At some point I needed a fast way to get SIP traffic monitoring into Prometheus — without installing agents on servers, configuring SPAN ports on switches, or being locked into specific software. Just connect to a network interface and see everything happening. With minimal latency and zero impact on telephony performance — monitoring shouldn't become the source of problems.
In this article — how I solved SIP telephony monitoring with eBPF: from packet capture in the Linux kernel to RFC 6076 metrics with breakdown by traffic source and device type in Prometheus/VictoriaMetrics.
eBPF (extended Berkeley Packet Filter) allows running small programs directly in the Linux kernel. The eBPF verifier guarantees safety: the program cannot exceed allocated memory, cannot loop indefinitely, cannot modify the kernel.
My approach — eBPF socket filter on AF_PACKET. This is passive network traffic observation:
SIP Traffic → NIC → eBPF filter → AF_PACKET socket → Go → SIP Parser → Prometheus Metrics