sip-exporter
github.com
What it is
sip-exporter is a free, open-source Linux and self-hosted eBPF sensor for SIP and correlated RTP monitoring. It exposes Prometheus metrics at /metrics, including SIP traffic, active sessions, RFC 6076 performance, voice quality, RTP, RTCP, fraud, and diagnostic measures. RTP analysis covers jitter, packet loss, packet-delay variation, and E-model MOS; RTCP sender and receiver statistics include loss, jitter, and round-trip time linked by SSRC. Documented fraud indicators include registration scans, INVITE bursts, account takeover after a registration country change, and False Answer Supervision. A Grafana dashboard has 11 sections, with Prometheus alert examples and Alertmanager examples for Slack, PagerDuty, and email. Metrics are documented for Prometheus, VictoriaMetrics, Grafana Cloud, and compatible scrapers. Deployment uses a single container that must run privileged with host networking. Capture is limited to IPv4/UDP SIP and related RTP/RTCP, and the sensor must see signaling and media on the same call path.
Spec sheet
- Purpose
- sip-exporter is an open-source eBPF sensor that turns SIP signaling and correlated RTP traffic observed on a Linux host into Prometheus metrics and Grafana dashboards.Read 5 Oct 2026 · github.com
- Deployment
- The project provides a single-container deployment and says the container must run privileged with host networking to access eBPF and the network interface.Read 5 Oct 2026 · github.com
- Integrations
- The Prometheus-format metrics are documented as compatible with Prometheus, VictoriaMetrics, Grafana Cloud, and other Prometheus-compatible scrapers.Read 5 Oct 2026 · github.com
- Privacy
- The README says the exporter does not store packets or audio and parses only the fixed 12-byte RTP header, while RTP snapshots copied to userspace may include a small payload prefix.Read 5 Oct 2026 · github.com
- Support
- The project directs users to GitHub Issues for support, bug reports, and feature requests, and to its security policy for private vulnerability reports.Read 5 Oct 2026 · github.com
- License
- The project is licensed under AGPL-3.0 and says modified network-accessible versions must offer users the corresponding source under the license terms.Read 5 Oct 2026 · github.com
- Capture
- It captures IPv4/UDP SIP and correlated RTP/RTCP; SIP over TCP or TLS is not captured.Read 5 Oct 2026 · github.com
- Capture method
- An eBPF socket filter selects IPv4 SIP packets over UDP for userspace processing; SIP over TCP or TLS is not captured.Read 5 Oct 2026 · github.com
- Dashboard and alerts
- The repository includes a Grafana dashboard and documented Prometheus alert-rule examples, with Alertmanager examples for Slack, PagerDuty, and email.Read 5 Oct 2026 · github.com
- Data handling
- The project says it does not store packets or audio; its RTP processing parses the fixed RTP header and does not inspect or persist audio.Read 5 Oct 2026 · github.com
- Fraud signals
- Documented fraud signals include registration scans, INVITE bursts, account takeover after a registration country change, and False Answer Supervision.Read 5 Oct 2026 · github.com
- Grafana dashboard
- The repository includes a Grafana dashboard with 11 sections and documented Prometheus alert-rule examples.Read 5 Oct 2026 · github.com
- Limits
- The sensor requires a host that sees IPv4/UDP SIP signaling and the correlated RTP/RTCP path; IPv6, fragmented UDP, SIP over TCP/TLS, and mirrored traffic for trustworthy QoE/direction are unsupported.Read 5 Oct 2026 · github.com
- Metrics
- It exposes SIP traffic, active-session, RFC 6076 performance, RFC 6035 voice-quality, RTP, RTCP, fraud, and diagnostic metrics at `/metrics`.Read 5 Oct 2026 · github.com
- Network placement
- For full metrics, the sensor must run on a host that sees both SIP signaling and RTP media on the same call path.Read 5 Oct 2026 · github.com
- RTCP support
- It reports RTCP receiver and sender statistics, including loss, jitter, and round-trip time, correlated by SSRC.Read 5 Oct 2026 · github.com
- RTP quality
- RTP analysis includes jitter, packet loss, packet-delay variation, and E-model MOS for streams correlated with SIP dialogs.Read 5 Oct 2026 · github.com
- SIP and RTP metrics
- The exporter reports SIP traffic and session metrics, RFC 6076 performance metrics, and RTP quality metrics including packet loss, jitter, and MOS.Read 5 Oct 2026 · github.com
- Supported traffic
- Capture support is IPv4/UDP SIP and RTP/RTCP; SIP over TCP/TLS, IPv6 traffic, and fragmented UDP are listed as unsupported.Read 5 Oct 2026 · github.com
- Telemetry
- Anonymous usage telemetry is enabled by default and can be opted out of by setting SIP_EXPORTER_TELEMETRY to false.Read 5 Oct 2026 · github.com
Plans and prices
Strong points and limits
Strong points
- Open-source AGPL-3.0 licensing
- Reports jitter, packet loss, and MOS
- Includes Grafana dashboard and alert examples
- Documents Prometheus-compatible integrations
- Does not store packets or audio
Limits
- SIP over TCP or TLS is unsupported
- IPv6 and fragmented UDP are unsupported
- Requires privileged container and host networking
- Needs signaling and media on the same path
Who it suits
sip-exporter suits Linux operators who can place a privileged sensor where both SIP signaling and RTP media are visible. It fits users already using Prometheus or Grafana-compatible monitoring.
Verdict
sip-exporter provides detailed SIP, RTP, RTCP, quality, and fraud metrics for compatible Linux traffic. Its value depends on meeting strict capture and network-placement requirements.
Where Specifiction places it
- VoIP Monitoring Software#7 of 217.9