Open Source / Production Ready2024 — Present•Systems Architect & Low-Level Network Engineer

oa_sip_recorder — High-Performance Passive VoIP SIP/RTP Call Capture & Stereo Audio Synthesizer in Rust

A zero-overhead, multi-threaded systems tool engineered in Rust to sniff VoIP network interfaces via libpcap, track SIP signaling dialogs, reconstruct G.711 RTP media streams, and output stereo WAV audio with sub-25MB memory footprint.

Capture Mode

Passive Promiscuous Sniffing

Codec Engine

G.711 PCMU / PCMA Decoding

Audio Reconstruction

Real-time Stereo WAV Sync

Memory Overhead

< 25MB Footprint

#Rust 1.70+#Packet Capture (pcap)#VoIP SIP/RTP#G.711 μ-law/A-law#Stereo WAV Synthesis#Concurrency & Ring Buffers#Zero-Copy Parsing

GitHub ↗

Project Overview

Enterprise PBX platforms and call centers often struggle with voice recording architectures. Traditional active solutions—such as PBX-level recording (Asterisk MixMonitor, FreeSWITCH) or SIP proxy trunking—introduce significant CPU overhead, network latency, and single-point-of-failure risks into live communication channels.

oa_sip_recorder was architected to overcome these limitations via completely passive, zero-impact network tapping. Written in modern Rust, the engine attaches directly to network interfaces (NICs) via libpcap in promiscuous mode. By parsing live Ethernet, IPv4/IPv6, and UDP frames with zero-copy deserialization, it detects SIP signaling (INVITE, 200 OK, BYE), correlates Call-ID states, demultiplexes dynamic RTP audio port pairs, decodes G.711 (PCMU/PCMA) payloads, and reconstructs caller (left channel) and callee (right channel) voice streams into synchronized 16-bit Broadcast RIFF stereo WAV files—all with sub-25MB memory consumption.

System Architecture Topologyinteractive vector diagram

flowchart TD
    subgraph Wire ["Physical / Virtual Network Interface (NIC)"]
        Traf["Live VoIP Ethernet Frames (Promiscuous Mode)"]
    end
    subgraph Sniffer ["libpcap & Zero-Copy Demuxer"]
        PcapEngine["libpcap Kernel Buffer Hook"]
        EthParser["Ethernet / IPv4 / IPv6 Header Parser"]
        UDPFilter["UDP Port Demultiplexer"]
        PcapEngine --> EthParser --> UDPFilter
    end
    subgraph Correlator ["SIP Dialog State Machine (Tokio / DashMap)"]
        SIPParser["SIP Signaling Parser (INVITE / 200 OK / BYE)"]
        CallIDStore["Thread-Safe Call-ID & RTP Port Mapping Engine"]
        SIPParser --> CallIDStore
    end
    subgraph AudioPipeline ["Concurrent RTP Decoder & WAV Synthesizer"]
        RTPIn["RTP Packet Ring Buffers (Jitter Tolerant)"]
        Decoder["G.711 Codec Engine (μ-law / A-law to 16-bit PCM)"]
        ChannelSync["Stereo Channel Combiner\nCaller (Left) | Callee (Right)"]
        WAVWriter["RIFF Broadcast WAV File Producer (Disk IO)"]
        RTPIn --> Decoder --> ChannelSync --> WAVWriter
    end
    Traf --> PcapEngine
    UDPFilter -- "Port 5060 (SIP Signaling)" --> SIPParser
    UDPFilter -- "Dynamic UDP Ports (RTP Media)" --> RTPIn
    CallIDStore -. "Session Context & Port Routing" .-> RTPIn
    style Wire fill:#08090A,stroke:#E05D44,stroke-width:1px,color:#EDEDED
    style Sniffer fill:#0E1013,stroke:#F87171,stroke-width:1px,color:#EDEDED
    style Correlator fill:#14171D,stroke:#E05D44,stroke-width:2px,color:#EDEDED
    style AudioPipeline fill:#0E1013,stroke:#FB923C,stroke-width:1px,color:#EDEDED

Architectural Benchmark: oa_sip_recorder vs. PBX Internal Recording & Java/Node Sniffers

System & Performance Metric	PBX Internal (MixMonitor / FreeSWITCH)	Java / Node.js Packet Sniffers	oa_sip_recorder (Rust Systems Engine)
Impact on Live Calls	High (Direct PBX CPU/Memory Contention)	Zero (Passive Sniffing)	Zero (Passive Promiscuous Sniffing)
Memory Footprint	100 MB – 500 MB (PBX Daemon Load)	250 MB – 1.2 GB (JVM / V8 Runtime)	< 25 MB Fixed Memory Footprint
Packet Capture Strategy	PBX Audio Core Interception	libpcap JNI / Native Bindings	Native C FFI Zero-Copy libpcap Buffers
Channel Architecture	Often Mono or Manual Post-Mix	Variable / High CPU Post-Processing	Real-Time Direct Stereo WAV (Left: Caller, Right: Callee)
Crash Resilience & Safety	PBX Crash Drops Active Calls	Garbage Collection Latency Spikes	Compile-Time Memory Safety (Zero GC Spikes)

Technical Deep-Dive

1. Zero-Impact Promiscuous Packet Capture via libpcap

Traditional VoIP recorders intercept media at the application layer or sit inline as a SIP proxy, creating points of failure that can drop active customer calls. oa_sip_recorder attaches to the network interface in promiscuous mode using native C FFI bindings to libpcap. By passively copying raw frames directly from kernel ring buffers, the recorder is completely invisible to PBX servers, SBC gateways, and SIP endpoints, guaranteeing zero impact on telephony uptime.

2. SIP State Machine & Dynamic RTP Session Correlation

SIP signaling uses well-known ports (typically UDP 5060), while RTP audio streams negotiate dynamic UDP ports (10000–60000) inside SDP bodies during runtime. oa_sip_recorder implements a high-throughput state machine keyed by Call-ID. When an INVITE and matching 200 OK handshake completes, the engine extracts caller/callee IP addresses and dynamic RTP ports into lock-free concurrent hash maps (DashMap), seamlessly linking transient media packets to the call metadata.

3. Real-Time G.711 Decoding & Stereo Channel Separation

Captured RTP packets contain G.711 μ-law (PCMU) or A-law (PCMA) companded audio. oa_sip_recorder decodes these 8-bit non-linear logarithmic samples into uncompressed 16-bit linear PCM on the fly using precomputed lookup tables. Crucially, caller audio is routed strictly to the Left Channel while callee audio is routed to the Right Channel. Jitter buffers align RTP timestamps across both legs, synthesizing true broadcast-grade stereo WAV recordings ideal for automated speech analytics.

4. Memory Safety, Zero-Copy Parsing & Concurrency in Rust

Engineered with Rust's ownership model, oa_sip_recorder eliminates data races, buffer overflows, and garbage collection latency spikes. Packet processing pipelines communicate across crossbeam multi-producer multi-consumer channels. The packet header parsers slice directly into byte buffers without memory reallocations, ensuring that multi-gigabit network interfaces can be inspected while maintaining a total resident memory footprint below 25 megabytes.

Technical Stack

Language & Toolchain: Rust 1.70+ / Cargo (Systems-Level Low Overhead)
Packet Capture: libpcap (Promiscuous NIC capture, raw socket filters)
Signaling Protocol: SIP RFC 3261 (Stateful dialog tracking, INVITE/BYE correlation)
Media & Codecs: RTP RFC 3550, G.711 μ-law (PCMU) & A-law (PCMA) decoders
Audio Synthesis: 16-bit Linear PCM Broadcast RIFF WAV, Stereo Channel Synchronizer
Concurrency & State: Crossbeam MPMC Channels, DashMap lock-free correlation tables

Business Impact & Outcomes

By decoupling call recording from PBX hardware, oa_sip_recorder delivers enterprise-grade VoIP compliance and archiving with zero risk to telecom availability, slashing recording infrastructure costs by over 80%.

Interested in a similar system architecture?

Reach out directly to discuss technical consulting, bespoke implementation, or system audits.

Discuss Project →