AudioCodes Tunneling

AudioCodes tunneling allows AudioCodes SBCs to encapsulate and forward SIP/RTP packets to VoIPmonitor via the "Debug Recording Server" feature, as an alternative to traditional SPAN port mirroring.

When to Use AudioCodes Tunneling

This method is ideal for:

TLS 1.3 / ECDHE encrypted traffic - The SBC decrypts internally, no SSL key logger needed
MS Teams Direct Routing - SBC-to-Microsoft traffic uses PFS where private key decryption is impossible
Cross-segment monitoring - When SBC and VoIPmonitor are on different network segments
Closed appliances - When you cannot inject SSL key logger libraries

ℹ️ Note: For MS Teams Direct Routing, AudioCodes tunneling is often the most practical solution because it does not require access to Microsoft's private keys.

For other TLS decryption methods, see TLS Decryption Guide.

Configuration

Step 1: AudioCodes SBC

On the AudioCodes device:

Locate Debug Recording Server (or "Log server" / "Session mirroring")
Set the IP address to your VoIPmonitor server IP
Default port: UDP/TCP 925

Refer to AudioCodes documentation for model-specific steps.

Step 2: VoIPmonitor Server

Edit /etc/voipmonitor.conf:

audiocodes = yes
udp_port_audiocodes = 925
tcp_port_audiocodes = 925

Restart the service:

systemctl restart voipmonitor

ℹ️ Note: Ensure your firewall allows incoming traffic on port 925.

RTP/RTCP Handling Options

These options control how VoIPmonitor handles RTP/RTCP packets when both tunneled and pure (non-encapsulated) packets are captured:

audiocodes_rtp  = yes | no | only | only_for_audiocodes_sip
audiocodes_rtcp = yes | no | only | only_for_audiocodes_sip

Value	Description	Use Case
`yes`	Process tunnel RTP/RTCP (default)	Tunnel-only capture, no SPAN
`no`	Ignore tunnel RTP/RTCP	Use only pure packets
`only`	Use only tunnel RTP/RTCP for all calls	Exclusively use tunnel data
`only_for_audiocodes_sip`	Use tunnel RTP only if SIP was also tunneled	Recommended for mixed capture (tunnel + SPAN)

Mixed Traffic Configuration

When capturing both AudioCodes tunnel and SPAN traffic, use:

audiocodes          = yes
audiocodes_rtp      = only_for_audiocodes_sip
audiocodes_rtcp     = only_for_audiocodes_sip

This ensures correct pairing between tunnel RTP and tunnel SIP, preventing stream mixing.

Verification

On the AudioCodes SBC:

tshark -i pkt1 port 925

On the VoIPmonitor server:

tcpdump -i any port 925 -w /var/tmp/capture.pcap

Known Limitations

IP Addresses Logged as 0.0.0.0

RTP packets may show 0.0.0.0 IP addresses in CDR because the AudioCodes encapsulation strips IP header information.

Aspect	Details
Impact	Display limitation only; SIP signaling IPs and call recording remain intact
Workaround	Use SIP History tab to see actual IPs from signaling packets
Status	Expected behavior, not fixable via configuration

Performance Considerations

Monitor SBC CPU and network load before/after enabling tunneling:

Check baseline SBC metrics (CPU, network)
Enable tunneling via UDP on the SBC
Monitor metrics during normal operation

💡 Tip: You can test SBC impact without configuring VoIPmonitor listener to isolate SBC performance from sensor processing.

AI Summary for RAG

Summary: AudioCodes tunneling allows AudioCodes SBCs to encapsulate and forward SIP/RTP packets to VoIPmonitor using the "Debug Recording Server" feature (default port UDP/TCP 925). Configuration: (1) SBC - set Debug Recording Server IP to VoIPmonitor server, (2) VoIPmonitor - enable audiocodes=yes and set udp_port_audiocodes/tcp_port_audiocodes=925. For mixed capture (tunnel + SPAN), use audiocodes_rtp=only_for_audiocodes_sip to prevent stream mixing. Key use case: Decrypt TLS 1.3/ECDHE traffic (including MS Teams Direct Routing) without SSL key logger. Known limitation: RTP IPs may show as 0.0.0.0 due to encapsulation format.

Keywords: audiocodes, tunnel, SBC, debug recording server, port 925, udp_port_audiocodes, tcp_port_audiocodes, audiocodes_rtp, only_for_audiocodes_sip, mixed streams, TLS decryption, ECDHE, PFS, TLS 1.3, MS Teams Direct Routing, 0.0.0.0 IP, SPAN alternative

Key Questions:

How to configure AudioCodes SBC to forward packets to VoIPmonitor?
What is the default port for AudioCodes tunneling?
How to configure VoIPmonitor to receive AudioCodes tunneled data?
How to fix mixed RTP streams when capturing both AudioCodes tunnel and SPAN traffic?
What is the difference between audiocodes_rtp options?
Can AudioCodes tunneling decrypt TLS/ECDHE encrypted SIP?
Why are IP addresses logged as 0.0.0.0 with AudioCodes tunneling?
How to monitor MS Teams Direct Routing traffic?

Audiocodes tunneling