be to fast for analysis)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ngrep -d any -p -q -W byline port 5060<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Sipgrep<\/h2>\n\n\n\n<p>web:  <a href=\"https:\/\/github.com\/sipcapture\/sipgrep\">https:\/\/github.com\/sipcapture\/sipgrep<\/a> <\/p>\n\n\n\n<p>Sipgrep is a grep tool for SIP diagnostic, where opposed to generic ngrep, it allows us to focus on certain SIP fields  (To, From, Contact &#8230;). Tool highlights SIP information as the transaction and dialog information. <\/p>\n\n\n\n<p>For the simplest use type<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>root@voip ~ # sipgrep<\/strong>\n interface: eth0 (158.193.152.0\/255.255.255.128)\n filter: (ip or ip6) and ( portrange 5060-5061) or (udp and ip[6:2] &amp; 0x3fff != 0)<\/pre>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img alt=\"\" decoding=\"async\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/10\/image-3.png\" class=\"wp-image-4906\" width=\"700\" height=\"389\"\/><figcaption>sipgrep<\/figcaption><\/figure>\n\n\n\n<p>But sipgrep also allows to simply focus on specific SIP AORs. For example  to show all messages from SIP URI (AOR) 1765<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">  sipgrep -d any -t 1763 -G  <\/pre>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img alt=\"\" decoding=\"async\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/10\/image-4.png\" class=\"wp-image-4908\" width=\"700\" height=\"389\"\/><figcaption>Filter calls to 1763 number<\/figcaption><\/figure>\n\n\n\n<p>More at <code>man sipgrep<\/code> or project <a href=\"https:\/\/github.com\/sipcapture\/sipgrep\">home page<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sngrep<\/h2>\n\n\n\n<p>web:  <a href=\"https:\/\/github.com\/irontec\/sngrep\">https:\/\/github.com\/irontec\/sngrep<\/a> <\/p>\n\n\n\n<p>A big surprise for me, the great tool <code>sngrep<\/code>, Provides a nice overview of what is happening on a SIP Server arranged on a dialog view. We may move using arrows keys and using enter and Esc keys simply look into each SIP message of the dialog.<\/p>\n\n\n\n<p>Features:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Capture SIP packets from devices or read from PCAP file<\/li><li>Supports UDP, TCP and TLS (partially) transports<\/li><li>Allows filtering using BPF (Berkeley Packet Filter)<\/li><li>Save captured packets to PCAP file<\/li><\/ul>\n\n\n\n<p>Simplest use? Just type<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><strong>sngrep<\/strong><\/pre>\n\n\n\n<p>and watch \ud83d\ude09 For the movement use arrow keys, Enter (go in), Esc (or q to go back) and F8 or c for message highlight. <\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img alt=\"\" decoding=\"async\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/10\/image-5.png\" class=\"wp-image-4911\" width=\"700\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/10\/image-5.png 605w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/10\/image-5-300x170.png 300w\" sizes=\"(max-width: 605px) 100vw, 605px\" \/><figcaption>sngrep<\/figcaption><\/figure>\n\n\n\n<p>of course, it allows more. Sngrep shows information using several windows:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>C<strong>all List Window<\/strong>: Shows and allows to select calls (dialogs) to be displayed in deeper detail  (use arrow keys to select one call  from the list or in combination with <code>Spacebar <\/code>key select more calls and hit the Enter then).<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img alt=\"\" decoding=\"async\" width=\"1024\" height=\"641\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1024x641.png\" class=\"wp-image-4975\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1024x641.png 1024w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-300x188.png 300w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-768x481.png 768w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image.png 1355w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption>Call list window &#8211; the list of dialogs<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><img alt=\"\" decoding=\"async\" width=\"1024\" height=\"58\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1-1024x58.png\" class=\"wp-image-4977\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1-1024x58.png 1024w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1-300x17.png 300w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1-768x44.png 768w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-1.png 1340w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption> Call list window  &#8211; selecting two dialogs<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Call Flow Windo<\/strong>w: displays selected call from the Call list window. <\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img alt=\"\" decoding=\"async\" width=\"1024\" height=\"593\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-2-1024x593.png\" class=\"wp-image-4978\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-2-1024x593.png 1024w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-2-300x174.png 300w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-2-768x445.png 768w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-2.png 1329w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption>Call flow window<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Call Raw Window<\/strong>: Display selected dialog messages in plain text (useful for copy messages to clipboard).  Go in from Call flow window using the <code>F6 <\/code>key<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img alt=\"\" decoding=\"async\" width=\"1024\" height=\"600\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-3-1024x600.png\" class=\"wp-image-4979\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-3-1024x600.png 1024w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-3-300x176.png 300w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-3-768x450.png 768w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-3.png 1361w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption>Call raw window<\/figcaption><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Message Diff Window<\/strong>: the window will compare and shows differences of two messages. Reach the window by selecting two messages using <code>Spacebar <\/code>inside of the Call Flow window<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><img alt=\"\" decoding=\"async\" width=\"1024\" height=\"604\" src=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-6-1024x604.png\" class=\"wp-image-4985\" srcset=\"https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-6-1024x604.png 1024w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-6-300x177.png 300w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-6-768x453.png 768w, https:\/\/nil.uniza.sk\/wp-content\/uploads\/2019\/11\/image-6.png 1356w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption>Message diff window<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">sngrep &#8211; command line arguments<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sngrep &#91;-hVcivNqrD] &#91;-IO pcap_dump] &#91;-d dev] &#91;-l limit] &#91;-k keyfile] &#91;-LH capture_url] &#91;&lt;match expression&gt;] &#91;&lt;bpf filter&gt;]<\/code><\/pre>\n\n\n\n<p>where:<\/p>\n\n\n\n<ul class=\"wp-block-list\">null<li>-h &#8211;help: This usage<\/li><li> -V &#8211;version: Version information<\/li><li> -d &#8211;device: Use this capture device instead of default<\/li><li> -I &#8211;input: Read captured data from pcap file<\/li><li> -O &#8211;output: Write captured data to pcap file<\/li><li> -c &#8211;calls: Only display dialogs starting with INVITE<\/li><li> -r &#8211;rtp: Capture RTP packets payload<\/li><li> -l &#8211;limit: Set capture limit to N dialogs<\/li><li> -i &#8211;icase: Make case insensitive<\/li><li> -v &#8211;invert: Invert<\/li><li> -N &#8211;no-interface: Don&#8217;t display sngrep interface, just capture<\/li><li> -q &#8211;quiet: Don&#8217;t print captured dialogs in no interface mode<\/li><li> -D &#8211;dump-config: Print active configuration settings and exit<\/li><li> -f &#8211;config: Read configuration from file<\/li><li> -R &#8211;rotate: Rotate calls when capture limit have been reached.<\/li><li> -H &#8211;eep-send: Homer sipcapture url (udp:X.X.X.X:XXXX)<\/li><li> -L &#8211;eep-listen: Listen for encapsulated packets (udp:X.X.X.X:XXXX)<\/li><li> -k &#8211;keyfile: RSA private keyfile to decrypt captured packets<\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>Sometimes there is a need for simple and quick analysis or the troubleshooting of a SIP server and its call functions. Of course, we should use the well-known tcpdump, mentioned in the article Using tcpdump for SIP diagnostics. However, for some occasional Linux users this may be too difficult and unclear. Actually there exist some&#8230;<\/p>","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"footnotes":""},"categories":[685,771,807,677],"tags":[965,1259,1279,1261,1263],"class_list":["post-4896","post","type-post","status-publish","format-standard","hentry","category-linux_-_howto-en","category-sip-en","category-sip-testing-en","category-ip-telephony-voip","tag-linux","tag-ngrep","tag-sip-giagnostic","tag-sipgrep","tag-sngrep"],"taxonomy_info":{"category":[{"value":685,"label":"Linux - HOWTO"},{"value":771,"label":"SIP"},{"value":807,"label":"Testing"},{"value":677,"label":"VoIP"}],"post_tag":[{"value":965,"label":"linux"},{"value":1259,"label":"ngrep"},{"value":1279,"label":"sip giagnostic"},{"value":1261,"label":"sipgrep"},{"value":1263,"label":"sngrep"}]},"featured_image_src_large":false,"author_info":{"display_name":"palo73","author_link":"https:\/\/nil.uniza.sk\/en\/author\/palo73\/"},"comment_info":7,"category_info":[{"term_id":685,"name":"Linux - HOWTO","slug":"linux_-_howto-en","term_group":0,"term_taxonomy_id":683,"taxonomy":"category","description":"","parent":0,"count":71,"filter":"raw","cat_ID":685,"category_count":71,"category_description":"","cat_name":"Linux - HOWTO","category_nicename":"linux_-_howto-en","category_parent":0},{"term_id":771,"name":"SIP","slug":"sip-en","term_group":0,"term_taxonomy_id":769,"taxonomy":"category","description":"","parent":0,"count":23,"filter":"raw","cat_ID":771,"category_count":23,"category_description":"","cat_name":"SIP","category_nicename":"sip-en","category_parent":0},{"term_id":807,"name":"Testing","slug":"sip-testing-en","term_group":0,"term_taxonomy_id":805,"taxonomy":"category","description":"","parent":771,"count":2,"filter":"raw","cat_ID":807,"category_count":2,"category_description":"","cat_name":"Testing","category_nicename":"sip-testing-en","category_parent":771},{"term_id":677,"name":"VoIP","slug":"ip-telephony-voip","term_group":0,"term_taxonomy_id":675,"taxonomy":"category","description":"","parent":673,"count":3,"filter":"raw","cat_ID":677,"category_count":3,"category_description":"","cat_name":"VoIP","category_nicename":"ip-telephony-voip","category_parent":673}],"tag_info":[{"term_id":965,"name":"linux","slug":"linux","term_group":0,"term_taxonomy_id":963,"taxonomy":"post_tag","description":"","parent":0,"count":5,"filter":"raw"},{"term_id":1259,"name":"ngrep","slug":"ngrep","term_group":0,"term_taxonomy_id":1257,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":1279,"name":"sip giagnostic","slug":"sip-giagnostic","term_group":0,"term_taxonomy_id":1277,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":1261,"name":"sipgrep","slug":"sipgrep","term_group":0,"term_taxonomy_id":1259,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"},{"term_id":1263,"name":"sngrep","slug":"sngrep","term_group":0,"term_taxonomy_id":1261,"taxonomy":"post_tag","description":"","parent":0,"count":1,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts\/4896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/comments?post=4896"}],"version-history":[{"count":0,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/posts\/4896\/revisions"}],"wp:attachment":[{"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/media?parent=4896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/categories?post=4896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nil.uniza.sk\/en\/wp-json\/wp\/v2\/tags?post=4896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}