Analysis of VoIP data using incomplete call information
A method for determining the existence of calls in a VoIP system is disclosed. The present method enables calls that escape detection under known methods to be captured and analyzed, thereby improving the operation of a monitoring component that incorporates the principles disclosed herein. In one embodiment, an undetermined user datagram protocol (“UDP”) data packet is captured. Analysis of the UDP packet is conducted to determine whether the packet conforms to real-time transfer protocol (“RTP”) or real-time transfer control protocol (“RTCP”) protocols that are associated with VoIP calls. If the packet corresponds to RTP or RTCP protocols, further analysis is conducted to determine whether the packet corresponds to an already-identified call. If not, a new call record is created to track the packet and all other packets relating to the call. Analysis of various metrics and other properties of the packet can then be conducted as needed.
1. In a computer system including system memory, a method of detecting data packets relating to a call in a voice-over-IP system, the method comprising:
detecting a data packet of a voice-over-IP call, wherein call signaling data are missing or not detectable or understandable;
determining whether the data packet corresponds to RTP or RTCP protocols including checking a packet version field, a padding bit field, a payload type field, an extension bit; or a length of the packet to determine whether the data packet corresponds to RTP or RTCP protocols;
if the data packet corresponds to RTP or RTCP protocols, determining whether the RTP or RTCP data packet can be associated with a previously identified call; and
if the RTP or RTCP data packet cannot be associated with a previously identified call, creating a call record pertaining to the RTP or RTCP data packet in a call memory.
2. A method of detecting data packets as defined in claim 1 , wherein detecting a data packet further comprises:
detecting a data packet corresponding to the UDP protocol.
3. A method of detecting data packets as defined in claim 2 , further comprising:
determining whether the data packet corresponding to the UDP protocol is unidentified with respect to a port of the computer system.
4. A method of detecting data packets as defined in claim 3 , further comprising:
if the data packet corresponding to the UDP protocol is, resuming detection of succeeding data packets.
5. A method of detecting data packets as defined in claim 1 , further comprising:
analyzing at least one metric of the RTP or RTCP data packet relating to the call record.
6. A method of detecting data packets as defined in claim 1 , further comprising:
if the data packet does not correspond to RTP or RTCP protocols, resuming detection of succeeding data packets.
7. A method of detecting data packets as defined in claim 1 , wherein detecting a data packet is performed by a hardware-based monitoring component.
8. A method of detecting data packets as defined in claim 1 , wherein the voice-over-IP system is at least partially implemented in connection with the Internet.
9. A non-transitory computer program product for use in a computer system including system memory, the computer program product for implementing a method of detecting data packets relating to a call in a voice-over-IP system, the computer program product comprising one or more computer-readable media having stored thereon computer executable instructions that, when executed by a processor, cause the computer system to perform the following:
detect a data packet of a voice-over-IP call, wherein call signaling data are missing or not detectable or understandable;
determine whether the data packet corresponds to RTP or RTCP protocols;
if the data packet corresponds to RTP or RTCP protocols, determine whether the RTP or RTCP data packet can be associated with a previously identified call, wherein determining whether the RTP or RTCP data packet can be associated with a previously identified call includes checking an identified RTCP packet having a specified destination or source port number that is one more than an identified RTP packet stream already listed in the call record is determined to be associated with the call represented by the RTP packet stream; and
if the RTP or RTCP data packet cannot be associated with a previously identified call, create a call record pertaining to the RTP or RTCP data packet in a call memory.
10. A non-transitory computer program product as defined in claim 9 , wherein the computer executable instructions, when executed, cause the computer system to:
detect a data packet corresponding to the UDP protocol.
11. A non-transitory computer program product as defined in claim 10 , wherein the computer executable instructions, when executed, cause the computer system to:
determine whether the data packet corresponding to the UDP protocol is unidentified with respect to a port of the computer system.
12. A non-transitory computer program product as defined in claim 11 , wherein the computer executable instructions, when executed, cause the computer system to:
if the data packet corresponding to the UDP protocol is identified, resume detection of succeeding data packets.
13. A non-transitory computer program product as defined in claim 9 , wherein the computer executable instructions, when executed, cause the computer system to:
analyze at least one metric of the RTP or RTCP data packet relating to the call record.
14. A non-transitory computer program product as defined in claim 9 , wherein the computer executable instructions, when executed, cause the computer system to:
if the data packet does not correspond to RTP or RTCP protocols, resume detection of succeeding data packets.
15. A non-transitory computer program product as defined in claim 9 , wherein the computer executable instructions that, when executed, cause the computer system to detect a data packet are performed by a hardware-based monitoring component.
16. A non-transitory computer program product as defined in claim 9 , wherein the computer executable instructions, when executed, cause the computer system to:
determine the termination of a call corresponding to the data packet by utilizing a timeout procedure.
17. In a computer system including system memory, a method of detecting data packets relating to a call in a voice-over-IP system, the method comprising:
detecting a data packet corresponding to UDP protocol, wherein the data packet is part of a stream of data packets that represents only part of a communication in the voice-over-IP system, wherein call signaling data are missing or not detectable or understandable;
determining whether the UDP data packet corresponds to RTP or RTCP protocols;
if the data packet corresponds to RTP or RTCP protocols, determining whether the RTP or RTCP data packet can be associated with a previously identified call;
if the RTP or RTCP data packet cannot be associated with a previously identified call, creating a call record pertaining to the RTP or RTCP data packet in a call memory; and
determining that when the stream of data packets has been inactive for a specified amount of time that the stream of data packets have been terminated from a source providing the stream of data packets and recording the termination in the cal record.
18. A method of detecting data packets as defined in claim 17 , wherein determining whether the data packet corresponds to RTP or RTCP protocols further comprises:
examining a header of the data packet to determine if the data packet corresponds to RTP or RTCP protocols.
19. A method of detecting data packets as defined in claim 18 , wherein at least one portion of the header is examined, the at least one portion being selected from the group consisting of version, padding, payload type, extension bit, data length, and destination port designation.
20. A method of detecting data packets as defined in claim 18 , wherein examining a header of the data packet further comprises:
determining whether a payload type portion of the header conforms to payload types typically associated with RTP and RTCP packets.
21. A method of detecting data packets as defined in claim 17 , wherein determining whether the RTP or RTCP data packet can be associated further comprises:
examining a destination or source port designation of the RTP or RTCP data packet.
22. A method of detecting data packets as defined in claim 21 , wherein examining a destination or source port designation further comprises:
determining whether at least one of the destination and source port designations of the RTP or RTCP data packet has a value within one of at least one of a destination and source port of a previously identified call.
23. A method of detecting data packets as defined in claim 17 , wherein determining whether the RTP or RTCP data packet can be associated further comprises:
examining source and destination IP addresses of the RTP or RTCP data packet.
24. A method of detecting data packets as defined in claim 17 , wherein determining whether the RTP or RTCP data packet can be associated further comprises:
associating a channel on which the RTP or RTCP data packet is transmitted with a previously identified call.
25. A method of detecting data packets as defined in claim 17 , further comprising:
if the data packet is associated with a previously terminated call, using a timeout procedure to prevent creation of a new call record.
26. A method of detecting data packets as defined in claim 17 , wherein the data packet is associated with a call signaling protocol that is selected from the group consisting of SIP, SCCP, and H 323, and wherein the call is composed of data packets that are transmitted on a plurality of channels.
27. A method of performing analysis of a call as defined in claim 17 , wherein the data packet is associated with a call signaling protocol that is not identifiable by a monitoring component.