VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011)...

40
SHARKFEST 11 | Stanford University | June 13–16, 2011 VoIP TroubleshooGng and Analysis June 16 th 2011 Loris Degioanni Sr. Director of Technology | Riverbed Technology Pietro Giordano Technical Staff Team Lead | Riverbed Technology SHARKFEST ‘11 Stanford University June 1316, 2011 Wireshark Developer and User Conference

Transcript of VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011)...

Page 1: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  TroubleshooGng  and  Analysis  June  16th  2011      Loris  Degioanni  Sr.  Director  of  Technology  |  Riverbed  Technology  Pietro  Giordano  Technical  Staff  Team  Lead  |  Riverbed  Technology      SHARKFEST  ‘11  Stanford  University  June  13-­‐16,  2011  

Wireshark Developer and User Conference

Page 2: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Signaling  and  Data  

•  Signaling  protocols  – Manage  the  call  

•  NoNfy  a  receiver  for  incoming  calls  

•  NoNfy  the  caller  for  accepted  or  rejected  calls  •  NoNfy  both  the  caller  and  the  receiver  for  errors/events  

– Manage  the  data  protocols  •  Decides  how  the  voice  is  encoded  •  Decides  how  the  voice  is  transferred  

•  Data  protocols  – Carry  the  coded  voice    

Page 3: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Signaling  and  Data  

•  Signaling  protocols  – SIP  (IETF)  – H323  (ITU-­‐T)  – SCCP  or  Skinny  (CISCO)  – MCGP  (IETF)  – Others  

•  Data  protocols  – RTP  (PCMU,  PCMA,  G728,  G729…)  

Page 4: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Signaling  and  Data  

– Cascade  Pilot  views  (sip_ex_01_sig_data.pcap)  •  VoIP  Signaling  vs.  Data  Bandwidth  Over  Time  

•  VoIP  Signaling  vs.  Data  Bandwidth  UNlizaNon  •  RTP  Traffic  by  CODEC  

•  Top  RTP  CODECs        

Page 5: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5930/IP2

VoIP  call:  a  simple  example  

5923/IP1

IP3

Page 6: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

VoIP  call:  a  simple  example  

5923/IP1 Listening on PortA

IP3

Page 7: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

VoIP  call:  a  simple  example  

IP3

5923/IP1 Listening on PortA

Page 8: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  call:  a  simple  example  

IP3

5923/IP1 Listening on PortA

5950/IP2 Listening on PortB

Page 9: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  call:  a  simple  example  

IP3

5923/IP1 Listening on PortA

5950/IP2 Listening on PortB

Page 10: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  call:  a  simple  example  

Connecting to IP2:PortB Connecting to IP1:PortA

IP3

5923/IP1 Listening on PortA

5950/IP2 Listening on PortB

Page 11: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  call:  a  simple  example  

5923/IP1 5930/IP2

– Cascade  Pilot  views  (sip_ex_01_reg.pcap)  •  TransacNon  Analysis  by  VoIP  Call  

Page 12: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay    

IP3

5923/IP1 5950/IP2

Page 13: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

IP3

5923/IP1 Listening on PortA

5950/IP2

Page 14: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

IP3

5923/IP1 Listening on PortA

5950/IP2

Listening on PortC

Page 15: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

IP3

5923/IP1 Listening on PortA

5950/IP2 Listening on PortB

Listening on PortC

Page 16: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

IP3

5923/IP1 Listening on PortA

Listening on PortC Listening on PortD

5950/IP2 Listening on PortB

Page 17: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

IP3

5923/IP1 Listening on PortA

Listening on PortC Listening on PortD

5950/IP2 Listening on PortB

Page 18: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  server  as  relay  

– Cascade  Pilot  views  (sip_ex_03_relay.pcap)  •  TransacNon  Analysis  by  VoIP  Call  

 

Page 19: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1

Page 20: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Page 21: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Page 22: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Listening on PortC

Page 23: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2 Listening on PortB

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Listening on PortC

Page 24: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2 Listening on PortB

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Listening on PortC Listening on PortD

Page 25: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2 Listening on PortB

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Listening on PortC Listening on PortD

Page 26: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

5950/IP2 Listening on PortB

Calling  from  behind  a  NAT  

IP3

NAT  

5923/IP1 Listening on PortA

Listening on PortC Listening on PortD

Page 27: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Calling  from  behind  a  NAT  

– Cascade  Pilot  views  •  TransacNon  Analysis  by  VoIP  Call  

–  sip_ex_04_cace-­‐voip-­‐nat-­‐behind-­‐nat.pcap  –  sip_ex_04_cace-­‐voip-­‐nat-­‐carl.pcap  –  sip_ex_04_cace-­‐voip-­‐nat-­‐nina.pcap  

Page 28: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Problems  

•  Signaling  related  problems  – Control  Messages/Errors  – PDD  

•  Data  related  problems  – Delay  –  Jieer  – Packet  Loss    

Page 29: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Control  Messages/Errors  

•  Recognizing  for  the  different  VoIP  protocols:  – Regular  transacNon  messages  – MisconfiguraNon  errors  

•  SIP  Response  codes:  – 1xx  Provisional  – 200  OK  – 3xx  RedirecNon  – 4xx  Request  Failure  – 5xx  Server  Failure  – 6xx  Global  Failures  

Page 30: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

VoIP  Control  Messages/Errors  

– Cascade  Pilot  views  (sip_ex_01_sig_data.pcap)  •  SIP  Massages  DistribuNon  

Page 31: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Post  Dial  Delay  

– The  Post  Dialing  Delay  (PDD)  is  the  Nme  interval  between  the  dialing  of  the  last  digit  and  the  recepNon  of  either  a  ring  tone  or  a  busy  signal  

– The  smaller  PDD  the  beeer  

– PDD  <=  1s  

Page 32: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Post  Dial  Delay  

– Cascade  Pilot  views  (sip_ex_01_sig_data.pcap)  •  VoIP  Avg/Max/Min  PDD  Over  Time  

•  VoIP  Avg  PDD  –  Worst  Sources/Callers  •  VoIP  Avg  PDD  –  Worst  DesNnaNons/Receivers  

Page 33: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Voice  Quality  

– Packet  Loss  – Latency  –  Jieer  – R-­‐Factor  – MOS  

Page 34: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Packet  Loss  

– Data  packet  containing  voice  can  be  dropped  •  because  of  a  congesNon  on  Network  •  because  of  a  limited  buffer  size  on  the  receiver        

– The  Packet  Loss  in  a  voice  stream  affects  the  call  quality  

– Packet  Loss  <=  1  %  

Page 35: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Packet  Loss  

– Cascade  Pilot  views  (sip_ex_03._marcello.pcap)  •  VoIP  Call  Summary  –  Packet  Loss  

•  VoIP  Avg/Max/Min  Packet  Loss  Over  Time  –  Send  To  Wireshark  (RTP  outside  conversaNons)  

•  VoIP  Packet  Loss  –  Worst  Sources/Callers  

•  VoIP  Packet  Loss  –  Worst  DesNnaNons/Receivers  •  TransacNon  Analysis  by  VoIP  Call  

Page 36: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Latency  

– The  Latency  is  the  amount  of  Nme  that  takes  for  a  data  packet  to  get  from  a  source  to  a  desNnaNon    

– For  VoIP  the  Latency  is  the  measure  of  the  one-­‐way  delay  between  two  nodes  

– Latency  <=  150  ms  

Page 37: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Jieer  

– The  Jieer  is  the  variaNon  of  the  data  packet  arriving  Nme,  the  variaNon  of  the  data  packet  delay  

–  If  correctly  compensated  with  jieer  buffer  it  does  not  affect  too  much  a  communicaNon  

–  Jieer  <=  20-­‐30  ms  

Page 38: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

Jieer  

– Cascade  Pilot  views  (sip_ex_03._marcello.pcap)  •  VoIP  Call  Summary  –  Jieer  

•  VoIP  Jieer  DistribuNon  

Page 39: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

R-­‐Factor  

– The  R-­‐Factor  is  a  numeric  method  for  compuNng  and  index  of  the  quality  of  a  voice  stream  (E-­‐Model,  ITU-­‐T  RecommendaNon  G.107)  

– The  R-­‐Factor  takes  into  account  •  The  cumulaNve  effect  of  the  used  CODEC  impairments  •  The  Packet  Loss  and  how  it  affects  the  used  CODEC  •  Delay  between  two  consecuNve  voice  data  packets  

– The  R-­‐Factor  ranges  between  50  and  90  – R-­‐Factor  >=  80  

Page 40: VoIP)TroubleshooGng)and)Analysis) · SHARKFEST)ʻ11))|))Stanford)University))|))June)13–16,)2011) VoIP%Signaling%and%Data • Signaling%protocols% – Manage%the%call% • NoNfy%areceiver%for%incoming

SHARKFEST  ‘11    |    Stanford  University    |    June  13–16,  2011  

MOS  

– MOS  (Mean  Opinion  Score)  is  a  numeric  value  that  provides  an  indicaNon  of  the  voice  stream  quality  

– The  MOS  ranges  between  1  (Impossible  to  communicate)  to  5  (Perfect  communicaNon)  

– MOS  >=  4