MIT Licensed Clean-Room RFC 3261 100% Pure Rust Zero GPL Code

Next-Generation SIP Packet Sniffer & Call Flow Visualizer

A high-performance terminal tool inspired by sngrep, re-engineered from scratch in Rust for modern VoIP diagnostics, live ladder flow tracing, and offline PCAP inspection.

Interactive Call Flow Ladder Simulator

Click on any message in the flow to inspect real-time SIP headers and SDP payload

sipgrep-rs | Interface: eth0 (port 5060) | Calls: 1 | Msgs: 6 | [LIVE]
Call-ID: c204a8b-voip-session-991
Timestamp Client [192.168.1.100:5060] ◀ ── Flow ── ▶ PBX Server [10.0.0.1:5060]
15:42:01.102
|
INVITE (SDP: audio 4000)
▶|
Step 1
15:42:01.108
|◀
100 Trying
|
Step 2
15:42:01.145
|◀
180 Ringing
|
Step 3
15:42:03.420
|◀
200 OK (Call Answered)
|
Step 4
15:42:03.425
|
ACK
▶|
Step 5
15:42:25.800
|
BYE (Call Ended)
▶|
Step 6
Parsed RFC 3261 Message: INVITE Syntax Highlighted
INVITE sip:bob@biloxi.example.com SIP/2.0
Via: SIP/2.0/UDP 192.168.1.100:5060;branch=z9hG4bK-776asdhds
Max-Forwards: 70
From: "Alice" <sip:alice@biloxi.example.com>;tag=alice-tag-991
To: "Bob" <sip:bob@biloxi.example.com>
Call-ID: c204a8b-voip-session-991
CSeq: 1 INVITE
Contact: <sip:alice@192.168.1.100:5060>
Content-Type: application/sdp
Content-Length: 138

v=0
o=alice 2890844526 2890844526 IN IP4 192.168.1.100
s=SIP Call
c=IN IP4 192.168.1.100
t=0 0
m=audio 4000 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000
            

Why Engineers Choose sipgrep-rs

Engineered from clean RFC specifications with zero legacy dependencies

100% Clean-Room RFC 3261

Written from pure IETF RFC 3261, RFC 3262, and RFC 4566 (SDP) specs without using or copying sngrep source code. Safe for commercial use under the MIT license.

Real-Time Ladder Diagrams

Automatic call session correlation by Call-ID. Visualizes endpoint interactions, directional arrows, provisional status codes, and call states in ratatui TUI.

Blazing Fast Pure Rust

Powered by Rust 2024, etherparse for zero-copy packet slicing, and crossbeam channels. Ultra-low CPU usage even under high VoIP traffic.

Interactive Search & Filter

Filter calls on the fly by pressing /. Matches Call-ID, Caller URI, Callee URI, IP addresses, and methods.

CI & Script Friendly

Pipe ASCII ladder diagrams straight into logs or automation scripts using --ladder or stream packets directly to stdout with --dump.

PCAP & Live Sniffing

Supports live interface sniffing (eth0, any, loopback) as well as offline analysis of recorded Wireshark .pcap / .pcapng captures.

Getting Started

Get up and running with sipgrep-rs in seconds

1. Install system prerequisites (libpcap-dev):
sudo apt-get install -y libpcap-dev build-essential
2. Clone & build release binary:
git clone https://github.com/mahirgul/sipgrep-rs.git && cd sipgrep-rs && cargo build --release
3. Start live packet sniffing:
sudo ./target/release/sipgrep-rs -i eth0

TUI Keybindings

Key Action Context
Enter Open Call Flow ladder diagram / Inspect message Call List / Flow
Esc / b Back to previous view / clear filter Global
/ Open real-time interactive search filter bar Call List
Space Pause / resume live packet capture Global
d Inspect raw SIP message headers & SDP body Flow Ladder
c Clear captured call history from memory Call List
q Quit application cleanly Global