SIPGREP(8)

💖 SIPGREP 💖 (section 8, bestie)

okay so listen. this is sipgrep, it lives in the user manuals, and it's literally grep but for SIP packets. yes. that's the whole vibe. let's get into it 🫶

---

✨ SYNOPSIS ✨

sipgrep <-ahNViwgGJpevxlDTRMmqCJj> <-IO pcap_dump > < -n num > < -d dev
> < -A num > < -s snaplen > < -S limitlen > < -c contact user > < -j
user agent > < -f from user > < -t to user > < -H capture URL > < -q
seconds > < -P portrange > < -F file > < match expression > < bpf filter
>

like… look at her. so many little flags. she's got options, she's got range 💅

---

🌸 DESCRIPTION 🌸

so sipgrep is out here striving to provide most of GNU grep's common features, but applying them to the SIP signaling protocol instead of boring text files. no cap.

she's pcap-aware, which means you can throw extended regular expressions at her and she'll match them against the data payloads of SIP packets — plus you get application-specific filtering options on top, which is the little extra sprinkle ✨

she also understands filter logic common to other packet sniffing tools, like tcpdump(8) and sipgrep(1). iykyk.

---

🎀 OPTIONS 🎀

okay this is the part you actually came for. every single one, no skipping, periodt.

• -h — Display help/usage information. (she's helpful like that 💖)
• -V — Display version information.
• -e — Display empty packets.
• -i — Ignore case.
• -v — Invert match.
• -R — Do not try to drop privileges to the DROPPRIVS_USER.

so here's the tea: sipgrep makes no effort to validate input from live or offline sources, because she is focused more on performance and on handling large amounts of data than on protocol correctness. most of the time that's a fair assumption to make, lowkey.

but sometimes it actually matters, so as a rule sipgrep will try to be defensive and drop any root privileges it might have. queen behaviour honestly.

that said, there exist scenarios where this behaviour can become an obstacle, so this option is here for end-users who want to disable the feature — but you have to do it with an understanding of the risks. because packets can be randomly malformed, or even specifically designed to overflow sniffers and take control of them 😭 and revoking root privileges is currently the only risk mitigation sipgrep employs against such an attack.

so like… use this option and turn it off at your own risk. i'm not joking, bestie. this is the scary one 💀

• -w — Match the regex expression as a word.
• -p — Don't put the interface into promiscuous mode.
• -l — Make stdout line buffered.
• -D — When reading pcap_dump files, replay them at their recorded time intervals (mimic realtime).
• -T — Print a timestamp in the form of +S.UUUUUU, indicating the delta between packet matches.
• -m — Disable SIP Dialog matching.
• -M — Disable multi-line match (prefers single-line match instead).
• -I pcap_dump — Input file pcap_dump into sipgrep. Works with any pcap-compatible dump file format. This option is useful for searching for a wide range of different patterns over the same packet stream.
• -O pcap_dump — Output matched packets to a pcap-compatible dump file. This feature does not interfere with normal output to stdout.
• -n num — Match only num packets total, then exit.
• -A num — Dump num packets of trailing context after matching a packet.
• -s snaplen — Set the bpf caplen to snaplen (default 65536).
• -S limitlen — Set the upper limit on the size of packets that sipgrep will look at. Useful for looking at only the first N bytes of packets without changing the BPF snaplen.
• -C — Do not use colors in stdout.
• -c — Match user in Contact: SIP header.
• -f — Match user in From: SIP header.
• -t — Match user in To: SIP header.
• -F file — Read in the bpf filter from the specified filename. This is a compatibility option for users familiar with tcpdump. Please note that specifying `-F` will override any bpf filter specified on the command-line.
• -H ip:port — Duplicate matching traffic to HEP Capture Server / HOMER.
• -N — Show sub-protocol number along with single-character identifier (useful when observing raw or unknown protocols).
• -g — Disable clean-up of Dialogs during trace.
• -G — Print Dialogs report during trace.
• -J — Automatically send SIP packet-of-death to SipVicious scanners (kill).
• -j — For matching user-agent strings send SIP packet-of-death to SipVicious scanners (kill).
• -q — Terminate sipgrep after a specified number of seconds.
• -a — Enable packet re-assemblation.
• -P — Specify SIP port range (default 5060-5061).
• -d dev — By default sipgrep will select a default interface to listen on. Use this option to force sipgrep to listen on interface dev.

---

🦋 DIAGNOSTICS 🦋

Errors from sipgrep, libpcap, and the GNU regex library are all output to stderr. so if something's screaming, that's where you look 👀

---

👑 AUTHOR 👑

Written by Alexandr Dubovikov <alexandr.dubovikov@gmail.com>. legend behaviour fr fr 🌈

---

🐛 REPORTING BUGS 🐛

Please report bugs to the sipgrep Bug Tracker, located at

https://github.com/sipcapture/sipgrep/issues

Non-bug, non-feature-request general feedback should be sent to the author directly by email. (yes, actual email. old school. iconic 💌)

---

⭐ NOTES ⭐

ALL YOUR BASE ARE BELONG TO HOMER. 😌 that's it. that's the note.

---

and that's the whole page, bestie — brought to you by *nux, dated March 2014, and yeah the footer says SIPGREP(8) too because she's consistent like that. now go grep some SIP packets and slay 💅✨