Call direction detection on SIP IMS
Systems and methods for call direction detection on Session Initiation Protocol (SIP) Internet Protocol (IP) Multimedia Subsystem (IMS) include monitoring SIP register messages, such as “401 UNAUTHORIZED” messages inside the IMS core to detect and log the IP addresses of the Proxy-Call Session Control Function (P-CSCF). The systems and methods include monitoring SIP registration messages; determining and storing addresses of P-CSCFs based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein; monitoring SIP INVITE messages; and, for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs.
1. A non-transitory computer-readable medium having instructions stored thereon for programming a processing device to perform steps of:
monitoring Session Initiation Protocol (SIP) registration messages, by the processing device in a monitoring system that is not involved in exchanging the SIP registration messages and has limited visibility thereof;
determining and storing addresses of Proxy-Call Session Control Functions (P-CSCFs), in a log in the monitoring system, based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein, wherein the determining the addresses of the P-CSCFs is based on Internet Protocol (IP) addresses in 401 UNAUTHORIZED messages of the SIP registration messages, with the cipher or encryption keys therein;
monitoring SIP INVITE messages; and
for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs in the log.
2. The non-transitory computer-readable medium of claim 1 , wherein the monitoring of both the SIP registration messages and the SIP INVITE messages is in an Internet Protocol (IP) Multimedia Subsystem (IMS) core and excludes messages on a Gm interface.
3. The non-transitory computer-readable medium of claim 1 , wherein the monitoring of both the SIP registration messages and the SIP INVITE messages is in any of an Internet Protocol (IP) Multimedia Subsystem (IMS) core and a Gm interface.
4. The non-transitory computer-readable medium of claim 1 , wherein the 401 UNAUTHORIZED messages of the SIP registration messages used for determining the P-CSCFs include only two VIA headers to distinguish between the 401 UNAUTHORIZED messages destined for the P-CSCFs and Interrogating-Call Session Control Functions (I-CSCFs).
5. The non-transitory computer-readable medium of claim 1 , wherein the comparison of address in the SIP INVITE messages determines whether a destination address and/or source address match one of the stored addresses of the P-CSCFs,
wherein when the destination address matches one of the stored addresses, the specific call is a terminating call, and
wherein when the source address matches one of the stored addresses, the specific call is an originating call.
6. The non-transitory computer-readable medium of claim 1 , wherein the steps further include
marking the specific call as mobile terminating if a destination address in the SIP INVITE message matches one of the stored addresses; and
marking the specific call as mobile originating if a source address in the SIP INVITE message matches one of the stored addresses.
7. A method comprising:
monitoring Session Initiation Protocol (SIP) registration messages, by a monitoring system that is not involved in exchanging the SIP registration messages and has limited visibility thereof;
determining and storing addresses of Proxy-Call Session Control Functions (P-CSCFs), in a log in the monitoring system, based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein, wherein the determining the addresses of the P-CSCFs is based on Internet Protocol (IP) addresses in 401 UNAUTHORIZED messages of the SIP registration messages, with the cipher or encryption keys therein;
monitoring SIP INVITE messages; and
for a specific call associated with a SIP INVITE message, determining a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs in the log.
8. The method of claim 7 , wherein the monitoring of both the SIP registration messages and the SIP INVITE messages is in an Internet Protocol (IP) Multimedia Subsystem (IMS) core and excludes messages on a Gm interface.
9. The method of claim 7 , wherein the monitoring of both the SIP registration messages and the SIP INVITE messages is in any of an Internet Protocol (IP) Multimedia Subsystem (IMS) core and a Gm interface.
10. The method of claim 7 , wherein the 401 UNAUTHORIZED messages of the SIP registration messages used for determining the P-CSCFs include only two VIA headers to distinguish between the 401 UNAUTHORIZED messages destined for the P-CSCFs and Interrogating-Call Session Control Functions (I-CSCFs).
11. The method of claim 7 , wherein the comparison of address in the SIP INVITE messages determines whether a destination address and/or source address match one of the stored addresses of the P-CSCFs,
wherein when the destination address matches one of the stored addresses, the specific call is a terminating call, and
wherein when the source address matches one of the stored addresses, the specific call is an originating call.
12. The method of claim 7 , further comprising marking the specific call as mobile terminating if a destination address in the SIP INVITE message matches one of the stored addresses; and
marking the specific call as mobile originating if a source address in the SIP INVITE message matches one of the stored addresses.
13. A processing device in a monitoring system comprising:
one or more processors; and
memory storing instructions that, when executed, cause the one or more processors to obtain monitored Session Initiation Protocol (SIP) registration messages, wherein the monitoring system is not involved in exchanging the SIP registration messages and has limited visibility thereof;
determine and store addresses of Proxy-Call Session Control Functions (P-CSCFs), in a log in the monitoring system, based on the monitoring of the SIP registration messages, wherein P-CSCF addresses are determined from any SIP registration messages having cipher or encryption keys therein, and wherein the addresses of the P-CSCFs are determined based on Internet Protocol (IP) addresses in 401 UNAUTHORIZED messages of the SIP registration messages, with the cipher or encryption keys therein;
obtain monitored SIP INVITE messages; and
for a specific call associated with a SIP INVITE message, determine a direction of the specific call based on a comparison of address in the SIP INVITE messages with the stored addresses of the P-CSCFs in the log.
14. The processing device of claim 13 , wherein the monitored SIP registration messages and the monitored SIP INVITE messages are from an Internet Protocol (IP) Multimedia Subsystem (IMS) core and exclude messages on a Gm interface.
15. The processing device of claim 13 , wherein the monitored SIP registration messages and the monitored SIP INVITE messages are from any of an Internet Protocol (IP) Multimedia Subsystem (IMS) core and a Gm interface.
16. The processing device of claim 13 , wherein the 401 UNAUTHORIZED messages of the SIP registration messages used for determining the P-CSCFs include only two VIA headers to distinguish between the 401 UNAUTHORIZED messages destined for the P-CSCFs and Interrogating-Call Session Control Functions (I-CSCFs).
17. The processing device of claim 13 , wherein the comparison of address in the SIP INVITE messages determines whether a destination address and/or source address match one of the stored addresses of the P-CSCFs,
wherein when the destination address matches one of the stored addresses, the specific call is a terminating call, and
wherein when the source address matches one of the stored addresses, the specific call is an originating call.