Palladion : Tier -2/-3 VoIP monitoring (QoS / SLA)

PALLADION : Pragmatic Passive VoIP monitoring (Signalling & Media).

Introduction       Highlights         Specifications        Performance

IPTEGO designed and built PALLADION VoIP Edition to fulill the special requirements of VoIP Suppliers, Internet Telephony Service Providers (ITSPs) and Voice Peering companies in terms of reliability, optimization and cost savings in SIP networks.

PALLADION is already deployed at a wide range of innovative VoIP Suppliers, ITSPs, Voice Peering and wholesale companies. With the help of IPTEGO they have experienced that monitoring with PALLADION revalues and differentiates their services and maximizes the quality of their customer management.

PALLADION VoIP Edition is designed to be a “companion tool” to the core Next Generation Network (NGN) focused on SIP / pre-IMS networks. It features three powerful processing steps: visibility, detectionand triggering. Each of them is contributing to a high quality service.

The knowledge of existing and future problems leads on the one hand to reducing the load for the User Helpdesks. On the other hand it allows the operator to limit the in-house need of SIP expertise.

Thanks to the open structure and connectivity of PALLADION in the SIP / pre-IMS network it is becoming both the first address for collecting useful data and a central source of continuously reliable information. 

Introduction:

PALLADION makes the job of running SIP based network infrastructure much more straightforward, resulting in much more reliable and predictable SIP based services. PALLADION has a deep and comprehensive understanding of SIP and provides a comprehensive insight into the SIP-based activities of subscribers. It gives service providers highly focused subscriber orientated and service orientated Quality Assurance capabilities. PALLADION understands both SIP messages and the associated media RTP traffic that carries the speech. It is capable of the semantic analysis of SIP messages and understanding the consequential call state for each and every caller, including their registration status. The internal monitoring module listens to each and every packet, and understands whether or not the message is being carried over UDP or TCP. In either case PALLADION re-assembles multi-packet messages into the complete SIP message, which each contains a SIP method or a SIP acknowledgement.

PALLADION can be used for :

• Service Assurance,
• Quality Assurance and
• Revenue Assurance

within the service providers own network or as part of a managed service offering for enterprise customers.Compatible with many flavors of the SIP protocol (“dialects”) and infrastructures (NGN, pre-IMS, IMS) PALLADION taps the signaling traffic rather than sits in-line with signaling flows. PALLADION is configured through an advanced web based user interface to identify both subscriber and system problems, point to root causes and provide significant and relevant diagnostic information making them easy to understand and fix. PALLADION has sophisticated SIP level event capture capability that can be configured via the web interface to identify and capture
worrying events and trends, and then export them, for example, to external trouble ticket systems for further processing. The event filters are highly configurable by the service provider so that issues can be easily identified before they become problems. PALLADION examines many thousands of concurrent SIP signaling streams and from the huge amounts of data generated by even small number of subscribers, extracts the information about events in a very usable, concise and compact form.

In particular the PALLADION alerting system offers a well thought out and implemented configurable Behavioral Analysis capability, providing significant protection for the service provider and its subscribers from specific call patterns & activities. PALLADION's software can readily interface to external systems (including SNMP alerting about SIP events) and export captured information about calls and users to them for further analysis. PALLADION understands and captures SIP call state, enabling it to generate Call Detail Records (CDRs) for billing purposes. These can be exported to external billing systems for the actual generation of a customer bill.



Highlights:

• Response Time Measures system performance to prevent possible service abuse.
• Call Viewer Measures subscriber behavior to detect service abuse.
• User Tracking Monitors and tracks all subscriber SIP events.
• User Agent Statistics Monitors and analyzes statistics for all deployed SIP clients.
• Behavioral Analyses Detects abnormal, faulty, or fraudulent behavior of users.
• Captures and Traces provides detailed statistics to thoroughly investigate service.
• Service Detail Records provides details of service usage parameters.
• Voice Quality monitors the quality of audio streams.

PALLADION features three powerful processing steps in real time:

• Visibility: A core function of PALLADION is to analyze telephony via SIP/pre-IMS and IMS networks in real time, and to detect from a variety of messages and answers what’s going on in the network. Here PALLADION correlates all related raw data and has the ability to examine processes as a whole.

• Detection: PALLADION’s ability to scan the whole network makes it easy to know about existing and future problems. This not only reduces the load for the user help desks but also allows operators to limit the in-house need of SIP expertise.

• Triggering: Through the full visibility of calls and the continuous collection of all information PALLADION is able to generate a reliable Call Detail Records. These can be used as an important source of information for existing on-line billing systems. But as well for off-line correlations with other systems to avoid incorrect entries, and to guarantee a precise end-to-end billing. In addition PALLADION can be used to minimize fraud. By detecting specific call patterns, PALLADION is able to differentiate in real time between normal user behavior patterns and suspicious behavior.

Specifications :

Supported SIP Standards

The following methods are supported by PALLADION: Invite, Register, Update, Options, Subscribe, Notify, Publish, Refer. PALLADION supports a wide range of RFCs and understands many SIP dialects including, for example, SIP-T and associated variants.Intrinsically PALLADION does not inspect and act on anything other than the standard message fields within a SIP method, so if the SIP method is supported, PALLADION can capture and process any fields within the method that may be present.

RFCs supported: 2976, 3204, 3261, 3262, 3550, 4566, 3263, 3264,
3265, 3310, 3311, 3319, 3323, 3325, 3326, 3327, 3428, 3515, 3581,
3840, 3841, 3891, 3892, 3911, 3903, 3968, 3969, 4028, 4244, 4412,
4485, 4508

RTP Analysis
Calculation of MOScqe, R, Jitter and some more values based on the ITU G.107 recommendation (E-Model).

Supported CODECs:
Every narrow-band codec is supported: pcmu, pcma, g711, gsm, g729, g729a, g726-16, g726-24, g726-32, g726-40, g728.

SNMP
GET messages supported for interface statistics (transfered/received bytes, link status etc.), cpu load, memory consumption, uptime, status of key processes.

TRAPS: can be generated by multiple events: counter alert, network element alert, Protocol Counters, User Devices, Behavioral Analysis detection.

Counter Alert: When the condition happens an SNMP trap is created with all details concerning that alert.

Network Element alert: An SNMP trap is generated when PALLADION detects a network element to be down (by OPTIONS monitoring orpassive monitoring).

VRRP
For 1+1 high-availability configurations

Features available through the web interface system:

• Dashboard
 -  Design 
 -  Real time review

• Traces Management
 -  New Trace definition/launch
 -  Review of active and finished Traces
 -  Download of Trace (Pcap)

• Alerts Management
 -  Alert definition;  
      An Alert is triggered by Behavioral Analysis, a Generic counter, a Device counter, a User agent,
the result of a Device monitoring, Authentication
 -  Alert review, Acknowledgment and export (CSV)

• User Tracking 
 -  Search
 -  Accessing registration details
 -  Accessing calls details
 -  User call(s) Export (CSV)

• Scripts Management
 -  Review available scripts
 -  Define scripts execution parameters
 -  Launch script
 -  Review script results, export results (CSV)
 -  Delete script results

• Statistics
 -  Overall counters review/monitoring
 -  Definition of new counter

• Voice Services Health
 -  Voice Quality Tracking
 -  User Devices Tracking
 -  Calls Tracking
 -  Registrations Tracking

• Network Health
 -  Overall Devices activity
 -  Devices (Network Elements) Tracking
 -  Trunks Tracking
 -  CleanBye Management :
         Review of Monitoring configuration (Passive, Options, ICMP monitoring modes)
         Review of history of issues
         Review of Logs
 -  Link Quality Management

• Behavioral Analysis Management
 -  Definition of behaviors to track
 -  Review of behaviors detected

• Configuration and Management
 - Appliance settings
 -  Network settings
 -  Platform settings (Devices, Realms, IP tags)
 -  External systems settings (SNMP, SMTP, FTP, Policy inforcement systems)
 -  User management (including rôle)

CDRs
PALLADION creates Call Data Records (CDR) files in CSV format. The files are placed in the cdr directory for FTP/sFTP pull. PALLADION creates one record (CDR) for each call seen. If the call is visible in different segments, all of them are taken into account for computing the call details, but a single record will be written. The call details are always the same as presented in the web interface. CDR entries are created only for successfully established calls. Failed calls do not appear in the CDR files.

Behavioral Analysis
The following call behaviors can be configured and then identified in real-time: call attempts occurrences in a specified time, multiple occurrences of calls from a same user, low completion rate, calls having call attempts to many users over a certain period of time, low call duration average, high calls cumulated duration, calls closed by the called party at a certain rate. Please consult IPTEGO for the latest behaviors added to this list.

Extension Scripting
Scripts provide an easy way to extend PALLADION with analytical capabilities that are not present in the user interface. Scripts can query information from PALLADION, process this information, and store results in an output table.

Structure of a script:
A valid PALLADION extension script consists of a Python 2.4 module and of a script specification file, that declares the parameters of the script and the schema of the scripts result table. The Python module file and the script specification file must be packed into a ZIP archive, containing no other files and no directories. Such a ZIP
archive can be uploaded to PALLADION. 

Performance

The PALLADION appliance has the capacity of supporting:
• 70.000 SIP messages per second
• An overall traffic of 500Mb/s
• 1.000 concurrent calls (RTP) being analyzed for Quality
• A maximum of 2.000 call attempts/second
• A maximum of 25.000 concurrent calls
• A maximum of 1 Million registered users, with 40000 registrations/second

Hardware Specifications
• 1 U rack‐mounting unit
• <300 W AC power
• 4x10/100/1000BaseT physical ports + VLAN support for collection of data
• 2 Raid disks