What you get
For every call: who called whom, how long until ringing and answer, how long the conversation lasted, who hung up and why (SIP code and Q.850 cause). The SIP ladder diagram shows every request and response, with retransmissions marked. For the audio: loss, jitter, packet spacing, DTMF and an estimated MOS with a chart over time. When something is wrong, such as a missing ACK, one-way audio, a private IP in SDP or heavy loss, the analyzer explains the likely cause and what to fix.
How to capture a call
Linux or a Linux PBX (Asterisk, FreeSWITCH, Kamailio): record SIP and RTP, make a test call, then stop with Ctrl+C.
tcpdump -i any -s 0 -w call.pcap port 5060 or portrange 10000-20000MikroTik: the sniffer saves a pcap on the router; download it from Files afterwards.
/tool sniffer set file-name=call.pcap filter-ip-protocol=udp file-limit=50000KiB
/tool sniffer start
# make the call
/tool sniffer stopWindows and macOS: Wireshark → Capture, then File → Save As pcapng. sngrep can also write a file with -O.
sngrep -O call.pcapLimits
SIP over TLS (port 5061) is encrypted and cannot be read. With SRTP the audio is encrypted, but loss and jitter still show in the headers. MOS is an E-model estimate, not a listening test. If the capture was taken on one side of NAT, SDP addresses and real packet addresses may differ; that is expected and the analyzer matches them up.
Need to ping or trace your PBX from other countries? Use the ping and traceroute tool.
Reference: SIP response codes, Q.850 release causes.