SIP Flow Analyzer

A comprehensive SIP/VoIP protocol analysis and performance testing toolkit. Built for telecom engineers, VoIP architects, and network operations teams who need deep visibility into SIP signaling, RTP media quality, and voice network performance.

Features

• SIP Message Parser — Full RFC 3261 compliant parser with support for all standard methods, compact header forms, SDP body extraction, and URI decomposition
• Call Flow Analysis — Transaction state machine tracking (INVITE/non-INVITE), dialog lifecycle management, and ASCII call flow diagram generation
• RTP/RTCP Analysis — Jitter calculation (RFC 3550), packet loss detection, MOS estimation via ITU-T G.107 E-model, R-factor computation, codec identification, and DTMF detection
• PCAP Processing — Read pcap/pcapng files, filter SIP packets, extract RTP streams, reconstruct SIP dialogs
• SIP Load Testing — Async call generation with configurable CPS, multiple scenarios (basic call, registration, OPTIONS ping), concurrent call limits, and detailed performance statistics
• CDR Analysis — Parse CDRs from CSV/JSON/BroadSoft/Asterisk formats, compute ASR/ACD/Erlang, peak hour analysis, trunk utilization
• QoS Monitoring — Real-time quality monitoring with RTCP-XR parsing, configurable alert thresholds, and historical trend analysis

Architecture

┌─────────────────────────────────────────────────────────┐
│                    CLI Interface (Click)                  │
├─────────┬──────────┬──────────┬──────────┬──────────────┤
│  parse  │   flow   │   rtp    │   cdr    │  load / mon  │
├─────────┴──────────┴──────────┴──────────┴──────────────┤
│                                                          │
│  ┌──────────┐  ┌───────────┐  ┌──────────────────────┐  │
│  │SIP Parser│  │Call Flow  │  │  RTP/RTCP Analyzer   │  │
│  │          │  │Analyzer   │  │  - Jitter (RFC 3550) │  │
│  │- Methods │  │- State    │  │  - MOS (G.107)       │  │
│  │- Headers │  │  Machine  │  │  - R-factor          │  │
│  │- SDP     │  │- Dialog   │  │  - Codec Detection   │  │
│  │- URI     │  │- Renderer │  │  - DTMF (RFC 4733)   │  │
│  └──────────┘  └───────────┘  └──────────────────────┘  │
│                                                          │
│  ┌──────────┐  ┌───────────┐  ┌──────────────────────┐  │
│  │PCAP      │  │CDR        │  │  Load Test Engine    │  │
│  │Reader    │  │Analyzer   │  │  - Async SIP gen     │  │
│  │          │  │- ASR/ACD  │  │  - CPS control       │  │
│  │- pcap    │  │- Erlang   │  │  - Concurrency mgmt  │  │
│  │- pcapng  │  │- Peak hr  │  │  - PDD/setup time    │  │
│  │- Filter  │  │- Trunks   │  │  - Stats collection  │  │
│  └──────────┘  └───────────┘  └──────────────────────┘  │
│                                                          │
│  ┌─────────────────────────────────────────────────────┐ │
│  │              QoS Monitor                             │ │
│  │  - RTCP-XR parsing  - Alert thresholds              │ │
│  │  - R-factor/MOS     - Trend analysis                │ │
│  └─────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────┘

Installation

# From source
git clone https://github.com/kambidi1973/sip-flow-analyzer.git
cd sip-flow-analyzer
pip install -e .

# With PCAP support
pip install -e ".[pcap]"

# With all extras
pip install -e ".[pcap,charts,dev]"

Quick Start

Parse SIP Messages

sip-analyzer parse capture.txt --format json

Generate Call Flows from PCAP

sip-analyzer flow capture.pcap --call-id "abc123@host"

Analyze RTP Quality

sip-analyzer rtp capture.pcap

Analyze CDRs

sip-analyzer cdr records.csv --format csv

Run Load Test

sip-analyzer load 192.168.1.100 --cps 50 --duration 120 --max-concurrent 200

Monitor QoS

sip-analyzer monitor 192.168.1.100 --mos-threshold 3.5 --interval 5

MOS Estimation (ITU-T G.107 E-model)

The analyzer implements the ITU-T G.107 E-model for objective voice quality estimation:

R = R0 - Is - Id - Ie_eff + A

Where:
  R0  = 93.2 (basic signal-to-noise ratio)
  Is  = simultaneous impairment factor
  Id  = delay impairment factor
  Ie_eff = effective equipment impairment (codec + packet loss)
  A   = advantage factor

MOS = 1 + 0.035*R + R*(R-60)*(100-R)*7e-6

Supported Codecs

Codec	Bitrate	Ie Factor	Bpl Factor	Max MOS
G.711	64 kbps	0	4.3	4.41
G.729	8 kbps	11	19.0	3.92
G.722	64 kbps	0	4.3	4.50
Opus	6-510 kbps	2	10.0	4.48
AMR-WB	23.85 kbps	5	12.0	4.35
iLBC	15.2 kbps	8	32.0	4.14

Configuration

Create config/analyzer.yaml:

qos:
  thresholds:
    max_jitter_ms: 30
    max_packet_loss_pct: 1.0
    max_latency_ms: 150
    min_mos: 3.5

load_test:
  default_cps: 10
  max_concurrent: 200
  call_duration_sec: 30

pcap:
  sip_ports: [5060, 5061, 5070, 5080]
  detect_rtp: true

Docker

docker build -t sip-analyzer .
docker run -v $(pwd)/captures:/data sip-analyzer flow /data/capture.pcap

Technology Stack

• Python 3.8+ with asyncio for concurrent load testing
• Click for CLI framework
• NumPy for numerical computations
• Scapy for PCAP processing (optional)
• Rich for terminal output formatting
• Matplotlib for chart generation (optional)

References

• RFC 3261 — SIP: Session Initiation Protocol
• RFC 4566 — SDP: Session Description Protocol
• RFC 3550 — RTP: Real-Time Transport Protocol
• RFC 3611 — RTCP-XR: Extended Reports
• RFC 4733 — DTMF Digits via RTP
• ITU-T G.107 — The E-model for VoIP Quality
• ITU-T G.113 — Transmission Impairments

License

MIT License — see LICENSE for details.