How to capture a SIP trace.
Before you can debug a SIP call, you need a trace - a .pcap, a sngrep dump, a vendor log. These short, opinionated guides walk through the fastest path for each tool real VoIP engineers actually reach for. Once you have the file, drop it into SIP Flow to render the ladder and surface RFC issues.
GUI tools
Desktop apps with a UI.
CLI tools
Headless capture from a shell.
Capture SIP traces with sngrep
- .pcap
- .txt
`sngrep` is a terminal SIP-aware sniffer that renders ladder diagrams in the shell and can live-capture, replay from a pcap, and export. It's the fastest way to grab a clean SIP-only pcap from a Linux PBX or SBC without installing a GUI.
Read the sngrep guide
Capture SIP traces with tshark
- .pcap
- .pcapng
- .txt
`tshark` is Wireshark's command-line sibling. It uses the same dissectors and capture filters as Wireshark, but runs headless, so it's the right tool for grabbing a clean SIP pcap from a server you can only reach over SSH.
Read the tshark guide
Capture SIP traces with tcpdump
- .pcap
- .pcapng
`tcpdump` is the lowest-common-denominator packet capture tool - installed on virtually every Linux/BSD/macOS box. It can't dissect SIP itself, but it produces clean .pcap files that SIP Flow, Wireshark, and sngrep all read natively. Reach for it first when you're triaging a server you've never touched before.
Read the tcpdump guide
Capture SIP traces with ngrep
- .txt
- .pcap
`ngrep` is grep for network packets. It can't write a clean pcap with the same fidelity as tcpdump, but its real strength is tailing SIP on the console with a regex filter - perfect for "is this REGISTER even reaching us?" debugging in a couple of seconds.
Read the ngrep guide
Centralized SIP capture
Platforms that collect SIP from your whole estate.
PBX-side traces
Capture from inside your PBX.
Capture SIP traces with Asterisk
- .txt
- .pcap
Asterisk's PJSIP and chan_sip stacks both expose verbose SIP logging from the CLI. You can dump SIP messages straight to the Asterisk console or full log file, then either send the text log to SIP Flow or pcap the loopback to convert it to .pcap.
Read the Asterisk guide
Capture SIP traces with FreeSWITCH
- .txt
- .pcap
FreeSWITCH exposes SIP via the Sofia stack, and `sofia loglevel` / `sofia global siptrace` give you message-level traces without restarting. Combine with `fs_cli` and tcpdump for a complete capture suitable for SIP Flow.
Read the FreeSWITCH guide
SBC-side traces
Capture from your session border controller.
Cloud carriers
Pull traces from your provider's portal.
Got the trace? Render the ladder.
Drop your .pcap, .pcapng, or sngrep log into SIP Flow and we'll render the call flow, surface RFC issues, and (optionally) ask SIPFlow AI to explain what went wrong - all client-side by default.
Open analyzer