Skip to content
hepic
protocol spec

HEP / EEP - the encapsulation protocol

The Homer Encapsulation Protocol is the open, vendor-neutral envelope that carries captured signaling, media metrics and logs from any source to hepic.

§01Overview

One envelope for everything on the wire

HEP (Homer Encapsulation Protocol), also known as EEP, wraps a captured packet together with the metadata you need to make sense of it - source and destination, timing, protocol type and the capturing agent's identity. Because the format is open and self-describing, any HEP-enabled tool can emit it and hepic can index, correlate and analyze it without bespoke parsers.

  • Vendor-neutral. One envelope format that every HEP-enabled tool understands - no proprietary wire protocols.
  • Self-describing. Typed chunks carry source, destination, timing and protocol metadata alongside the payload.
  • Secure transport. HEP/TLS encrypts the channel; per-agent auth keys gate what reaches your collector.
  • Compressible. Optional payload compression keeps high-volume capture links efficient.
hep3_decode · packet
HEP3 packetstruct layout
  1. 00HEP3 magic0x48455033
  2. 01Total lengthuint16
  3. 02IP family / protochunk 0x0001
  4. 03Src / Dst addresschunk 0x0003
  5. 04Src / Dst portchunk 0x0007
  6. 05Timestamp µschunk 0x0009
  7. 06Protocol typechunk 0x000b
  8. 07Capture agent IDchunk 0x000c
  9. 08Auth keychunk 0x000e
  10. 09Payload (SIP/RTCP/log)chunk 0x000f

Illustrative - chunk types are extensible per the HEP3 spec.

§02HEPAgent

The all-in-one HEP agent, built for carrier scale

HEPAgent is the most advanced HEP agent on the planet and comes bundled with every hepic deployment. Our unique design allows our agents to capture, collect, correlate and analyze millions of concurrent calls in real-time without violations of end-user privacy.

Analyze millions of concurrent calls up to 10G-40G-100G/s

Capture

Wire-rate SIP and RTP capture into HEP, tuned for dense signaling and media on production networks.

Collect

One agent collects signaling, media stats and session records into a single stream to hepic.

Correlate

Session-aware correlation so SIP and RTP land in hepic as one call, not disconnected packets.

Record

Record SIP/RTP sessions into hepic without a second probe, a tap farm or a separate recorder.

§03Agent Swarm

Capture everywhere, correlate in one place

Deploy lightweight HEP agents across every node - SIP proxies, SBCs, media engines - and stream them to a single hepic collector.

1

Emit

Each node wraps its packets in HEP3 and ships them over HEP/TLS.

2

Collect

hepic ingests every agent, authenticating by capture-agent ID and key.

3

Correlate

Cross-protocol correlation stitches signaling and media into one call flow.

§04HEP clients

Universal where VoIP already runs

HEP is universally available in the major open-source VoIP projects, and adopted by commercial SBC and IMS vendors. Point any of them at hepic.

Open source VoIP

Native HEP clients ship in the major open-source stack - SIP proxies, PBXs, media engines and capture tools. No proprietary probe required.

Commercial SBC & IMS

HEP is also adopted by commercial SBC and IMS vendors. Stream from Sansay, Ribbon, Sonus, Avaya and others on the same envelope.

KamailioOpenSIPSAsteriskFreeSWITCHRTPEngineDrachtioreSIProcatePartySIPsipgrepsngrepheplifyCaptagentHEPAgentSansayRibbonSonusAvaya

Native HEP clients · see the full list at awesome-hep

get started

Start streaming HEP today

Point any HEP-enabled source at hepic - or run HEPAgent - and watch your network light up in real time.