How to Run Multiple Sniffer Instances on a Single Host

Running multiple VoIPmonitor sniffer instances on a single host allows you to:

Monitor multiple PBX systems via separate network interfaces
Assign different id_sensor values for licensing or organizational purposes
Use separate storage paths (spooldir) for each instance

⚠️ Warning: Do NOT use the GUI wrench icon to configure interfaces when running multiple instances. Interface settings must be configured in local configuration files only.

Configuration Requirements

Each instance requires unique values for these parameters:

Option	Purpose	Example (Instance 2)
`id_sensor`	Sensor ID for licensing/GUI	`2`
`interface`	Network interface to capture	`eth1`
`managerport`	API port for GUI communication	`5030`
`server_bind`	Server mode bind address:port	`127.0.0.1:60025`
`mirror_bind`	Mirror mode bind address:port	`127.0.0.1:60026`
`spooldir`	PCAP/audio storage directory	`/var/spool/voipmonitor2`

Step-by-Step Setup

Step 1: Copy configuration file

cp -a /etc/voipmonitor.conf /etc/voipmon2.conf

Step 2: Edit the new configuration

Edit /etc/voipmon2.conf and set unique values:

id_sensor = 2
interface = eth1
managerport = 5030
server_bind = 127.0.0.1:60025
mirror_bind = 127.0.0.1:60026
spooldir = /var/spool/voipmonitor2

Step 3: Create systemd service

Create /etc/systemd/system/voipmon2.service:

[Unit]
Description=VoIPmonitor Instance 2
After=network.target mysql.service

[Service]
Type=forking
ExecStart=/usr/local/sbin/voipmonitor --config-file=/etc/voipmon2.conf
Restart=on-failure

[Install]
WantedBy=multi-user.target

Step 4: Create spooldir and start service

mkdir -p /var/spool/voipmonitor2
systemctl daemon-reload
systemctl enable --now voipmon2

Step 5: Verify startup

journalctl -u voipmon2 -n 50

⚠️ Warning: Verify there are NO errors in the logs before proceeding.

Step 6: Register in GUI

Navigate to Settings > Sensors > Add Sensor
Configure:
- Sensor ID: 2 (matches id_sensor)
- Manager IP: IP address of the host
- Manager Port: 5030 (matches managerport)

Troubleshooting

Duplicate Calls in GUI

If both interfaces see the same traffic (overlapping SPAN), add to both config files:

auto_enable_use_blocks = yes

See Sniffing_modes#Multiple_Mirrored_Interfaces_Issue for details.

GUI Overwrites Configuration

Prevent GUI from overwriting local config settings:

mysqlloadconfig = no

Service Won't Start

Check port conflicts: ss -tulpn | grep -E '502[0-9]|6002[0-9]'
Verify spooldir exists and is writable
Check logs: journalctl -u voipmon2 -e

AI Summary for RAG

Summary: Guide for running multiple independent VoIPmonitor sniffer instances on a single host. Each instance requires unique values for id_sensor, interface, managerport, and bind options (server_bind, mirror_bind). Setup involves copying the config file, creating a systemd service unit with --config-file parameter, and registering the sensor in GUI. For duplicate calls when interfaces see overlapping traffic, use auto_enable_use_blocks = yes. To prevent GUI from overwriting local settings, use mysqlloadconfig = no.

Keywords: multiple instances, single host, separate interfaces, id_sensor, managerport, server_bind, mirror_bind, dual PBX, systemd service, auto_enable_use_blocks, mysqlloadconfig, packet deduplication

Key Questions:

How to monitor two PBX systems on a single VoIPmonitor host?
Why are calls duplicated when using multiple sniffer instances?
How to configure unique ports for each sniffer instance?
How to prevent configuration conflicts between multiple instances?
How to create a systemd service for additional sniffer instance?

Multiple sniffer instancies