Sip-exporter: eBPF-Based SIP/RTP Monitoring for Prometheus

Sip-exporter is a new open-source tool that captures SIP and RTP telephony traffic directly in the Linux kernel using eBPF, then exports call-quality and traffic metrics to Prometheus-compatible backends. By filtering packets at L4 via AF_PACKET sockets instead of relying on iptables or tcpdump-style userspace daemons, it avoids the overhead typically associated with packet capture, enabling voice-quality analysis without ever capturing audio payloads.

The project reports zero packet loss at up to 2,000 calls per second (~28,000 packets/sec) with under 15% CPU and roughly 15 MB of RAM, while keeping garbage-collection pauses under 1 millisecond so packets aren't dropped due to GC. It ships as a single privileged Docker container running in host network mode with no external dependencies.

Beyond standard SIP counters and RFC 6076 performance metrics (ASR, NER, PDD, and others), the exporter adds RTP-based MOS/jitter/packet-loss scoring, RTCP SR/RR correlation, carrier and device-type labeling via CIDR/User-Agent config, GeoIP-based source/destination country tags, and built-in fraud detection for registration scanning, INVITE bursts, account takeover, and False Answer Supervision. For telecom and VoIP engineers, it offers a lightweight, kernel-level alternative to heavier SIP monitoring stacks like VoIPMonitor or Homer that plugs directly into existing Prometheus/VictoriaMetrics observability pipelines.