VoIP SIP Header Inspector, RTP Bandwidth & SRTP Security Auditor (2026)

At the standard 20 ms packetization interval (`ptime=20`), a VoIP endpoint sends 50 packets per second. Each packet carries 160 bytes of G.711 voice payload plus 12 bytes RTP + 8 bytes UDP + 20 bytes IPv4 + 18 bytes L2 Ethernet header = 58 bytes of protocol overhead per packet. Across 50 packets/sec, that overhead adds 23.2 kbps, bringing total wire bandwidth to 87.2 kbps per direction.

When an SDP offer negotiates `m=audio ... RTP/AVP` instead of `RTP/SAVP` (SRTP), voice audio travels in plaintext UDP packets. Any attacker capable of ARP spoofing, VLAN hopping, or port mirroring on the voice subnet can capture the PCAP and click 'Telephony -> RTP -> RTP Streams -> Play Streams' in Wireshark to listen to both sides of the conversation.

STIR/SHAKEN uses an RFC 8224 SIP `Identity` header containing a cryptographically signed JSON Web Token (PASSporT). Level A (Full Attestation) means the originating carrier authenticated the caller and confirmed they are authorized to use that specific E.164 phone number. Level B (Partial) means the customer is known but the specific number is unverified. Level C (Gateway) means the call entered from an international or legacy TDM gateway with no origin verification.

SIP (Session Initiation Protocol) only handles call setup, ringing, and teardown (typically on port 5060 UDP/TCP or 5061 TLS). Encrypting SIP with TLS hides phone numbers and headers, but the actual voice audio flows over a separate pair of dynamic UDP ports using RTP. You must enable both SIP-over-TLS and SRTP (`RTP/SAVP` via SDES or DTLS) to protect both call metadata and voice audio.

MOS ranges from 1.0 (unintelligible) to 5.0 (theoretical perfection). Uncompressed G.711 peaks around 4.41 (R-Factor 93.2). A score above 4.0 is considered high toll quality; 3.6–4.0 is acceptable with minor artifacts; below 3.1 (typically caused by >150 ms one-way latency or >2% packet loss) causes severe syllables clipping and users talking over each other.