VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor (2026)

Parse raw SIP INVITE/REGISTER packets and SDP media descriptors locally: detect Caller ID spoofing (`From` vs `P-Asserted-Identity`), missing STIR/SHAKEN `Identity` headers, plaintext RTP vs SRTP encryption gaps, and calculate SIP trunk bandwidth & MOS scores.

Facebook X (Twitter)WhatsApp LinkedIn

VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor — Interactive Console

Runs locally in your browser • Instant output

Module A: Paste SIP INVITE & SDP Payload

INVITE sip:1001@pbx.corp.example.com SIP/2.0
Via: SIP/2.0/UDP 198.51.100.77:5060;branch=z9hG4bK-748291
From: "CEO Office" <sip:1000@pbx.corp.example.com>;tag=99812
To: <sip:1001@pbx.corp.example.com>
Contact: <sip:scanner@198.51.100.77:5060>
P-Asserted-Identity: <sip:9999@external-attacker.ru>
User-Agent: friendly-scanner/sipvicious
Content-Type: application/sdp

v=0
o=- 102938 102938 IN IP4 198.51.100.77
c=IN IP4 198.51.100.77
m=audio 16400 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000

SIP / SDP Security Score0 / 100

Signaling Transport

Cleartext UDP 5060

RTP Media Encryption

Unencrypted RTP/AVP

Caller-ID Spoof Check

From != PAI Mismatch!

Scanner User-Agent

SIPVicious Detected!

Module B: VoIP Concurrent Call Bandwidth (Mbps) & L2/IP/UDP/RTP Overhead Calculator

Audio Codec

Concurrent Active Calls: 50

Packetization Interval (ptime)

Wire Rate Per Leg (incl. 58B headers)87.2 kbps

Bidirectional Trunk Bandwidth8.72 Mbps

Total Router Packet Rate (PPS)5,000 pps

Ready

Embed / Cite This Tool (Markdown & HTML)

GitHub / Reddit Markdown Badge

[![VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor](https://img.shields.io/badge/ZerosUniverse-Free_Tool-ff6a00)](https://www.zerosuniverse.com/tools/voip-sip-header-rtp-security-auditor/)

Blog / Documentation HTML Citation

<a href="https://www.zerosuniverse.com/tools/voip-sip-header-rtp-security-auditor/">VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor — ZerosUniverse</a>

2026 Quick-Reference Cheat Sheet & Benchmark Table: VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor

Quick Answer & 2026 Technical Summary (sip header analyzer voip bandwidth calculator)Updated 2026 Standard

At the standard 20 ms packetization interval (`ptime=20`), a VoIP endpoint sends 50 packets per second. Each packet carries 160 bytes of G.711 voice payload plus 12 bytes RTP + 8 bytes UDP + 20 bytes IPv4 + 18 bytes L2 Ethernet header = 58 bytes of protocol overhead per packet. Across 50 packets/sec, that overhead adds 23.2 kbps, bringing total wire bandwidth to 87.2 kbps per direction. Use this interactive sip header analyzer voip bandwidth calculator above to test sip invite sdp packet parser online, voip rtp bandwidth calculator g711 opus, and stir shaken sip identity header verifier locally in your browser with zero server uploads.

Target Keyword Spec: sip header analyzer voip bandwidth calculator  |  Modules: SIP Header & SDP Media Descriptor Forensics Parser • Caller ID Spoofing, STIR/SHAKEN & Toll-Fraud Vulnerability Scanner • Multi-Channel VoIP Codec Bandwidth & Packet Overhead Calculator

Primary Focus: sip header analyzer voip bandwidth calculator

Core Capability: sip invite sdp packet parser online

Privacy Mode: 100% Client-Side (Zero Upload)

Technical Parameter / Module	Standard / Keyword Spec	Architecture & Validation Rule	Operational Use Case (2026)
SIP Header & SDP Media Descriptor Forensics Parser	`sip invite sdp packet parser online`	Dissect Via hop chains, Contact URIs, Record-Route proxies, Max-Forwards, U...	Defending PBX Trunks Against VoIP Eavesdropping & Toll Fraud
Caller ID Spoofing, STIR/SHAKEN & Toll-Fraud Vulnerability Scanner	`voip rtp bandwidth calculator g711 opus`	Flag mismatched `From` / `P-Asserted-Identity` headers, missing RFC 8224 ST...	Investigating Spoofed Vishing Calls & STIR/SHAKEN Attestation Levels
Multi-Channel VoIP Codec Bandwidth & Packet Overhead Calculator	`stir shaken sip identity header verifier`	Compute exact Layer-2 Ethernet/VLAN and IP/UDP/RTP wire bandwidth (kbps/Mbp...	Enterprise Call Center WAN & SD-WAN Capacity Planning
Execution & Privacy Architecture	`100% Client-Side WebCrypto / JS Sandbox`	0 Bytes Sent to External Servers	Safe for internal SOC & authorized lab artifacts
NIST SP 800-53 / OWASP Alignment	`OWASP ASVS v4.0.3 / NIST CSF 2.0`	Deterministic Rule & Header Verification	Maps findings to actionable hardening controls
Cryptographic & Entropy Standard	`SHA-256 / AES-256-GCM / Argon2id`	≥ 128-bit Effective Security Margin	Meets 2026 post-quantum & zero-trust baselines

In-Depth ZerosUniverse Tutorial

What Are VoIP Attacks and Protocols Utilized by VoIP

Read our complete step-by-step editorial guide, architecture breakdown, and defensive best practices on ZerosUniverse.

Read Full Guide

How to Use VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor

Paste a Raw SIP INVITE / 200 OK Packet or Load a VoIP Attack Preset

Paste a SIP message with SDP body into the inspector—or load a preset (Insecure Plaintext Asterisk INVITE, Spoofed Vishing Call, Hardened TLS+SRTP+STIR/SHAKEN Call).

Audit SIP Signaling & SDP Media Security Findings

Review the security scorecard checking SIPS TLS transport, `RTP/SAVP` SRTP crypto suites, Digest Auth challenges, User-Agent enumeration leaks, and STIR/SHAKEN attestation.

Configure Codec, Packetization (ptime) & Concurrent Channels

Select G.711 (64 kbps), G.729 (8 kbps), G.722, or Opus, adjust packetization interval (20 ms default = 50 pps), and set your concurrent call count.

Inspect Wire Bandwidth (Mbps) & Live MOS Call Quality Score

View total WAN bandwidth including IP/UDP/RTP/Ethernet overhead alongside the ITU-T E-Model R-Factor and Mean Opinion Score (1.0–4.5) under simulated jitter and packet loss.

Key Capabilities & Technical Architecture

SIP Header & SDP Media Descriptor Forensics Parser

Dissect Via hop chains, Contact URIs, Record-Route proxies, Max-Forwards, User-Agent PBX fingerprints (Asterisk, FreeSWITCH, 3CX), and SDP `m=audio` / `a=crypto` attributes.

Caller ID Spoofing, STIR/SHAKEN & Toll-Fraud Vulnerability Scanner

Flag mismatched `From` / `P-Asserted-Identity` headers, missing RFC 8224 STIR/SHAKEN `Identity` PASSporT tokens, unauthenticated INVITE floods, and plaintext `RTP/AVP` media streams.

Multi-Channel VoIP Codec Bandwidth & Packet Overhead Calculator

Compute exact Layer-2 Ethernet/VLAN and IP/UDP/RTP wire bandwidth (kbps/Mbps) and packets-per-second (PPS) across G.711 (PCMU/PCMA), G.729, G.722, and Opus at 10ms/20ms/30ms ptime.

ITU-T E-Model R-Factor & MOS (Mean Opinion Score) Simulator

Simulate how network one-way latency (ms), packet jitter (ms), and UDP packet loss (%) degrade voice call quality from MOS 4.41 (Toll Quality) down to robotic dropouts.

Practical Use Cases

Defending PBX Trunks Against VoIP Eavesdropping & Toll Fraud

Verify that SIP trunks enforce TLS 1.3 signaling (SIPS on port 5061) and SDES/DTLS-SRTP media encryption (`RTP/SAVP`) so Wireshark captures cannot reconstruct audio via `rtpbreak`.

Investigating Spoofed Vishing Calls & STIR/SHAKEN Attestation Levels

Inspect SIP `Identity` headers and `verstat` parameters (`TN-Validation-Passed`) to distinguish Full Attestation (A) from Gateway/Partial Attestation (B/C).

Enterprise Call Center WAN & SD-WAN Capacity Planning

Calculate exact Mbps and router PPS load for 50 to 1,000 concurrent SIP trunk channels including Layer-2 Ethernet/802.1Q headers and VPN IPsec encapsulation overhead.

Frequently Asked Questions (FAQs)

Why does a 64 kbps G.711 VoIP call actually consume 87.2 kbps on the wire?+

How do attackers eavesdrop on unencrypted VoIP calls using Wireshark?+

When an SDP offer negotiates `m=audio ... RTP/AVP` instead of `RTP/SAVP` (SRTP), voice audio travels in plaintext UDP packets. Any attacker capable of ARP spoofing, VLAN hopping, or port mirroring on the voice subnet can capture the PCAP and click 'Telephony -> RTP -> RTP Streams -> Play Streams' in Wireshark to listen to both sides of the conversation.

What are STIR/SHAKEN Attestation Levels A, B, and C in SIP headers?+

STIR/SHAKEN uses an RFC 8224 SIP `Identity` header containing a cryptographically signed JSON Web Token (PASSporT). Level A (Full Attestation) means the originating carrier authenticated the caller and confirmed they are authorized to use that specific E.164 phone number. Level B (Partial) means the customer is known but the specific number is unverified. Level C (Gateway) means the call entered from an international or legacy TDM gateway with no origin verification.

What is the difference between SIP TLS signaling encryption and SRTP media encryption?+

SIP (Session Initiation Protocol) only handles call setup, ringing, and teardown (typically on port 5060 UDP/TCP or 5061 TLS). Encrypting SIP with TLS hides phone numbers and headers, but the actual voice audio flows over a separate pair of dynamic UDP ports using RTP. You must enable both SIP-over-TLS and SRTP (`RTP/SAVP` via SDES or DTLS) to protect both call metadata and voice audio.

What Mean Opinion Score (MOS) is required for clear business VoIP calls?+

MOS ranges from 1.0 (unintelligible) to 5.0 (theoretical perfection). Uncompressed G.711 peaks around 4.41 (R-Factor 93.2). A score above 4.0 is considered high toll quality; 3.6–4.0 is acceptable with minor artifacts; below 3.1 (typically caused by >150 ms one-way latency or >2% packet loss) causes severe syllables clipping and users talking over each other.