SIP ALG (Application Layer Gateway) is a feature built into most consumer and SMB routers/firewalls. It intercepts SIP packets and rewrites IP addresses in headers (Via, Contact, SDP) trying to help with NAT traversal. In practice, it almost always breaks VoIP by corrupting headers, mangling ports, or failing to handle the SDP body.

This tool analyzes a PCAP capture and looks for telltale signs of ALG interference: mismatched IPs between network layer and SIP headers, private IPs leaking in SDP while the Via was rewritten, and more.