Hello, While troubleshooting a memory leak, I noticed that we are mixing SHM memory with PKG memory during hep tracing. When the dispatcher timer is scheduled for OPTION pings, the ds_ping_set() is called and the tm module is engaged to handle the ping. dispatcher: dispatcher.c ds_ping_set() tmb.t_request Inside the tm module, a new cell is created and the SIP message is cloned for further processing via sip_msg_cloner() and later on the onsend_route is engaged: tm: uac.c: request() t_uac() t_uac_with_ids() t_uac_prepare() new_cell->uas.request = sip_msg_cloner(&lreq, &sip_msg_len); core: sip_msg_shm_clone() (we are cloning the msg in SHM) send_prepared_request_impl(SHM pointer) run_onsend(SHM pointer) Inside the onsend_route we call siptrace() and we go like this: siptrace: siptrace_send.c sip_trace_prepare(SHM pointer) parser: parse_from_header(SHM pointer) we allocate PKG mem that is leaked parse_to() parse_addr_spec() we allocate PKG mem that is leaked Later on, the SHM memory block is released by the free_cell_helper(): sip_msg_free_unsafe(dead_cell->uas.request); This was a misconfiguration, because the siptrace was configured to automatically mirror all SIP traffic and the call for siptrace() in the onsend_route was not necessary. Perhaps siptrace() should be a noop when trace_mode is not 0. Here are the siptrace params: loadmodule "siptrace.so" modparam("siptrace", "db_url", DBMYSQL) modparam("siptrace", "duplicate_uri", SIPTRACE_SVR_IP) modparam("siptrace", "send_sock_addr", SIPTRACE_OUT_IP) modparam("siptrace", "hep_mode_on", 1) modparam("siptrace", "hep_version", 3) modparam("siptrace", "trace_to_database", 0) modparam("siptrace", "trace_flag", 22) modparam("siptrace", "trace_on", 1) modparam("siptrace", "evcb_msg", "ksr_siptrace_msg") modparam("siptrace", "trace_mode", 1) This is happening on the latest version of kamailio 5.6. -ovidiu