How to capture a SIP trace with Homer / sipcapture
Homer (sipcapture.org) is the open-source HEP-based SIP capture platform that ships with most modern PBX deployments. It stores every SIP message centrally, and you can export any call as a pcap-equivalent or HEP dump for offline analysis.
When to reach for this
- Your platform already feeds Kamailio/OpenSIPS/FreeSWITCH/Asterisk into Homer over HEP
- You want to grab a historical call trace you can't easily reproduce live
- You need the full multi-leg view (UAC ↔ SBC ↔ UAS) in one file
Before you start
- Access to a Homer 7.x web UI (HOMER Webapp) with read access to the relevant tenant
- The Call-ID, From-tag, or originating IP/timestamp of the call you want
Steps
- 1
Find the call in Homer Search
Open Homer → Search. Filter by date range and one strong identifier — Call-ID is best, then From-Number, then source IP. Hit Search and click the row representing the call.
- 2
Open the Flow / Ladder view
From the result row, click the dialog icon (or `Flow`). Homer stitches all legs that share the Call-ID or that it correlated via X-CID. Confirm you see every hop you expect (UAC, proxy, SBC, UAS) before exporting.
- 3
Export the call as PCAP
In the flow view, click `Export` (or the download icon, top- right) → `PCAP`. Homer rebuilds the SIP messages into a synthetic pcap that Wireshark, sngrep, and SIP Flow all read natively.
- 4
Or grab raw text via the API
For bulk export or scripting, the Homer API can return the raw messages as text. Useful when you want to feed many calls through SIP Flow programmatically.
curl -H "Auth-Token: $HOMER_TOKEN" \ "https://homer.example.com/api/v3/call/transaction" \ -d '{"param":{"search":{"1_call-id":"abc123@pbx"}}}' - 5
Sanity-check the export
Open the downloaded .pcap in Wireshark or sngrep first. If you're missing legs, widen the search window or correlate by From-tag instead of Call-ID — SBCs frequently rewrite Call-ID per leg.
Tips from people who've done this 1,000 times
- Homer stores correlation data in `correlation_id` — search on that to grab all legs of a B2BUA call in one shot
- The PCAP export is synthetic (timestamps come from HEP capture time) — close enough for ladder analysis, not for jitter math
- Use `Advanced Search` to filter by SIP method (`INVITE`, `BYE`) when looking for setup vs teardown problems
Pitfalls
- HEP captures only what your agents send — if your SBC isn't HEP-instrumented, you won't see its rewrites
- Long retention windows + busy tenants can make Homer searches slow; narrow by time first, then by identifier
- Downloaded PCAPs do not contain RTP — use the carrier-side pcap for one-way-audio investigation
Got the trace? Render the ladder.
Drop your Homer / sipcapture export into SIP Flow and we'll render the call flow, surface RFC issues, and (optionally) ask Gemini to explain what went wrong — all client-side by default.
Open analyzer