Glossary - NormB/sipnab GitHub Wiki

The VoIP and sipnab terms the rest of these pages use, one short definition each. Every definition says what the term means in sipnab's output. That sometimes differs from a textbook.

ACD

Average call duration. The mean talk time, in seconds, of the calls that were both answered and hung up inside the capture.

  • A call still up when the capture ended does not count.

ASR

Answer-seizure ratio. Of the INVITEs that reached a final response, the percentage answered with a 2xx.

  • An INVITE still ringing when the capture ended is not counted.
  • A REGISTER is never a call attempt.

B2BUA

Back-to-back user agent. A SIP element that ends a call on one side and starts a new call on the other.

  • Each side (a leg) carries its own Call-ID.
  • The TUI's extended flow (x or F4 in the call flow) draws the legs sipnab matched as one ladder.

BPF

Berkeley Packet Filter. The kernel filter, written in tcpdump syntax, that decides which packets reach sipnab during a live capture.

  • sipnab builds one from --portrange unless you pass your own.
  • The eBPF uprobe backend reads TLS without keys. It uses the same kernel machinery for a different job.

Call-ID

The SIP header that names one call. Every message in a dialog carries the same value. sipnab keys each dialog on it. So --call-report and the REST and MCP lookups all take a Call-ID.

Dialog

One SIP conversation: every message that shares a Call-ID. The call list shows one row per dialog. That includes registrations and other exchanges that are not calls.

HEP

Homer Encapsulation Protocol. A proxy such as Kamailio, OpenSIPS or Asterisk copies each SIP message into a HEP packet. It sends that packet to a collector.

  • sipnab can be that collector (-L) or a sender (-H).
  • It works over UDP, TCP or TLS.

Jitter

How much the spacing between RTP packets varies, in milliseconds. sipnab computes it with the interarrival algorithm of RFC 3550.

MCP

Model Context Protocol. The protocol an AI agent uses to call tools. With --mcp, sipnab offers its analysis as MCP tools. An agent then asks the capture questions instead of parsing text output. See MCP server.

MOS

Mean opinion score. An estimate of how the audio sounded, on a scale from 1.0 (bad) to 4.5 (excellent).

  • sipnab derives it from loss, jitter, delay and the codec with the ITU-T G.107 E-model.
  • sipnab gives an AMR-WB stream a second, wideband score on its own scale.
  • Some codecs have no published basis for the score. For those, sipnab reports a flagged placeholder. MOS and codecs lists which.

NER

Network effectiveness ratio (ITU-T E.411). Of the INVITEs that reached a final response, the percentage the network delivered to the far end. That is:

  • answered calls,
  • plus those the callee refused with 480, 486, 487, 600 or 603.

A low NER points at the network. A low ASR with a normal NER means the network reached the called phones. People then chose not to answer.

Orphan stream

An RTP stream sipnab could not match to any dialog's SDP. It has no Call-ID. Only SDP in an offer or an answer can match a stream. SDP in a 3xx to 6xx response matches none. SDP in an OPTIONS response, or in any method other than INVITE, ACK, PRACK and UPDATE, matches none. Common causes:

  • NAT rewriting the media address,
  • SIP that happened somewhere the capture did not see.

PDD

Post-dial delay. The time from the INVITE to the first 180 Ringing or 183 Session Progress. It is how long the caller waited before hearing anything.

R-factor

The E-model's transmission rating, from 0 to 100. sipnab computes the MOS from it.

  • sipnab reports its own R-factor beside the MOS.
  • sipnab separately shows the far end's R-factor when that endpoint sends it in RTCP XR.

RTP and RTCP

RTP (Real-time Transport Protocol) carries the audio or video. RTCP is its control channel: each end reports the loss and delay it sees. sipnab measures RTP itself. It reads RTCP as the far end's own account.

SBC

Session border controller. The SIP element at the edge of a network, between a carrier and a PBX for example. Most SBCs act as a B2BUA. So a call crossing one shows up as two dialogs.

SDP

Session Description Protocol. The body of an INVITE or its answer. It names the codecs and the address and port each side expects media on. sipnab reads it to match RTP streams to dialogs.

SIPREC, SRC and SRS

SIPREC (RFC 7866) is how a call gets recorded.

  • The session recording client (SRC) sends the call's media and a metadata document to a session recording server (SRS).
  • sipnab reads that metadata, meaning who was on the call and which stream belongs to whom.
  • sipnab is neither an SRC nor an SRS.

SSRC

Synchronization source. The 32-bit number in every RTP header that names one media stream. Two streams on the same address and port stay apart in sipnab's output. Their SSRCs differ.

TFPS

A toll-fraud prevention system. It is optional separate software. It decides which sources to ban and enforces that in the firewall.

  • sipnab can ask it what it decided (the tfps_* MCP tools and the /v1/tfps/ routes).
  • sipnab never decides a ban itself. It asks TFPS to ban only:
    • when an operator asks,
    • and only where --allow-action enables it.

TUI

Text user interface. The interactive full-screen view sipnab opens when you run it without -N.

vCon

A JSON container for one conversation: parties, dialog, and optionally the audio.

  • sipnab writes one observed dialog as a vCon with --export-vcon.
  • It writes it unsigned, and as an observer rather than a party.
  • See Export a call as a vCon.