Passive monitoring or active test calls: which to choose for telephony
Passive monitoring analyzes the real calls that cross your network; active test calls dial on their own, from outside, and check the result. Passive explains what happened to the people who called; active warns you when nobody can call, including when nobody tried. Most of the time you want both, and this guide shows in what order.
Summary
- Passive monitoring captures or reads the SIP and RTP traffic of real calls and computes indicators such as estimated MOS, jitter and packet loss.
- Active test calls leave from outside the network, on a schedule, and check whether the number connects, who answers and how the audio sounds.
- Passive cannot see what never crossed your network: a fault on the carrier's route that stops the call from arriving leaves no record to analyze.
- Active cannot see the reason inside your network: it shows that the call failed and with which code, but it does not replace capture for investigating the cause.
- For an 0800 or an IVR, start with the active test; for a busy trunk with quality complaints, add passive.
What is the difference between passive monitoring and active test calls?
In passive monitoring, the tool stays out of the path and watches the calls customers made; in active test calls, the tool dials. The difference changes what each one can see. Passive sees everything that crossed your network and nothing that did not; active sees the result of a simulated customer call, at any hour, but only for the calls it places.
| Passive monitoring | Active test calls | |
|---|---|---|
| What it does | Captures or reads the traffic of real calls | Dials the numbers, on a schedule |
| Example tools | VoIPmonitor (SIP and RTP capture); PRTG and Zabbix measure the network and the PBX with sensors, without test calls | Monitor by 2N5 |
| Needs real traffic? | Yes: with no call, there is nothing to analyze | No: it generates its own calls |
| Sees a fault on the carrier route? | Only if some call gets recorded | Yes, it sees the call that does not connect |
| Sees a swapped IVR or the carrier’s announcement? | No, unless someone listens | Yes, it compares with the reference recording |
| Sees the cause inside your network? | Yes, with the call capture | Only the SIP code and Q.850 cause returned |
| Installation | In your network (port mirroring, SBC mirroring or PBX reading) | None: it dials from outside |
For the tools in the table, the facts come from the vendors’ own pages, listed in the sources: VoIPmonitor does passive SIP and RTP capture, with MOS, one-way audio detection and fraud rules, and places no calls; PRTG uses SIP OPTIONS, QoS and Cisco IP SLA sensors, with MOS estimated from the network; Zabbix reads the trunks, channels and queues of Asterisk. On the pages we checked, none of the three dials out to the public network to check an 0800 or an IVR.
When is passive monitoring the best choice?
When you need to understand calls that already happened. With capture, you can open a specific call, see the signaling and the audio, and find out whether the delay was in your SBC or at the carrier. Passive is the right tool to:
- investigate a customer’s complaint about a specific call;
- follow real traffic indicators, such as the completion rate (ASR and ACD) and post-dial delay;
- detect fraud patterns and abnormal trunk use;
- measure jitter and packet loss on the calls that did go through.
When are active test calls the best choice?
When the risk is the number going down without anyone noticing. Active calls serve best for:
- 0800, 0300 and 4004 numbers, whose problem is often before your network, in the route or in number portability, where none of your equipment looks;
- IVRs, to check that the right message answers and not the carrier’s;
- nights, weekends and rarely dialed numbers, where real traffic is low or nonexistent;
- measuring the carrier’s SLA with an independent record of each hour;
- SIP trunks that need to be checked from outside, and not only by registration.
An 0800 that stopped connecting at 2 a.m. does not show up in passive monitoring: there was no call to capture. The guide Your 0800 went down and nobody told you shows that case.
Can you use both?
You can, and it is the most common setup in larger operations: active warns that something stopped, with the time and the code; passive helps find out why. The tools do not compete for the same job. A reasonable order:
- Start with active on the numbers that earn money or that the rules require to be answered (SAC, sales 0800, support IVR).
- Add passive when there is traffic volume and quality questions that only the analysis of real calls can settle.
- Use the codes of the failed test calls as the starting point. The guide Failing calls: diagnosis shows what each one means.
What does Monitor by 2N5 do, and not do?
Monitor by 2N5 is about active test calls: it dials from Brazil to 0800 numbers, IVRs and SIP trunks, on a schedule of its own for each circuit, checks what answered, measures the voice quality of the audio received (MOS-LQO) and opens an incident after four failures in a row, the first and three retests. It does not capture your network’s traffic and does not replace a capture tool for finding the cause inside it. See the comparisons with VoIPmonitor, PRTG and Zabbix, and the definition in what is synthetic call monitoring.
Frequently asked questions
What is the difference between passive and active VoIP monitoring?
Passive monitoring observes the calls customers already made, by traffic capture or by reading logs, and computes indicators about them. Active monitoring places its own test calls, on a schedule, from outside the network. Passive explains what happened on existing calls; active detects the failure even when no real call is crossing.
Does VoIPmonitor place test calls?
No. According to the vendor's site, VoIPmonitor does passive SIP and RTP capture and computes MOS, detects one-way audio and applies fraud rules; it analyzes traffic and does not generate calls. It is a very good tool for investigating real calls, and a different category from dialing the 0800 and checking the IVR.
Does PRTG place test calls to my 0800?
From the vendor's pages, PRTG measures with sensors: SIP OPTIONS ping, QoS round trip and Cisco IP SLA, with MOS estimated from the network. We found no dialing to the public network, 0800 or IVR. It shows the health of the network and the trunk; checking what answers on the 0800 is another task.
Does Zabbix monitor SIP trunks and call quality?
Zabbix, which is open source, has an Asterisk template that reads the state of trunks and peers, channels and queues. From what the project publishes, it does not place test calls or assess audio. It is for looking at the PBX from inside, not for knowing whether a call from outside connects.
Do I need both kinds of monitoring?
It depends on the risk. If what matters is knowing that the 0800, the IVR or the trunk answer at any hour, start with active. If there is heavy traffic and quality complaints, passive shows the problem calls. Larger operations run both: active warns, passive helps find the cause.
Does PRTG / Zabbix place test calls?
Not according to the vendors' own pages. PRTG measures with sensors, such as SIP OPTIONS ping, QoS round trip and Cisco IP SLA, and Zabbix reads trunk, channel and queue status through its Asterisk template. Neither one dials the public network or checks what answers. For that you need an active test call, which dials from outside and listens to the result.