Practical application and basic principle of VoIP monitoring system

Absrtact: In recent years, with the development of technology VoIP gradually replaces the traditional long-distance business of the corresponding demand for VoIP business monitoring is also applied.

At present, more equipment is often through the router firewall and other modified but to meet the OC192 wire speed requirements of the equipment is often very high for the entire network of comprehensive monitoring investment is very huge. Therefore, it is a feasible solution to use special algorithms and devices to analyze the network data and to reduce the price of the equipment for the whole network monitoring of VoIP. In this paper, the new algorithm and structure can be used as a reference method for the current network measurement network billing while solving the practical problems.

Key words: VoIP parallel Hardware filtering OC192

I. Overview

Over the past few decades, the internet has been greatly developed with TCP/IP as its core technology and has become a part of everyday life for ordinary people. Network measurement in the early development of the internet did not pay attention to, when the network's designers more attention to enhance the speed of the network, capacity and coverage. With the expansion of the Internet and the complexity of the network structure, the network itself has shown many problems, such as viruses, cyber attacks, spam and so on. The solution of these problems requires us to further understand the basic characteristics of the network and network behavior. However, as a subject with experimental physics nature, network science must depend on the acquisition of the real data of the network, so the measurement and analysis of Internet has become one of the important subjects of network researchers.

The main content of network measurement is to measure the current parameters of the network by using various tools, and analyze it accordingly. There are many classification criteria for network measurement, according to the measuring method, the active measurement and passive measurement are divided into single point measurement and multi point measurement according to the number of measuring points, which can be divided into cooperative measurement and non cooperative measurement according to the knowledge of the surveyors, and the protocols used in the measurement are divided into the measurement based on BGPOSPF and other routing protocols, Based on the measurement of TCP/IP network and Transport layer protocol and the measurement of Application layer protocol based on SNMP,DNS, the measurement can be divided into topological measurement and performance measurement. The parameters in the network can be divided into: availability (availability), loss rate (Loss), Latency (Delay), throughput (throughput) and so on.

With the continuous progress of network technology and the increasing trend of network convergence, the IP network began to carry more and more traditional telecom network and TV online business, meanwhile, the internet has been emerging more and more new business. The measurement of network application has been paid more and more attention by researchers. In particular, the application of VoIP services in Internet network development speed is particularly alarming. VoIP protocols are emerging. Protocols that are now popular on the web include H.323, MGCP, SIP, and SKYPE. VoIP is a typical application of CTI (three networks in one) it uses the existing data network as the base of the host network to encode the traditional telecommunication voice signals and then carry on the data communication on the Internet to complete the speech continuity.

We need to oversee this new type of business for commercial or security purposes. Traditional telecommunication network monitoring because the network is a tree structure and centralized control is very helpful for monitoring but the structure of Internet network exists is net and without centralized control, new equipment is needed to complete supervision and monitoring, which is the starting point of designing VoIP monitoring.

Second, system description and evaluation index

1. System description

A backbone network has n exports in a certain period of time in which the packets flow through the existence of M-Bar VoIP (protocol is endless) after the system black box analysis to get this m call record of the tuple () is the source IP address, destination IP address, source port, destination port, protocol type, creation time, call length.

The difficulty with the problem is that the IETF defines some common ports (well-known port) for many applications to provide an application identity. The identification of different applications can be accomplished by detecting the port number in the network message. At present, most of the practical applications on the network are based on the method of identifying the five tuples (source IP address, source port number, destination IP address, destination port number and protocol number) in IP header only.

However, with the continuous development of Internet technology, especially the wide application of VoIP technology, only the port number identification can not recognize the different applications in the network, these applications are mainly some new applications using streaming media technology. In addition, due to the extensive use of firewalls, more and more applications began to deliberately use a certain range of random or completely random port, in addition, some applications will not only use non-standard ports, and sometimes also intentionally occupy some special ports (such as HTTP 80 port), To achieve the goal of confusing the firewall. As a general rule, the difficulties encountered in the application identification and classification are mainly as follows: The randomization of the port, the hidden application, the continuous emergence of the new application, and the continuous improvement of the network loan.

The analysis of the system can not be carried out in the traditional sense of the five-tuple matching method and must use the higher level of the application layer data analysis.

2. Evaluation indicators

Our goal is to design and implement a new network voice application layer program identification and analysis system, this system has the following characteristics:

(1) wire-speed analysis backbone network data. The basic requirement of the telecommunication grade system is the high stability of the equipment on the backbone network and the stability of the peak flow. This feature guarantees that the device will not affect the overall network, whether it is threaded or connected to the backbone network line in parallel.

(2) The cost price of the hardware and software system. Because of the characteristics of Internet communication, it is necessary to dispatched the whole network in order to monitor the call, so it is very advantageous to reduce the price of unit equipment for the whole system.