Multiple sniffer instancies

How to Run Multiple Sniffer Instances on a Single Host

Running multiple VoIPmonitor sniffer instances on a single host is useful when you need to:

• Monitor multiple PBX systems via separate network interfaces
• Distinguish calls by the network interface they arrived through
• Assign different id_sensor values for licensing or organizational purposes
• Use completely separate storage paths for different instances

⚠️ Warning: Do NOT use the GUI wrench icon to configure interfaces when running multiple instances. Interface settings must be configured in the local configuration files only.

Step-by-Step Setup Procedure

To add a second instance when a single instance is already running correctly, follow these steps:

Step 1: Copy the main configuration file

cp -a /etc/voipmonitor.conf /etc/voipmon2.conf

Step 2: Copy and modify the init script (if using init.d)

cp -a /etc/init.d/voipmonitor /etc/init.d/voipmon2

Edit the new script and replace all occurrences of voipmonitor with voipmon2:

vim /etc/init.d/voipmon2
# In vim, use: :%s/voipmonitor/voipmon2/g

Step 3: Edit the new configuration file

Edit /etc/voipmon2.conf and modify these critical options:

Option	Purpose	Requirements
id_sensor	Sensor ID for licensing/organization	Must be unique per instance
interface	Network interface(s) to sniff	Must be unique or non-overlapping
managerport	API port for GUI communication	Must be unique per instance (e.g., 5030, 5031)
server_bind	Server process bind address/port	Must be unique per instance
mirror_bind	Mirror process bind address/port	Must be unique per instance
spooldir	Directory for PCAP/graph/audio files	Must be unique per instance
maxpoolsize	Maximum storage size for spooldir	Adjust for available disk space

ℹ️ Note: All bind options (server_bind, mirror_bind, etc.) must have unique values across all instances to prevent port conflicts.

Example configuration for /etc/voipmon2.conf:

[general]
id_sensor = 2
interface = eth1
managerport = 5030
server_bind = 127.0.0.1:5031
mirror_bind = 127.0.0.1:5032
spooldir = /var/spool/voipmonitor2

Step 4: Verify RAM and storage capacity

Ensure the total resources across all instances do not exceed available capacity:

• RAM: The sum of ringbuffer and max_buffer_mem from all instances must not exceed available free RAM
• Storage: The sum of maxpoolsize for all instance spool directories must not exceed available disk space

Step 5: Register and start the new service

systemctl daemon-reload
systemctl enable voipmon2
systemctl start voipmon2

Step 6: Verify the service started successfully

Check service logs for errors:

# Using journalctl (recommended)
journalctl -u voipmon2 --since="2025-01-06" -n 50

# Or check syslog
tail -f /var/log/syslog | grep voipmon2

⚠️ Warning: Verify there are NO errors in the logs before proceeding.

Step 7: Add the new instance to the GUI

1. Log in to the VoIPmonitor GUI 2. Navigate to Settings > Sensors 3. Click Add Sensor 4. Configure:

  * Sensor ID: Matches id_sensor in the config file
  * Manager IP: IP address of the sensor host
  * Manager Port: The managerport configured in the config file (e.g., 5030)

💡 Tip: Do NOT use the GUI wrench icon to set the interface field. The interface is managed exclusively through the local configuration file.

Troubleshooting Multiple Instances

Duplicate Calls in GUI

If you see duplicate calls, it typically means:

• Both interfaces are seeing the same SPAN/mirrored traffic (e.g., VLAN trunking or inter-VLAN routing overlap)
• Packet deduplication is not enabled

Solution: Add to both configuration files:

auto_enable_use_blocks = yes

Reference: Sniffing_modes#Multiple_Mirrored_Interfaces_Issue

Configuration Conflicts

If changes in the GUI are being applied to the wrong sensor:

• Ensure GUI wrench icon is NOT used for interface settings
• Verify each instance has unique id_sensor, managerport, and all bind options
• Set mysqlloadconfig = no in each instance's config file to prevent GUI overwrites

Service Won't Start

• Check that all bind ports are unique and not already in use: netstat -tulpn | grep -E '50[23][0-9]'
• Verify spooldir paths exist and are writable by the voipmonitor user
• Check logs for permission errors or missing dependencies

Alternative: Systemd Service Files (Modern Method)

For modern systemd-based systems, you can create dedicated service files instead of copying init.d scripts.

Create /etc/systemd/system/voipmon2.service:

[Unit]
Description=VoIPmonitor Instance 2
After=network.target mysql.service

[Service]
Type=forking
ExecStart=/usr/local/sbin/voipmon2 --config-file=/etc/voipmon2.conf
User=voipmonitor
Restart=on-failure

[Install]
WantedBy=multi-user.target

Then enable and start:

systemctl daemon-reload
systemctl enable voipmon2
systemctl start voipmon2

AI Summary for RAG

Summary: This guide explains how to run multiple independent VoIPmonitor sniffer instances on a single physical host. Each instance requires unique values for id_sensor, interface, managerport, and all bind options (server_bind, mirror_bind, etc.). The procedure covers copying configuration files, modifying init scripts or creating systemd service units, and registering sensors in the GUI. It also addresses troubleshooting for duplicate calls and configuration conflicts. Keywords: multiple instances, single host, separate network interfaces, id_sensor, managerport, server_bind, mirror_bind, PBX monitoring, dual PBX Key Questions:

• How to monitor two PBX systems on a single VoIPmonitor host?
• Why are calls duplicated in the GUI when using multiple sensors?
• How to configure unique managerport and bind options for each sniffer instance?
• How to prevent configuration conflicts between multiple sniffer instances?
• When to use auto_enable_use_blocks for packet deduplication?