SIP-based VoIP Analysis Tool and Lawful Interception

Size: px

Start display at page:

Download "SIP-based VoIP Analysis Tool and Lawful Interception"

Christopher Stephen Porter
7 years ago
Views:

1 SIP-based VoIP Analysis Tool and Lawful Interception 陳懷恩博士助理教授兼資工所所長及計算機中心資訊網路組組長國立宜蘭大學 TEL: # 255

2 Outline SIP Message Analysis Installing Ethereal Getting start Setting Filter Analyzing SIP Call Flow Capturing RTP Packets Using Windows Messenger 5.0 for Example Lawful Interception SIPv6 Analyzer VoIP Monitoring System 2

3 SIP Message Analysis by Using Ethereal

4 Introduction to Ethereal Every network manager at some time or other needs a tool that can capture packets off the network and analyze them. In the past, such tools were either very expensive, proprietary, or both. With the advent of Ethereal, all that has changed. 4

5 Ethereal Features Available for UNIX and Windows. Capture and display packets from any interface on a UNIX system. Display packets captured under a number of other capture programs: tcpdump Network Associates Sniffer and Sniffer Pro NetXray Microsoft Network Monitor Filter packets on many criteria. Colorize packet display based on filters Allow people to add new protocols to Ethereal. 5

6 Download Ethereal Official site: 6

7 Install Ethereal under Windows Install WinPcap. WinPcap is an architecture for packet capture and network analysis for the Win32 platforms. It includes a kernel-level packet filter, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (wpcap.dll, based on libpcap version 0.6.2) This course utilizes Ethereal as an example. You can use higher or the latest version. 7

8 Getting Start

9 Capture Packets by Using Ethereal 開始抓取封包封包列表封包解析封包傾印 9

10 The Capture Preferences Dialog Box 設定抓取介面 ( 網卡 ) 儲存抓取封包至檔案全收模式設定停止條件自動更新視窗自動捲動視窗設定 MAC/IP/port 名稱解析 10

11 Stop after you have collected enough packets 手動結束抓取封包 11

12 File Save As 檔案目錄檔案格式僅儲存做記號的封包檔案名稱 12

13 Show Packet in New Window 13

14 Setting Capture Filters

15 Filtering While Capturing 設定抓取規則 15

Syntax of the tcpdump [not] primitive [and or [not] primitive...] tcp port 23 and host 10.

16 Syntax of the tcpdump [not] primitive [and or [not] primitive...] tcp port 23 and host tcp port 23 and not host tcpdump filter language is explained in the man page. 16

17 Capture SIP Messages (filter: udp port 5060) 17

18 SIP Call Establishment It is simple, which contains a number of interim responses. 18

19 Basic Call Flow 19

20 REGISTER Message 20

21 200 OK Message (REGISTER) 21

22 INVITE Message 22

23 SDP in INVITE Message 23

24 200 OK Message (INVITE) 24

25 SDP in 200 OK Message 25

26 ACK Message 26

27 Capturing the Media Packets

28 RTP Traffic (udp port 9000) What s wrong? Ethereal cannot recognize this port. 28

29 Tools Decode As RTP 29

30 Display Filter 設定顯示規則 30

31 Display Colorize Display 31

32 Emphasize the packets 32

33 Examples for Windows Messenger 5.0

SIP UA Windows Messenger Windows XP 內建 4.7 版最新 5.1 版下載 http://www.microsoft.

34 SIP UA Windows Messenger Windows XP 內建 4.7 版最新 5.1 版下載 s/details.aspx?displaylang=zh- tw&familyid=a8d9eb73-5f8c- 4b9a-940f-9157a3b3d774 34

35 Download Windows Messenger

36 Install Windows Messenger

37 Start up Windows Messenger 37

38 Configuration 38

39 Configuration 39

40 Registration 40

41 Packet Capture- REGISTER Message 41

42 Dialing 42

43 Packet Capture- INVITE Transaction(1) 43

44 Packet Capture- INVITE Transaction (2) 44

45 Ringing 45

46 Termination 46

47 Packet Capture- Termination 47

48 Lawful Interception SIPv6 Analyzer and VoIP Monitoring System

49 SIPv6 Analyzer 問題 : 一般網路分析器沒有針對 VoIP 通話分析之功能貢獻 : 以圖形方式顯示 SIP 訊息流程, 協助使用者快速分析 SIP 網路中所有的節點配合 Jitter Buffer 的設定, 播放已儲存之 RTP 封包成果發表於 Wireless Communication and Mobile Computing 期刊獲得國網盃軟體設計比賽冠軍與日本 IPv6 Appli-Contest 2004 冠軍 49

50 SIP Viewer Call-ID From To (a) SIP Dialog Collection SIP 訊息流程由以下資訊繪出 (a) 來源與目的 IP 位址 (b) SIP 標頭欄位 (e.g., Via and Route) (b) SIP Message Flow 50

51 RTP Spy Yueh-Hsin Sung RTP Session List Video Playback Video and Voice Control Panel Jitter Buffer and Number of Dropped Packets 51

52 VoIP Monitoring System According to the telecommunication requirements, the ITSP (Internet Telephony Service Provider) MUST provide a monitoring mechanism before they provide the VoIP (Voice over IP) Service. A VoIP monitoring system should include the following two functions: providing CDRs (Call Detail Records) providing Wiretap Function We would like to provide the above functions on the NTP (National Telecommunication Program) VoIP platform that is a test-bed for SIP-based VoIP applications. Considering the mobility (device and account roaming) of VoIP, we develop a VoIP Monitoring System in core network to intercept the VoIP calls of a suspect. This system is a plug-in solution that can cooperate with the existing SIP servers. 52

53 System Architecture 53

54 Message Flow SIP Proxy (Monitoring Module) RTP Proxy INVITE c=in IP m=audio 9000 RTP/AVP 0 3.CreateConnection Call-ID m=reveive c=ip4 $ p=$ OK c=rtpproxy p= INVITE @SIP_proxy c=in IP4 rtpproxy m=audio 9002 RTP/AVP OK c=in IP m=audio 8002 RTP/AVP 0 9.Modify Call-ID m: send c=ip p= OK 11.CreateConnection Call-ID m=sendreceive c=rtpproxy p=9000 c=ip4 $ p=$ OK c=in IP rtpproxy m=audio 8000 RTP/AVP OK c=in IP4 rtpproxy p= ACK @SIP_proxy 17.ACK @SIP_proxy RTP Stream-1 RTP Stream-2 54

55 Demonstration 55

56 Thank you for your attention! Q&A 56

Lab Hours. We need to allocate 3 hours in this week for hands-on lab hours ( Nov 13 th 14:10-17:00).

Lab Hours. We need to allocate 3 hours in this week for hands-on lab hours ( Nov 13 th 14:10-17:00). Lab Hours We need to allocate 3 hours in this week for hands-on lab hours ( Nov 13 th 14:10-17:00). 17:00). The instructor will set up the SIP server. Every student will bring a labtop or desktop PC and