Merging or correlating multiple call legs

Call Correlation and Leg Matching in VoIPmonitor

Overview of Call Correlation

Call correlation is the process of identifying and linking multiple separate call recordings (legs) that belong to the same end-to-end phone call. This is crucial in environments where a call passes through multiple systems, such as a Session Border Controller (SBC) or a Back-to-Back User Agent (B2BUA). These systems often change the SIP Call-ID, causing a single call to be seen as several distinct segments by the sniffer.

VoIPmonitor offers several methods to solve this, which can be categorized into two main approaches:

1. Linking related CDRs: Keeps the individual call legs as separate CDRs but links them together in the GUI for unified analysis.
2. Merging legs into one CDR: Combines all SIP packets from multiple legs into a single CDR and a single PCAP file.

Method 1: Linking Separate CDRs in the GUI

This approach associates related call legs, but they remain as distinct entries in the database. The association is visible within the CDR detail view in dedicated tabs.

Automatic Linking by Caller ID (Legs by CID)

This is a built-in, automatic correlation method that requires no configuration.

• How it works: VoIPmonitor searches for CDRs where the last 6 digits of the caller and called numbers match. The calls must also have started within a +/- 10-second window of each other.
• Where to find it: The results are displayed in the CDR detail view under the Legs by CID tab.

Linking by Custom Header (matchheader)

This method uses a shared, unique SIP header to link legs. This is the most common and flexible method for advanced correlation.

How it works: You configure your PBX/SBC to add a unique header (e.g., X-Correlation-ID) to all related legs of a call. VoIPmonitor then finds all CDRs that share the same value in this header and displays them together under the Legs by header tab in the CDR detail.

This can be configured in two ways, which can be used simultaneously:

A. GUI Configuration (Recommended)

This is the modern and most flexible method, as it does not require restarting the sniffer service.

1. Navigate to Settings > Custom Headers.
2. Define the SIP header you want to use for correlation (e.g., X-Correlation-ID).
3. In the configuration for that specific header, enable the checkbox labeled "match in sip by header".
4. This change is applied dynamically after a configuration reload, which is triggered automatically from the GUI.

B. voipmonitor.conf Configuration (Legacy Method)

This method configures a single, system-wide matching header.

1. Edit the sniffer configuration file at /etc/voipmonitor.conf.
2. Set the `matchheader` parameter to the name of your custom SIP header.

# Enable storing the content of a custom header (e.g., in-reply-to) in 'cdr_next.match_header'.
# This header is utilized in the related CDR GUI to match legs to a single call.
matchheader = X-Correlation-ID

1. You must restart the voipmonitor sniffer service for the change to take effect.
2. The sniffer will store the header's content in the `cdr_next.match_header` database column, which the GUI then uses for matching.

Method 2: Merging Legs into a Single CDR (callidmerge_header)

This method offers true merging, where multiple call legs are combined into a single CDR and a single PCAP file. This is useful when you want to treat the entire call as one atomic record.

• How it works: The second leg of the call must contain a special SIP header in its initial INVITE message. The value of this header must be the Call-ID of the first (parent) call leg.
• Configuration: This is configured exclusively in /etc/voipmonitor.conf and requires a sniffer restart.

# Enable call merging based on matching 'Call-ID'. The idea is that the second leg of the call, which has a different 'Call-ID',
# includes a special header in its initial INVITE that contains the 'Call-ID' of the parent SIP call.
# The configuration option specifies the name of that header.
callidmerge_header = Parent-Call-ID

# To keep this header confidential, you can encrypt it. If 'callidmerge_secret' is specified,
# the header will be decoded using Base64 and XORed with this secret string.
#callidmerge_secret = yourSecretString

AI Summary for RAG

Summary: This article explains the call correlation mechanisms in VoIPmonitor, which are used to link or merge multiple call legs that belong to a single end-to-end call, especially in environments with B2BUAs. It details three primary methods: automatic linking based on Caller ID (Legs by CID), linking separate CDRs using a custom SIP header (configured via the GUI or voipmonitor.conf `matchheader`), and a true merge of call legs into a single CDR and PCAP file using the `callidmerge_header` setting. The key difference between linking and merging is highlighted, as are the configuration requirements for each method. Keywords: call correlation, leg matching, CDR, B2BUA, SIP, Call-ID, matchheader, callidmerge_header, Legs by CID, custom header, voipmonitor.conf, sniffer, GUI, SBC Key Questions:

• What are the main methods for call correlation in VoIPmonitor?
• How does VoIPmonitor link call legs together in the GUI?
• What is the difference between `matchheader` and `callidmerge_header`?
• How can I merge two call legs into a single CDR?
• What is the "Legs by CID" feature?
• Do I need to restart the sniffer service to configure call correlation?
• How do I configure call correlation without restarting the sniffer?