pfSense capture · Go backend · Kubernetes-native

Complete SIP visibility
for VoIP operators.
Every call. Every packet.

SIPLens Platform captures SIP+RTP traffic passively on pfSense, indexes every call, builds SVG ladder diagrams, and surfaces RTP metrics — searchable in seconds.

Deploy with Helm View on GitLab

Open source capture · Proprietary platform · MIT-licensed Helm chart

SIPLens Platform

Recent calls

2025 → 3842

28s · G.711

1001 → 5551234

4m 12s · G.722

3001 → 3002

1m 44s · Opus

Earlier

9001 → 9002

0s · no RTP

2025 → 3842

192.168.1.10:5060 → 10.0.0.42:5060 · 28s · G.711u

200 OK

192.168.1.10 10.0.0.42

INVITE

→

10:04:12.001

100

←

10:04:12.018

180

←

10:04:12.210

200

←

10:04:14.882

ACK

→

10:04:14.884

↕ RTP stream · 28.4s · 0.4% loss · 3.1ms jitter

BYE

←

10:04:42.901

What's included

Everything you need to understand SIP traffic

From passive capture on pfSense to searchable call records with full ladder diagrams — SIPLens handles the complete pipeline.

Passive SIP+RTP capture

SIPLens runs on pfSense and captures every SIP dialog and RTP stream without touching call paths or adding latency.

Full-text call search

Search across caller, callee, Call-ID, IP addresses, and SIP headers with sub-second response times. Filter by date, duration, codec, and more.

SVG ladder diagrams

Every call renders as an interactive SIP ladder diagram directly in the browser — no plugins, no downloads, full message detail on click.

RTP stream metrics

Packet loss, jitter, codec detection, and SSRC tracking for every RTP stream, correlated to the SIP call that signaled it.

pfSense package

Install SIPLens and configure capture settings, backend connection, and upload triggers directly from the pfSense GUI. No SSH required.

Kubernetes-native

Ships as a Helm chart with PostgreSQL + TimescaleDB included. Prometheus metrics and health probes built in. Two replicas by default.

How it works

From packet on the wire to searchable call record

Capture on pfSense

SIPLens runs as a daemon on your pfSense firewall, listening passively. It identifies SIP calls from the traffic stream and writes per-call pcap files — incoming, outgoing, IPv4, IPv6, UDP, TCP.

Zero impact on call quality or latency
SIP + correlated RTP streams in one pcap
IPv4, IPv6, GRE/VXLAN tunnel support
pfSense GUI package for easy configuration

pfSense shell

$ siplens-capture -i em0 -d /var/pcaps/%Y%m%d/%f-%t-%i.pcap

─────────────────────────────

10:04:12 NEW call-id=abc123 from=2025 to=3842

10:04:14 RTP 192.168.1.10:16420 ssrc=0x1a2b

10:04:42 BYE closing call-id=abc123

10:04:43 TRIGGER exec upload.sh 20250608/2025-3842-abc123.pcap

Upload to SIPLens Platform

When a call ends, a configurable trigger uploads the pcap to SIPLens Platform via REST API. Supports exec, shell, and mv triggers with %-template expansion for caller, callee, and call-id.

HTTPS with API key auth. Works over the public internet — no VPN to the pfSense box required.

upload trigger config

[trigger]

mode = exec

command = /usr/local/sbin/siplens-upload

[upload]

url = https://siplens.example.com/api/v1/calls

api_key = slk_...

→ 201 Created call_id=uuid-...

Search and visualize

SIPLens Platform indexes every call, parses SIP headers and SDP, correlates RTP streams, and serves a full SVG ladder diagram in the browser. Search by any field in under a second.

PostgreSQL + TimescaleDB with trigram search
SVG ladder diagram — no client-side plugins
RTP loss, jitter, codec per stream
pcap download for deeper analysis

Search API

GET /api/v1/calls?q=3842&from=2025-06-01

{

"calls": [

{

"id": "uuid-abc",

"from": "2025",

"to": "3842",

"duration_s": 28,

"rtp_loss_pct": 0.4

}

]

}

Deployment

Deploy in minutes with Helm

SIPLens Platform ships as a Helm chart. PostgreSQL + TimescaleDB included. Requires Kubernetes 1.24+ and an ingress controller.

terminal

# Add the SIPLens Helm repository
helm repo add siplens https://charts.ntconnect.com
helm repo update

# Install SIPLens Platform
helm install siplens siplens/sip-pcap-viewer \
  --set postgresql.auth.password=<your-db-password> \
  --set auth.jwtSecret=<your-jwt-secret> \
  --set ingress.host=siplens.example.com

Complete SIP visibilityfor VoIP operators. Every call. Every packet.