Quality Management Suite



Cisco Port Integration Using Port Mirroring


QMS records and monitors telephone calls by sniffing packets traversing across the data network. Packet sniffing is achieved by enabling port mirroring on a data switch and feeding the mirrored port of that switch to the sniffing port on the QMS Call Recording Server. Port Mirroring is supported by most data switches and when enabled, it will send a copy of every packet destined for one port to another port.  For more information on port mirroring, click here.

QMS Setup & Configuration

Working in a Cisco port mirroring environment, the QMS Server must have 2 NIC's.  The primary NIC for a LAN connection must have a static IP address.  The second NIC used as the sniffing port, must have the tcp/ip properties unchecked in the NIC properties area.

Verify the NIC properties by going to Control Panel > Network & Internet > Network Sharing Center > Change Adapter Settings.

The illustration below shows the Properties page.  For the LAN NIC, uncheck Internet Protocol Version 6.  For the Sniffer NIC, uncheck both Internet Protocol Version 6 and Version 4.


The only other Cisco port mirroring specific thing that you need to do to set the PBX type in QMS.  Login to QMS and click on the Services button on the left menu.  The QMS Services page will open.  Highlight the service and click edit.  This will give you the option to select the correct PBX type.  Make sure that you save the changes.

Packet Capturing:

Cisco Unified Call Manager and Call Manager use SCCP, Skinny Call Control Protocol, a proprietary network terminal control protocol that was customized By Cisco for VoIp Call Control. Skinny packets begin and end every call. They provide the call control information that QMS keys on to begin and end the recording of a call. Skinny packets may also appear during a call.

Voice traffic will appear as UDP packets. When decoded as RTP packets, you will be able to see the Codec and Audio Compression Protocol ex: G711 or G729 Codecs.

When you do a packet capture what you should see are a series of Skinny packets followed by the audio payload followed by more Skinny packets.

How to Capture:

1. Open Wireshark

2. On the TOP menu, Click Capture > Interfaces

3. Click on the Start button next to the Sniffer Interface

4. Place the test call, talk for 15 seconds and then hangup

5. Click Capture > Stop

6. In the Filter field atop WireShark enter ip.addr== and hit enter

(Note the 2 = signs)  (Note: input the actual IP address of the test extension)

7. Depending on the size of the capture, it may take several minutes to filter through and

provide you with the capture you are looking for.

8. In figure 1, you can see the beginning of a call; first the Skinny packets and then the UDP packets.

9. The Skinny packets display messages that are interpreted by the QMS Software. Most of these messages are readable.

Ex: Skinny: SoftKeyeventmessage, SetRingerMessage, SetSpeakerModeMessage, CallStateMessage, Stoptone message, OpenReceiveChannel

And while we do not need to know exactly what they mean, their presence is what is important. The above string of Skinny packets indicate an Incoming call. In many cases, these packets will be repeated.

10. The Skinny packets below show that the call has been picked up. Note the Skinny OpenReceiveChannelAck and StartMediaTransmission. Usually they are repeated. When Calls are not being recorded and you see no activity for a user, there is a possibility that Call Recording Server is not receiving Skinny packets.

 11. Here is the end of a call. Note the Skinny CloseReceiveChannel, Stopmediatransmission, Stoptonemessage. The Skinny packets should be associated with the IP address of the phone.

12. Skinny packets are generated by the Cisco Call Manager Publisher or Subscribers. There can be only one publisher but there can be many subscribers. The Call Manager Publisher or Subscriber controlling the extension to be recorded must be mirrored to our sniffer. If you are not seeing Skinny packets, then the Publisher or Subscriber is not functioning or is not being mirrored to us.

13. Insure that the proper Codec is being used to encapsulate the voice traffic. On Wireshark, right click on one of the UDP packets.

Select Decode As from the drop down menu. Scroll down to RTP and click OK. It may take a few minutes to re-filter through.

The end result will be to re-filter the UDP packets into RTP packets which will clearly show the Codec. In this case the Codec displayed is G711.

14. The Line Status message is required for updating the IP address of an agent if they are using DHCP. Line Status messages provide the CallRex Server with the new IP address of an extension. You should see a Line Status Message generated when you reboot the phone or the Cisco Call Manager.


15. Additional Notes

     15.1  Cisco Unified Survivable Remote Site Telephone (SRST) is supported in the Port Mirroring integration

     15.2  The StationLineStatV2Msg is not processed by QMS because the default packet filter for Skinny won't allow this message through.  The default filter looks for tcp[28] == 0x47 but this assumes the packets have no tcp options headers. 

             Modify the filter to allow QMS to process all packets that arrive on port 2000.  In the CallRecordingService.exe.Config file, add  a line in the 'Control' section to modify the filter.  Add:  CCFilter="tcp port 2000".  Save and restart services.  This will cause us to process all skinny traffic so please monitor the CPU usage of the CallRecordingService.  If any issues occur remove this key.

     15.3  In a Cisco / QMS integration, the primary line, line 1 appearance needs to be recordable.

     15.4  On demand recording using ** and ## to turn call recording on and off manually, is supported in this integration. 


 Return to Main Page