Blog

From VoIPmonitor.org

VoIPmonitor Development Blog

This page contains announcements about new features and improvements in VoIPmonitor sniffer and GUI.

February 2026: PII Masking — Phone Number Anonymization

VoIPmonitor 2026.02.0 introduces PII (Personally Identifiable Information) masking — a comprehensive phone number anonymization system for organizations with strict privacy and compliance requirements (GDPR, etc.).

When enabled, all phone numbers (caller, called, contact) are anonymized before being stored in the database and in saved PCAP files. The system physically never stores the original plaintext phone numbers, eliminating PII exposure at the source.

What Gets Masked

PII masking covers all areas where phone numbers appear:

  • Calls — caller number, called number, caller name (database and PCAP)
  • Active calls — caller and called numbers in real-time view
  • Registrations — from, to, contact numbers (active and stored records, database and PCAP)
  • SIP messages — stored records and PCAP
  • Livesniffer — description and downloaded PCAP
  • Charts — source and destination numbers

Three Masking Modes

Mode How it works Correlation Reversible
Redact Replaces digits with a character (e.g. XXXXXXXXXXXXX) or a text string (e.g. REDACTED) No — all numbers look the same No
Hash (default) HMAC-SHA256 one-way hash with piih_ prefix Yes — same number = same token No
Encrypt AES-128-CTR encryption with piie_ prefix Yes — same number = same token Yes — with the secret key

The hash mode (default) is recommended for most deployments. It provides strong anonymization while preserving per-number correlation — statistics, graphs, and filtering by masked tokens still work as expected. Phone numbers are E.164-normalized before hashing, so the same number always produces the same token regardless of its original formatting (+420 123 456 789, 00420123456789, 420-123-456-789 all produce the same hash).

PCAP Anonymization

SIP headers in saved PCAP files are masked directly at the packet level. By default, all SIP headers are processed. The SIP request line (INVITE, REGISTER, etc.) is always masked. You can optionally restrict masking to specific headers: 

pii_sip_headers = from; to; contact; p-asserted-identity; p-called-party-id

Caller display names and SIP Authorization usernames are also anonymized by default (configurable via pii_anonymize_callername and pii_anonymize_username).

Quick Start

Simply add one line to voipmonitor.conf to enable with default HMAC hashing: 

pii_enable = yes

For reversible encryption (allows recovering original numbers with the secret key): 

pii_enable = yes
pii_masking_secret = your-secret-key-here

All 11 configuration parameters are documented in voipmonitor.conf under the PII MASKING section.

Availability

Available in sniffer version 2026.02.0 and newer.

For questions or feedback, please contact support@voipmonitor.org.

January 2026: Enhanced Sensor Monitoring & Disk I/O Analytics

We are excited to announce major improvements to sensor monitoring capabilities in both the sniffer and GUI.

New Disk I/O Monitoring System

The sniffer now includes comprehensive disk I/O monitoring with automatic calibration:

  • Automatic Baseline Calibration - On startup, the sniffer performs a quick calibration to determine your disk's baseline performance (throughput knee point and baseline latency). New in 2026.01.4: Calibration now detects external I/O load and waits for idle disk to ensure accurate baseline. If calibration runs under load, auto-recalibration occurs when disk becomes idle.
  • Real-time Metrics - Continuous monitoring of:
    • Disk utilization percentage
    • Capacity percentage (relative to calibrated knee point)
    • Write/Read throughput (MB/s)
    • Write/Read IOPS
    • Write latency with comparison to baseline
    • I/O queue depth
  • Saturation Detection - Automatic detection when disk cannot keep up with spool writes, displayed in syslog status line as DISK_SAT or IO_WARN. Additional status indicators: WAIT_CALIB (waiting for idle disk before calibration), RECAL_PEND (recalibration pending)
  • New RRD Graphs - Three new graph types:
    • Disk I/O Saturation - Shows utilization % and capacity %
    • Disk I/O Throughput - Write/Read MB/s with mirrored IOPS on right axis (dual Y-axis with dynamic scaling)
    • Disk I/O Latency - Write latency with queue depth on right axis

Redesigned Sensor Detail Page

The GUI sensor detail page has been completely redesigned to provide a unified view of all sensor performance data:

New sensor detail page with unified monitoring view
New sensor detail page with unified monitoring view

The new layout includes:

Statistics Dashboard

A comprehensive table showing real-time metrics organized into columns:

  • CALLS & TRAFFIC - Active calls, total calls, traffic rate, packet counters (SIP, RTP, etc.)
  • CPU USAGE - Per-thread CPU breakdown (t1, t2 workers, RTP threads, TAR compress, etc.)
  • MEMORY & BUFFERS - RSS/VSZ, TCMalloc stats, heap hashtable, buffers, queues
  • DISK I/O - All new I/O metrics with color-coded warnings
  • SQL & SYSTEM - SQL queue stats, load average, TLB entries

Real-time Thread Monitor

  • Live CPU usage for all ~70 sniffer threads
  • Mini sparkline graphs showing CPU history
  • Color-coded indicators (green/orange/red based on usage)
  • Sortable by CPU integral (Σ) to identify consistently busy threads
  • Refresh interval controls (1s, 2s, 5s, 10s)

RRD Performance Graphs

  • Time period selection from 1 hour to 10 years
  • Graphs displayed in organized groups:
    • CPU, Load averages, Memory
    • Disk I/O Saturation, Throughput, Latency (NEW)
    • Heap/Buffers, Network speed, Packet drops
    • Calls, SQL queues
    • Packet statistics

Why This Matters

These improvements make it significantly easier to identify performance bottlenecks:

  • CPU Bottlenecks - The thread monitor immediately shows which threads are overloaded. The critical t0 (packet capture) thread is highlighted - if it reaches 90%+, packets will be dropped.
  • I/O Bottlenecks - The new Disk I/O metrics show exactly when your storage cannot keep up:
    • High Capacity % means you're approaching the disk's throughput limit
    • High Latency ratio (current/baseline) indicates I/O contention
    • DISK_SAT status means immediate action is needed
  • Historical Analysis - RRD graphs let you correlate issues across time - see if CPU spikes coincide with I/O saturation or traffic bursts.

Configuration

Disk I/O monitoring is enabled by default. Configuration options in voipmonitor.conf: 

; Disk I/O monitoring (enabled by default when spooldir is set)
disk_io_monitor = yes

; Warning threshold (percentage of calibrated capacity)
disk_io_warning_threshold = 80

; Saturation threshold
disk_io_saturation_threshold = 95

; Recalibrate baseline (useful after hardware changes)
; Send manager command: disk_io_recalibrate

Availability

These features are available in:

  • Sniffer version 2026.01.3 and newer (external I/O load detection added in 2026.01.4)
  • GUI version 2026.1.3 and newer

For questions or feedback, please contact support@voipmonitor.org.

Retrieved from "https://www.voipmonitor.org/doc/index.php?title=Blog&oldid=11203"