Keybindings

Quick start: j/k for vim-style up/down, Enter to drill into a call, Esc to go back, Tab to switch between Call List and RTP Streams.

Complete keyboard shortcut reference for sipnab’s interactive TUI.

Keys marked with (configurable) can be remapped via the [keybindings] config section. See Config Reference for details. All other keys are hardcoded.

TUI Views

Call List View

The call list is the main view when sipnab starts. It shows all tracked SIP dialogs with their state, timing, and quality metrics.

sipnab -- Call List

 Current Mode: Online (eth0)   Dialogs: 47 (47 displayed)  [A]
 Match Expression:             BPF Filter: port 5060
 Time: Delta-prev
  #  Method     From           To             Src IP         Dst IP         State        Msgs  Date        PDD
▸ 1  INVITE     alice          bob            10.0.0.1       10.0.0.2       InCall         12  +0.000s     847ms
  2  INVITE     charlie        dave           10.0.0.3       10.0.0.4       Ringing         6  +1.234s     --
  3  REGISTER   admin          --             10.0.0.5       10.0.0.1       Registered      4  +0.012s     --
  4  INVITE     +15551234      +15559876      10.0.0.6       10.0.0.7       Failed          8  +3.456s     --
  5  INVITE     1005           1006           10.0.0.1       10.0.0.2       Completed      14  +0.003s     923ms
  6  OPTIONS    monitor        --             10.0.0.8       10.0.0.1       Completed       2  +0.001s     --
  7  INVITE     1010           +441234567     10.0.0.9       10.0.0.7       InCall         10  +0.215s     1.2s
  Esc Quit  Enter Show  F2 Save  F7 Filter  F8 Settings  F10 Columns  Tab Streams

Tip: Press Space to multi-select dialogs (shown with ▸). Press F2 to save only the selected dialogs. Use < / > to sort by different columns and Z to reverse sort direction.

Call Flow View

The call flow shows a ladder diagram for a selected dialog, with timing, SDP, and RTP quality indicators.

sipnab -- Call Flow

      10.0.0.1:5060          10.0.0.40:5060         10.0.0.2:5060
      (alice UAC)             (OpenSIPS proxy)       (bob UAS)
          │                        │                        │
 +0.000s  │------- INVITE -------->│                        │
 +0.003s  │<-------- 100 ----------│                        │
 +0.005s  │                        │------- INVITE -------->│
 +0.008s  │                        │<------- 100 ---------│
 +0.847s  │                        │<------- 180 ---------│  +839ms
 +0.850s  │<------- 180 ---------│                        │
 +2.134s  │                        │<------- 200 ---------│  +1.28s
 +2.137s  │<------- 200 ---------│                        │
 +2.140s  │--------- ACK --------->│                        │
 +2.143s  │                        │--------- ACK --------->│
          │    ██████████ RTP (PCMU, MOS 4.2)          │
          │    ██████████ RTP (PCMU, MOS 4.1)          │
+65.320s  │                        │<------- BYE ---------│
+65.323s  │<------- BYE ---------│                        │
+65.326s  │-------- 200 OK ------->│                        │
          │                        │                        │
  Esc Back  Enter Raw  Space Diff  d SDP  t Time  m Mark  x Extended  F6 RTP

Tip: Press m to set a mark at any message, then navigate to another message to see the delta badge showing elapsed time between them. Press M to clear the mark. Use d to cycle through SDP display modes (none / summary / full).

Raw Message View

Full SIP message with optional syntax highlighting, searchable.

sipnab -- Raw Message

INVITE sip:bob@10.0.0.2:5060 SIP/2.0
Via: SIP/2.0/UDP 10.0.0.1:5060;branch=z9hG4bK-524287-1
Max-Forwards: 70
From: "alice" <sip:alice@10.0.0.1>;tag=as6e4f2c8b
To: <sip:bob@10.0.0.2>
Contact: <sip:alice@10.0.0.1:5060>
Call-ID: 3c9a82f1e7b4@10.0.0.1
CSeq: 102 INVITE
User-Agent: Olle/1.0
Content-Type: application/sdp
Content-Length: 263
v=0
o=alice 2890844526 2890844526 IN IP4 10.0.0.1
s=-
c=IN IP4 10.0.0.1
t=0 0
m=audio 10000 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
  Esc Back  / Search  s Highlight  c Color

RTP Streams View

Shows all tracked RTP streams with quality metrics. Switch here from the Call List with Tab.

sipnab -- RTP Streams

 RTP Streams: 14 tracked                                                         
  #  SSRC        Src IP:Port          Dst IP:Port          Codec   Pkts    Jitter  Loss%   MOS
▸ 1  0x1a2b3c4d  10.0.0.1:10000       10.0.0.2:20000       PCMU    4820    2.1ms   0.0%    4.2
  2  0x5e6f7a8b  10.0.0.2:20000       10.0.0.1:10000       PCMU    4815    1.8ms   0.0%    4.3
  3  0x9c0d1e2f  10.0.0.6:12000       10.0.0.7:22000       PCMA    1205    18.3ms  1.2%    3.4
  4  0xa1b2c3d4  10.0.0.7:22000       10.0.0.6:12000       PCMA    1198    45.7ms  3.8%    2.1
  5  0xe5f60718  10.0.0.9:14000       10.0.0.7:24000       opus    9612    3.2ms   0.1%    4.1
  6  0x29304150  10.0.0.7:24000       10.0.0.9:14000       opus    9608    2.9ms   0.0%    4.2
  7  0xdeadbeef  10.0.0.3:16000       --                   PCMU    340     --      --      orphan
  Tab Call List  Esc Back  F7 Filter

Tip: Streams marked orphan have no matching SIP dialog. This often indicates RTP arriving on unexpected ports (check your NAT/ALG config) or calls that started before capture began.

Filter Dialog (F7)

The filter popup lets you build filter expressions with text fields and checkboxes for common options.

sipnab -- Filter Dialog

 ┌──────────────────── Filter ────────────────────┐
 │                                                │
 │  From:     [alice                       ]      │
 │  To:       [                            ]      │
 │  Filter:   [method == 'INVITE'          ]      │
 │                                                │
 │  [x] Case insensitive                          │
 │  [ ] Invert match                              │
 │  [ ] Calls only                                │
 │                                                │
 │     [ Apply ]          [ Cancel ]              │
 │                                                │
 └────────────────────────────────────────────────┘
 Tab: next field  Enter: apply  Esc: cancel  F9: clear all

Tip: The Filter field accepts the full Filter DSL syntax. Combine it with the From/To text fields for powerful multi-criteria matching. Press F9 to clear all filters at once.

Save Dialog (F2)

Save captured data in multiple formats. Use Tab to cycle through formats.

sipnab -- Save Capture

 ┌─────────────────── Save Capture ──────────────────┐
 │                                                  │
 │  Format:  PCAP │ PCAP-NG │ TXT │ Mermaid     │
 │                                                  │
 │  File:    [/tmp/capture.pcap           ]         │
 │                                                  │
 │  Saving: All 47 dialogs                          │
 │  (3 selected -- will save selected only)         │
 │                                                  │
 │     [ Save ]           [ Cancel ]                │
 │                                                  │
 └──────────────────────────────────────────────────┘
 Tab: cycle format  Enter: save  Esc: cancel

Tip: Select specific dialogs in the Call List with Space before pressing F2. The save dialog will show how many are selected and save only those. Mermaid format exports a sequence diagram you can paste into documentation.

Settings Dialog (F8)

Toggle display options without leaving the TUI.

sipnab -- Settings

 ┌──────────────────── Settings ───────────────────┐
 │                                                │
 │  ▸ Color mode         always                   │
 │    Timestamp mode     delta-prev               │
 │    Autoscroll         on                       │
 │    Raw preview         off                     │
 │    SDP display         summary                 │
 │    Syntax highlighting on                      │
 │                                                │
 └────────────────────────────────────────────────┘
 Up/Down: navigate  Enter/Space: toggle  Esc: close

Global

Key	Action
Ctrl+C	Force quit
Ctrl+L	Clear all calls (same as F5)

Call List

Key	Action
Up / k	Navigate up
Down / j	Navigate down
PgUp	Page up
PgDn	Page down
Home	Jump to first dialog
End	Jump to last dialog
Enter	Open call flow for selected dialog
Space	Select/deselect dialog (for multi-select save)
Esc / q	Quit (configurable: `quit`)
<	Sort by previous column
>	Sort by next column
Z	Reverse sort direction
A	Toggle autoscroll (configurable: `autoscroll`)
p	Pause/resume capture (configurable: `pause`)
/	Activate search (configurable: `search`)
i	Clear non-matching dialogs
I	Clear matching dialogs
t	Cycle timestamp mode (absolute / delta-prev / delta-first)
r / F6	Show raw SIP message for selected dialog
s	Switch to Statistics view
O	Open pcap file (File Open dialog)
Tab	Switch to RTP Streams view
F1	Help (configurable: `help`)
F2	Save capture (configurable: `save`)
F3	Search (same as `/`). Searches SIP headers and message bodies (SDP, multipart payloads)
F5	Clear all calls (configurable: `clear_calls`)
F7	Open filter dialog (configurable: `filter`)
F9	Clear active filter
F10	Column selector (configurable: `column_selector`). Opens a popup to show/hide columns in the Call List (e.g., PDD, Source IP, Destination).

Call Flow

Key	Action
Up / k	Navigate to previous message or RTP bar (detail panel updates)
Down / j	Navigate to next message or RTP bar
PgUp	Page up through messages
PgDn	Page down through messages
Home	Jump to first message
End	Jump to last message
Enter	Open full-screen raw message view. When an RTP bar is selected, opens the Stream Detail view with MOS, jitter, quality intervals, burst/gap analysis, silence detection, and sparklines
Space	Select message for diff (press on two messages to compare)
Esc	Back to call list
d	Cycle SDP display mode (none / summary / full)
t	Cycle timestamp mode (absolute / delta-prev / delta-first)
c	Cycle color scheme (method / call-id / cseq)
R	Toggle detail panel visibility
0 / + / = / Right	Increase ladder panel width
9 / - / Left	Decrease ladder panel width
[	Scroll detail panel up
]	Scroll detail panel down
e	Toggle fold/expand for selected message
m	Set mark at current message. Places a reference marker on the current message. Navigate to another message to see the delta time between the mark and your current position – useful for measuring delays between specific SIP messages.
M	Clear mark
E	Export Mermaid sequence diagram to clipboard
x / F4	Toggle extended multi-leg flow (configurable: `extended_flow`). Shows related B2BUA/SBC call legs together in the flow view – useful for tracing calls through proxies and back-to-back user agents.
F1	Help (configurable: `help`)
F2	Save (configurable: `save`)
F5	Start compare mode (configurable: `clear_calls`)
r	Jump to RTP Streams list for this dialog
F6	Toggle RTP display in flow
F7	Open filter dialog (configurable: `filter`)
F9	Clear active filter

Raw Message

Key	Action
Up / k	Scroll up
Down / j	Scroll down
PgUp	Page up
PgDn	Page down
Home	Scroll to top
/	Search within message
s	Toggle syntax highlighting
c	Cycle color scheme
Esc	Back to call flow

Message Diff

Key	Action
q	Quit
Esc	Back to call flow
F1	Help

RTP Streams

Key	Action
Up / k	Navigate up
Down / j	Navigate down
Home	Jump to first stream
End	Jump to last stream
Enter	Open Stream Detail view for the selected stream
Tab	Switch to Call List
Esc	Back to Call List
F1	Help (configurable: `help`)
F7	Open filter dialog (configurable: `filter`)

Stream Detail

Key	Action
Up / k	Scroll up
Down / j	Scroll down
PgUp	Page up
PgDn	Page down
Esc	Back to RTP Streams list or Call Flow

The Stream Detail view shows comprehensive per-stream quality data: MOS score, jitter statistics, quality intervals, burst/gap analysis (RFC 3611), silence detection, and sparkline graphs for MOS and jitter trends over the stream’s lifetime.

Statistics

Key	Action
Esc / q / s	Back to Call List

Help

Key	Action
Esc / F1 / q	Close help

Key	Action
Esc	Cancel and close
Enter	Save to the specified path
Tab	Cycle format forward (PCAP -> PCAP-NG -> TXT -> Mermaid)
Shift+Tab	Cycle format backward
Left / Right	Move cursor in filename
Home / End	Jump to start/end of filename
Backspace	Delete character before cursor
(any char)	Insert character

Save formats: PCAP, PCAP-NG, TXT, Mermaid

Key	Action
Esc	Cancel without applying
Enter	Apply filter (or cancel if Cancel button focused)
Tab	Focus next field
Shift+Tab / BackTab	Focus previous field
Down	Next field (or checkbox down)
Up	Previous field (or checkbox up)
Left / Right	Move within checkboxes or text cursor
Space	Toggle checkbox / activate button
F9	Clear all fields and active filter, close popup
Backspace / Delete	Text editing in focused text field
Home / End	Jump to start/end of text field
(any char)	Insert character in focused text field

Key	Action
Esc	Close settings
Up / k	Previous setting
Down / j	Next setting
Enter / Space	Toggle or cycle the focused setting

Settings items: Color mode, Timestamp mode, Autoscroll, Raw preview, SDP display mode, Syntax highlighting

Key	Action
Esc	Cancel and close
Enter	Open the specified pcap file
Left / Right	Move cursor
Home / End	Jump to start/end of path
Backspace	Delete character before cursor
(any char)	Insert character

Column Selector

Key	Action
Up / k	Move selection up
Down / j	Move selection down
Space	Toggle column visibility
Enter / Esc	Close selector

Timestamp Modes

Press t in the Call List or Call Flow to cycle through three timestamp modes (the mode is shared across both views):

Absolute (default) – HH:MM:SS.mmm wall-clock time
Delta-prev – +N.NNNs time since previous entry. Color-coded in call flow:
- Green: < 100 ms
- Yellow: 100 ms - 1 s
- Red: 1 s - 5 s
- Bold red: > 5 s
Delta-first – +N.NNNs cumulative time from first entry

Timestamp Modes Comparison

Absolute:           Delta-prev:          Delta-first:
14:23:01.000  INVITE  +0.000s  INVITE      +0.000s  INVITE
14:23:01.003  100     +0.003s  100         +0.003s  100
14:23:01.847  180     +0.844s  180         +0.847s  180
14:23:03.134  200     +1.287s  200         +2.134s  200
14:23:03.137  ACK     +0.003s  ACK         +2.137s  ACK
14:24:08.320  BYE     +65.18s  BYE         +67.32s  BYE

Tip: Delta-prev mode is ideal for spotting latency spikes in call setup. Delta-first mode is useful for measuring total elapsed time from the first message.