Acme Packet SBC “SIP Monitoring and Trace” Configuration

Diagnosing a troubled SIP call has a tendency to be a real pain. Whether it’s running wireshark, tcpdump, or collecting debugs, having to sort through duplicate packets and attempting to merge different pcap files together does not provide a simple way to troubleshoot a single call while looking at both sides of the call in a single ladder diagram.

Fortunately the Acme Packet SBC now includes a free tool embedded in the code that once enabled, allows it turns the SBC into a SIP capture device. The distinct advantage here is seeing both sides of a call in a single ladder diagram. Even better, extra (and very useful) information is included in between each step of the ladder diagram referencing internal “logic decisions” as they occur as traffic passes through the SBC. Finding a particular capture is easy using Search Filters which allow you to specify just about any criteria.

Pop-up context provides tool tips and additional information about a call depending on what area you are hovering over. It is also possible to export a capture locally so it may be emailed and viewed by others rather than having a variety of users logging into the SBC’s web interface. Alternatively, captures may be exported as ASCII text files with proper and readable formatting of the call information.

---Session Summary---
Startup Time: 2012-04-26 08:40:44.624
State: TERMINATED-200
Duration: 9
From URI: sipp &lt:sip:sipp@172.16.34.10:5060>;tag=25
To URI: sut <sip:service@172.16.34.226:5060>;tag=3453
Ingress Src Address: 172.16.34.10
Ingress Src Port: 5060
Ingress Dest Address: 172.16.34.226
Ingress Dest Port: 5060
Egress Source Address: 192.168.34.226
Egress Source Port: 5060
Egress Destination Address: 192.168.34.17
Egress Destination Port: 5060
Ingress Realm: Access
Egress Realm: Core
Ingress NetworkIf: s0p0
Egress NetworkIf: s1p0

There are three main parts to viewing a captured call. The first is the Session Summary view which contains information such as source and destination IP addresses, URI’s, Realms, etc..

The second viewing pane is SIP Message Details. This is the actual ladder diagram and SBC events.

The third pane is for viewing QoS statistics such as jitter, packet loss, delay, and MOS scores for the specified call.

In order to enable web browser viewing of SIP Monitoring and Trace the web server must be set to the enabled state.

web-server-config
    state               enabled
    inactivity-timeout  5
    http-state          enabled
    http-port           80
    https-state         enabled
    https-port          443
    tls-profile     

The next step is to create one or more filters. In the following example there is a filter called hostedIpPbx and in the user portion of the filter any SIP messages containing the phone number digits 781801 will be captured.

sbc# config t
sbc(configure)# session-router
sbc(session-router)# filter-config
sbc(filter-config)# select
name:
1. Broadsoft
2. Cisco
3. Genesys

selection: 1
sbc#(filter-config)# show
    name            Broadsoft
    address         0.0.0.0
    user            781801 <- Phone prefix NPA-NXX to capture

The next step is to enable sip-monitoring and identify which monitoring filter should be used. Applying the filter here enabled the filter globally on the system. Usually filters are best applied to specific realms or session agents (under monitoring-filters) to capture only interesting traffic.

sbc(sip-minitoring)# show
sip-monitoring
    state               enabled
    monitoring-filters  Broadsoft
    trigger-window      0

In this particular network there are IP phones behind a Cisco ASA firewall which NAT to the public internet and need to register to a BroadWorks SIP softswitch which is being “hidden” behind the SBC.

Below is the capture based on the filter above. Note the phone number starts with 781801xxxx