Cisco Port Integration Using Port Mirroring
QMS records and monitors telephone calls by sniffing
packets traversing across the data network. Packet sniffing is achieved by
enabling port mirroring on a data switch and feeding the mirrored port of that
switch to the sniffing port on the QMS Call Recording Server. Port Mirroring is supported
by most data switches and when enabled, it will send a copy of every packet destined
for one port to another port. For more information on
port mirroring, click here.
QMS Setup & Configuration
Working in a Cisco port mirroring environment, the QMS Server must have 2 NIC's. The primary NIC for a LAN connection must have a static IP address. The second NIC used as the sniffing port, must have the tcp/ip properties unchecked in the NIC properties area.
Verify the NIC properties by going to Control Panel > Network & Internet > Network Sharing Center > Change Adapter Settings.
The illustration below shows the Properties page. For the LAN NIC, uncheck Internet Protocol Version 6. For the Sniffer NIC, uncheck both Internet Protocol Version 6 and Version 4.
The only other Cisco port mirroring specific thing that you need to do to set the PBX type in QMS. Login to QMS and click on the Services button on the left menu. The QMS Services page will open. Highlight the service and click edit. This will give you the option to select the correct PBX type. Make sure that you save the changes.
Packet Capturing:
Cisco Unified Call Manager and Call Manager use SCCP, Skinny Call Control
Protocol, a proprietary network terminal control protocol that was customized By
Cisco for VoIp Call Control. Skinny packets begin and end every call. They
provide the call control information that QMS keys on to begin and end the
recording of a call. Skinny packets may also appear during a call.
Voice traffic will appear as UDP packets. When decoded as RTP packets, you will
be able to see the Codec and Audio Compression Protocol ex: G711 or G729 Codecs.
When you do a packet capture what you should see are a series of Skinny packets
followed by the audio payload followed by more Skinny packets.
How to Capture:
1. Open Wireshark
2. On the TOP menu, Click Capture > Interfaces
3. Click on the Start button next to the Sniffer Interface
4. Place the test call, talk for 15 seconds and then hangup
5. Click Capture > Stop
6. In the Filter field atop WireShark enter ip.addr==192.168.12.100
and hit enter
(Note the 2 = signs) (Note: input the actual IP address of the test
extension)
7. Depending on the size of the capture, it may take several minutes to filter
through and
provide you with the capture you are looking for.
8. In figure 1, you can see the beginning of a call; first the Skinny packets
and then the UDP packets.
9. The Skinny packets display
messages that are interpreted by the QMS Software. Most of these messages are
readable.
Ex: Skinny: SoftKeyeventmessage, SetRingerMessage, SetSpeakerModeMessage,
CallStateMessage, Stoptone message, OpenReceiveChannel
And while we do not need to know exactly what they mean, their presence is what
is important. The above string of Skinny packets indicate an Incoming call. In
many cases, these packets will be repeated.
10. The Skinny packets below show that the call has been picked up. Note the
Skinny OpenReceiveChannelAck and StartMediaTransmission. Usually they are
repeated. When Calls are not being recorded and you see no activity for a user,
there is a possibility that Call Recording Server is not receiving Skinny packets.
11. Here is the end of a call. Note the Skinny CloseReceiveChannel, Stopmediatransmission, Stoptonemessage. The Skinny packets should be associated with the IP address of the phone.
12. Skinny packets are generated by the Cisco Call
Manager Publisher or Subscribers. There can be only one publisher but there can
be many subscribers. The Call Manager Publisher or Subscriber controlling the
extension to be recorded must be mirrored to our sniffer. If you are not seeing
Skinny packets, then the Publisher or Subscriber is not functioning or is not
being mirrored to us.
13. Insure that the proper Codec is being used to encapsulate the voice traffic.
On Wireshark, right click on one of the UDP packets.
Select Decode As from the drop down menu. Scroll down to RTP and click OK. It
may take a few minutes to re-filter through.
The end result will be to re-filter the UDP packets into RTP packets which will clearly show the Codec. In this case the Codec displayed is G711.
14. The Line Status message is required for updating the IP address of an agent if they are using DHCP. Line Status messages provide the CallRex Server with the new IP address of an extension. You should see a Line Status Message generated when you reboot the phone or the Cisco Call Manager.
15. Additional Notes
15.1 Cisco Unified Survivable Remote Site Telephone (SRST) is supported in the Port Mirroring integration
15.2 The StationLineStatV2Msg is not processed by QMS because the default
packet filter for Skinny won't allow this message through. The default filter
looks for tcp[28] == 0x47 but this assumes the packets have no tcp options
headers.
Modify
the filter to allow QMS to process all packets that arrive on port 2000.
In the CallRecordingService.exe.Config file, add a line in the 'Control'
section to modify the filter. Add: CCFilter="tcp port 2000".
Save and restart services. This will cause us to process all skinny traffic so
please monitor the CPU usage of the CallRecordingService. If any issues occur
remove this key.
15.3 In a Cisco / QMS integration, the primary line, line 1 appearance needs to be recordable.
15.4 On demand recording using ** and ## to turn call recording on and off manually, is supported in this integration.