A Method for Implementing, Simulating and Analyzing a Voice over Internet Protocol Network Bianca Enache Communication Department Politehnica University of Timisoara Timisoara, Romania enache.biancaemilia@gmail.com Irina Giea Global Service Delivery Department Alcatel-Lucent Timisoara, Romania irina.giea@yahoo.com Abstract In the telecommunication domain, the simulation methodology is very important for the researchers because there are many simulation software. This paper presents a method of implementing a Voice over IP network in two steps. The first step is creating a real network, then analyze the call sessions. The second step is simulating the network and analyzing the traffic. Keywords VoIP network, network simulator, call sessions, traffic flow. I. Introduction More and more people need to communicate. Through this direction were implemented many technologies. The Voice over IP (VoIP) is one of them. It allows the user to make/receive a call from/to its telephone or personal computer (PC) using the IP cloud. VoIP comes as an answer to the call users who want to benefit of the same security, speed and quality of service as the network users already have [8-10]. Specific protocols were designed for this new type of network, like Session Initiation Protocol (SIP). Implementing, simulating and analyzing a VoIP network can be done in different ways and using various tools and simulators. In he next chapters, we will present one of this methods[1]. II. tools and simulators To develop our VoIP network, we used the following tools: X-LITE, PBX Manager, Asterisk, Hammer Call Analyzer, GNS3 and Wireshark [6-7]. For the first step, the tools (X-LITE, PBX Manager, Asterisk and Hammer Call Analyzer) are described below. X-LITE is a software that enables a PC to receive or execute telephone calls, calls that can originate from another PC or from an IP telephone. The type of calls are audio, video or both (conferences). You can also send messages towards different devices that supports this service. In order to be able to use this software, the PC has to accomplish several minimum performance conditions: Processor: Intel Core Duo (or its equivalent), Video Card with support for DirectX 9.0c Memory: 2 GB RAM This paper is supported by the Human Resources Development Programme POSDRU/159/1.5/S/137516 financed by the European Social Fund and by the Romanian Government. Space on Hard Disk: 50 MB Operating system: Microsoft XP Service Pack2, Vista (32 or 64 bits), 7 or MAC OS 10.5 Connection: connection to a network (broadband, LAN, wireless), permanent connection to Internet Sound adaptor: Full-duplex, 16 bit or using a USB Headset PBX Manager is a software that depends on Asterisk. It is a graphical management interface which allows the configuration and management of a PC in order for it to act like a conventional PBX (Private Branch Exchange). This software allows the construction of a VOIP PBX with the integration of capabilities and characteristics which can't be found in the PBX conventional systems. Asterisk is an open source program that transforms a PC into a communication server. It is used with PBX systems based on IP, VOIP gateways, conference servers and others. The most important files are extensions.conf and sip.conf. Extensions.conf defines the PBX calling plan for each user. In the sip.conf file we can configure everything that is related with the SIP protocol, like the creation of new users or the definition of the SIP suppliers. Hammer Call Analyzer can discover, isolate and fix signaling or transmission problems. With its help you can visualize what protocols were used, you can correlate call sessions over multiple protocols or domains and you can also visualize and analyze call session flows. The simulation of the network, for the second step, was possible using the GNS3 and Wireshark. GNS3 is a graphical network simulator which allows the simulation of complex networks. In order for it to function, it is dependent on three other programs that must run simultaneous: Dynamips (the core for GNS3 that emulates IOS CISCO images), Dynagen (text-based software that is necessary to Dynamips ) and Qemu (open source emulator and virtualization tool). Wireshark is the most common tool for analyzing the network protocols, fixing the network problems, developing software products and communication protocols. Wireshark captures the traffic of packets in real time but the analyze can be made offline. 109
Fig.2 Case 1 - capture window III. CREATING A REAL VOIP NETWORK In order to create the network, we connected three PCs with a router [2-3]. Each PC is behaving like a telephone, meaning that it can receive or make calls. connecting the PC as a telephone was possible using three software: X-LITE, PBX Manager and Asterisk. For the identification of each PC, we attached an ID number that can be used as a telephone number also. One PC will act as a telephone and also as a PBX station. Because the network is connected to the Internet, each PC will have the IP address of the PBX station. This must not be confused with its own IP address [Fig.1]. The PC that runs as both a telephone and a station is PC3, with the calling number 3002. Each PC has the IP address in the range of 93.115.167.x. In order to study this network from the point of view of the protocols involved, we captured the packets using Hammer Call Analyzer software. In the case of our network, only one PC has this program installed (PC1), which is why the sessions that will be studied, will be initiated only by PC1. There are four windows in the capture program Hammer Call Analyzer as you can see above (from left to right, updown): list of captured packets, call flow with the list of calls and statistics, a detailed list of the protocols used in the sessions, protocol list in hexadecimal format. In the second case, PC1 calls PC3. The caller is announced that PC3 is already in a conversation and receives two choices: it can leave a message which PC3 will receive after it closes the call or it can terminate the session. We can visualize all the steps of a call session in the callflow window. This window presents each command the SIP protocols requires in order to establish a correct call session. In the figure below are shown several statistics for the packets (Ethernet, IP, UDP-User Datagram Protocol) and other information (Fig.3). Fig.3 Protocol statistics Fig.1 The configuration of the real VOIP network For the capturing of the packets we chose three situations. In the first case, PC1 calls PC2 but after a few seconds PC2 is put on hold for 10 sec. during which PC1 calls PC3, a session that also lasts for 10sec. PC1 ends the session with PC3 because it's not answering. PC1 returns to the session created with PC2 and also closes shortly (Fig.2). In the last case, PC1 calls PC2. PC2 answers and talks for 10sec. PC2 then puts on hold PC1 and calls PC3. PC3 answers and talks for 10sec. before closes. PC2 returns to the call with PC1 and closes after a short time. Because the calls go through the PBX station PC3, the IP addresses for the called PCs will not be showed (Fig.4). Fig.4 Case 3 - call flow 110
IV. SIMULATING THE VOIP NETWORK For the simulation we used a router from the 1700 platform and three PCs. For the router to be accepted by the program IOS images had to be loaded as well as configuring each PC to accept connections towards the router. GNS3 has five windows were you can see the devices available to create a network, the network implementation area, a console that can be used as a telnet, a summary of the network topology and a window with the packet captures that are running (Fig.5). Fig. 5 The network topology Both router and the PCs have special menus where you can modify certain information. Once the network is created and works, you can proceed to analyze it with Wireshark. To start the capture of packets, you need to right-click on any connection and select "Start Wireshark". All of the captures are for the traffic between the router and PC2 (Fig.6). Fig.7 Capture menu In the Analyze menu you can select and visualize the filters, you can see the TCP (Transmission Control Protocol), UDP or SSL (Secure Socket Layer) flows and you can validate protocols. One of the most important menus is the Statistics menu. The first option you can select presents a summary of the capture that is running. There you can find information about the topology's name, the encapsulation that is used or the size limit of the packets. Also, you can see when the first and the last packet arrived and the duration between these packets. The summary also presents information about the traffic (Fig.8). Fig.6 Packet capture between router and PC2 The most revealing actions that can be taken to analyze a network are the ones from the menus: capture, analyze statistics and telephony (when using the virtual models for IP telephones). The capture of packets depends on different options. You can choose the interface you are using for the capture, you can select the filter meaning that only the packets that are passing through the filer will be captured (Fig. 7). Fig.8 Statistics menu - Flow graph To see the protocol hierarchy used by this network, the conversations that were captured, the input-output graphic of the data and the traffic analysis, we used the interface between the router and PC2 (Fig. 9). 111
select on X axe the packets by their hour, minute or second when their appeared (Fig. 12). Fig. 12 Input-Output traffic graphic Fig.9 Protocol hierarchy statistics The conversations between these devices are of two types: Ethernet and UDP [4-5]. Both present the number of sessions captured and the number of packets, their size and the direction from which they were captured. The traffic analyze depends on the selected options from the Statistics menu-flow graph (Fig. 8). Once they are selected the window from figure Fig.13 will appear. There we can observe each message that was received by the two devices. For this analysis we chose the TCP flows with the standard addresses for the source and destination. Each message received is detailed in the right side of the window (Fig.13). Fig. 10 Ethernet sessions The difference is that the UDP session also presents the port number of the device involved and the IP addresses of the devices (Fig. 11). Fig. 13 Traffic analysis V. CONCLUSIONS Implementing the network using this method reflects many advantages. The tools and simulators are both used by the researchers and in the engineering field. The analyzers work in real-time but the troubleshooting can be done in offline mode. The capture of packets offers an accuracy of milliseconds for each packet. Using this network model, the same principle can be applied to various network sizes from a company s intranet to a city s Metropolitan Access Network (MAN). Fig. 11 UDP sessions The window opened to visualize the input-output graphic of the traffic has options for choosing the filter. You can also modify the axes of the graphic. The axe X is the time axe and has a range between a few milliseconds and a few minutes. The Y axe can linear, logarithmic or automatic. You can also Acknowledgment This paper is supported by the Human Resources Development Programme POSDRU/159/1.5/S/137516 financed by the European Social Fund and by the Romanian Government. References [1] J. Davidson, J.Peters and Brian Gracely, Voice over IP Funtamentals, Cisco Press, March 2000 112
[2] A. M. Law and W. D. Kelton, Simulation modelling and analysis, thirded. New York: McGraw-Hill, 2000. [3] E. K. Bowdon, "Using simulation to evaluate system performance "presented at Proceedings of the 11th workshop on Design automation1974, pp. 359-365. [4] B. Goode, Voice over Internet Protocol(VoIP), Proceedings of the IEEE, vol.90, 2002, pp.1495-1517. [5] J. J. Yi and D. J. Lilja, "Simulation of computer architectures:simulators, benchmarks, methodologies and recommendations," IEEETransaction on Computers, vol. 55, no. 3, pp. 268-280, 2006. [6] Thomas P., H.323 Mediated Voice over IP: Protocols, Vulnerabilities; Remediation, updated 2 November 2010, [online] Available: http://www.symantec.com/connect/articles/h323- mediated-voice-overip-protocols-vulnerabilitiesamp-remediation [7] Florian Fankhauser, at. al., Security Test Environment for VoIP Research, International Journal for Information Security Research (IJISR), 1(1/2), Pages 53-60, (2011). [8] Park P, Voice over IP security, Cisco Press, (2009). [9] R. G. Cole and J. H. Rosenbluth, Voice over IP performance monitoring, SIGCOMM Computer Communnication Review, vol. 31, pp. 97 24, 2011 [10] H. P. Singh, S. Singh, J. Singh, and S. A. Khan, VoIP: state of art for global connectivity a critical review, Journal of Network and Computer Applications, vol. 37, no. 1, pp. 365 379, 2014. 113