Bundle LibraryDescription
This bundle provides insight into the state of SIP sessions by mapping all SIP requests to responses for a given SIP call dialog to track and correlate call setups with call teardowns and failures. You will need to assign the SIP-Sessions trigger to one of your SIP gateway servers. If you'd like visibility for multiple gateway servers in different networks we recommend that you duplicate the triggers, change the application name in them, and make a new dashboard for the additional VoIP network segment you'd like to monitor. (See the Installation Instructions below for more info).
As shown in the following image, you can set the trigger to capture SIP calls from either gateway server.
Note: This bundle is configured to filter out Lync chat messages when in a Lync environment. Active call counters are hard coded to reset at 2AM every day in case our session variables that hold them get out of sync.
Bundle Contents
- (2) Triggers
- SIP-SessionsV5 - This trigger makes a new session variable from the SIP INVITE callID+serverIP string. The variable has a default 900 second expire timer; however, the timer updates on subsequent signaling. The trigger has conditional statements that track the call state. Upon receiving a BYE, the variable is removed from the session table. The session table tracks the overall nailed up and torn down call counts through the atomic session.increment functions.
- SIP-SessionsExpiredCalls - This trigger catches all session variables that expire without being being properly torn down or having their timers updated by signaling within 900 seconds. SIP signaling should be seen sporadically, even when a call is setup so the lack of any within 15 minutes indicates we either dropped or never received the BYE for a given INVITE or the INVITE was not for a call but for a chat or other use.
- (1) Record Format
- VoIP CDR
- (1) Query
- MOS < 3.9
- (1) Dashboards
- SIP-Calls
- SIP-Network
Requirements
ExtraHop version 6.0 or later
Note: Your data feed (such as through an ERSPAN, RSPAN, RPCAP, or port mirror) must have data for the SIP protocol.
Installation Instructions
- Download the bundle on this page.
- Log into the ExtraHop Web UI and complete the following procedures, which are available in the ExtraHop Web UI Guide.
- Upload a Bundle
- Apply a Bundle
- Assign a Trigger
- You will need to assign the SIP-SessionsV5 trigger to one of your SIP gateway servers (try to only assign it to one VoIP gateway and not all SIP servers).
- If you would like visibility for multiple gateway servers in different networks see the note below.
- Enable a Trigger
- You will need to enable the SIP-Sessions-ExpiredCalls trigger, but note that the SIP-SessionsV5 trigger will already be enabled by default and just needs to be assigned properly per the instructions above.
- Log into the ExtraHop Admin UI
- In the System Configuration section, click Running Config.
- Click Edit config.
- Scroll to the bottom of the Running Config file
- add the following entry to the end of the sip portion of the 'app_proto' section:
"idle_timeout_classify": 604800* You might need to add the sip section if it does not already exist. Your edit to the sip portion should look similar to the following output: *"sip": { "idle_timeout_classify": 604800 },
- Click Update
- To view the SIP-Calls dashboard, click Dashboards from the top menu and then navigate in the left pane to My Dashboards.
Note: If you would like visibility for multiple gateway servers in different networks we recommend that you follow these steps:
1. Set globalCallID to false in the SIP-SessionsV5 trigger.
2. Duplicate both of the triggers.
3. Change the appName in both of the duplicated triggers.
4. Assign the new SIP-SessionsV5 trigger to a SIP gateway server.
5. Make new dashboards for the additional VoIP network segment that you would like to monitor.
Note: After SIP traffic is received, the triggers in this bundle will build the SIP-App application to hold stats, with protection against counting duplicate calls.
Note: Be cautious when editing the Running Config file, as changes to this file can affect the system configuration. You can read more about the Running Config in the ExtraHop Admin UI Guide or contact ExtraHop Support for assistance.