Multiple sniffer instancies

How to Run Multiple Sniffer Instances on a Single Host

Running multiple VoIPmonitor sniffer instances on a single host allows you to:

• Monitor multiple PBX systems via separate network interfaces
• Assign different id_sensor values for licensing or organizational purposes
• Use separate storage paths (spooldir) for each instance
• Prevent CDR merging from multiple sensors in packet mirroring mode (see below)

⚠️ Warning: Do NOT use the GUI wrench icon to configure interfaces when running multiple instances. Interface settings must be configured in local configuration files only.

Use Case: Multiple Receivers Preventing CDR Merging

When multiple sensors send packets to a single receiver instance in packet mirroring mode (packetbuffer_sender=yes), calls may be merged into single CDRs, preventing per-sensor concurrent call monitoring.

Solution: Run multiple voipmonitor receiver instances on the same host, one per sensor. Each instance binds to a dedicated server_bind_port and processes only that sensor's traffic.

# /etc/voipmonitor-sensor1.conf
id_sensor          = 1
server_bind        = 0.0.0.0:60024
server_bind_port   = 60024
server_password    = password1

# /etc/voipmonitor-sensor2.conf  
id_sensor          = 2
server_bind        = 0.0.0.0:60025
server_bind_port   = 60025
server_password    = password2

Configure each remote sensor to send to its dedicated port:

# On Sensor 1
server_destination      = receiver.host.ip
server_destination_port = 60024

# On Sensor 2
server_destination      = receiver.host.ip
server_destination_port = 60025

Note: Configuration options like id_sensor or cdr_check_unique_callid_in_sensors do not prevent CDR merging in packet mirroring mode. The only solution is separate receiver instances.

Configuration Requirements

Each instance requires unique values for these parameters:

Option	Purpose	Example (Instance 2)
id_sensor	Sensor ID for licensing/GUI	2
interface	Network interface to capture	eth1
managerport	API port for GUI communication	5030
server_bind	Server mode bind address:port	127.0.0.1:60025
mirror_bind	Mirror mode bind address:port	127.0.0.1:60026
spooldir	PCAP/audio storage directory	/var/spool/voipmonitor2

Step-by-Step Setup

Step 1: Copy configuration file

cp -a /etc/voipmonitor.conf /etc/voipmon2.conf

Step 2: Edit the new configuration

Edit /etc/voipmon2.conf and set unique values:

id_sensor = 2
interface = eth1
managerport = 5030
server_bind = 127.0.0.1:60025
mirror_bind = 127.0.0.1:60026
spooldir = /var/spool/voipmonitor2

Step 3: Create systemd service

Create /etc/systemd/system/voipmon2.service:

[Unit]
Description=VoIPmonitor Instance 2
After=network.target mysql.service

[Service]
Type=forking
ExecStart=/usr/local/sbin/voipmonitor --config-file=/etc/voipmon2.conf
Restart=on-failure

[Install]
WantedBy=multi-user.target

Step 4: Create spooldir and start service

mkdir -p /var/spool/voipmonitor2
systemctl daemon-reload
systemctl enable --now voipmon2

Step 5: Verify startup

journalctl -u voipmon2 -n 50

⚠️ Warning: Verify there are NO errors in the logs before proceeding.

Step 6: Register in GUI

1. Navigate to Settings > Sensors > Add Sensor
2. Configure:
   • Sensor ID: 2 (matches id_sensor)
   • Manager IP: IP address of the host
   • Manager Port: 5030 (matches managerport)

Troubleshooting

Duplicate Calls in GUI

If both interfaces see the same traffic (overlapping SPAN), add to both config files:

auto_enable_use_blocks = yes

See Sniffing_modes#Multiple_Mirrored_Interfaces_Issue for details.

GUI Overwrites Configuration

Prevent GUI from overwriting local config settings:

mysqlloadconfig = no

Service Won't Start

• Check port conflicts: ss -tulpn | grep -E '502[0-9]|6002[0-9]'
• Verify spooldir exists and is writable
• Check logs: journalctl -u voipmon2 -e

See Also

• Sniffer_configuration - Configuration file reference
• Systemd_for_voipmonitor_service_management - Systemd service details
• Sniffing_modes - Traffic capture methods and SPAN setup
• Sniffer_distributed_architecture - Client-server mode and packet mirroring

AI Summary for RAG

Summary: Guide for running multiple independent VoIPmonitor sniffer instances on a single host. Each instance requires unique values for id_sensor, interface, managerport, and bind options (server_bind, mirror_bind). Setup involves copying the config file, creating a systemd service unit with --config-file parameter, and registering the sensor in GUI. For duplicate calls when interfaces see overlapping traffic, use auto_enable_use_blocks = yes. To prevent GUI from overwriting local settings, use mysqlloadconfig = no.

Keywords: multiple instances, single host, separate interfaces, id_sensor, managerport, server_bind, mirror_bind, dual PBX, systemd service, auto_enable_use_blocks, mysqlloadconfig, packet deduplication

Key Questions:

• How to monitor two PBX systems on a single VoIPmonitor host?
• Why are calls duplicated when using multiple sniffer instances?
• How to configure unique ports for each sniffer instance?
• How to prevent configuration conflicts between multiple instances?
• How to create a systemd service for additional sniffer instance?