Correlation of media plane and signaling plane of media services in a packet-switched network

• US 10,200,270 B2
• Filed: 04/28/2011
• Issued: 02/05/2019
• Est. Priority Date: 04/28/2011
• Status: Active Grant

• Current Assignee: VOIPFUTURE GmbH (Jan Bastian Asset Management GmbH)
• Original Assignee: VOIPFUTURE GmbH (Jan Bastian Asset Management GmbH)
• Inventors: Scholz, Hendrik, Krueger, Michael, Bastian, Jan, Wallbaum, Michael
• Primary Examiner(s): Donaghue, Larry D
• Assistant Examiner(s): Ngankam, Patrick
• Application Number:
  US14/114,306
• Publication Number:
  US 20140089504A1
• Time in Patent Office: 2,840 Days
• Field of Search: 709224
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/1094 Inter-user-equipment sessions transfer or sharing
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/1106 Call signalling protocols; H.323 and related
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 65/80 Responding to QoS

Abstract

This invention relates to methods for correlating media streams and signaling sessions of services, for example, in a passive monitoring system of a packet-switched network. Furthermore, the invention also relates to an implementation of these methods in hardware and software, and provides a signaling plane probe, a media plane probe and a correlation unit. Moreover, a passive monitoring system comprising one or more of these hardware devices is provided. To correlate media streams and signaling sessions of services, the invention proposes to independently generate correlation keys in a media plane probe for monitored media streams and correlation keys for signaling sessions that are monitored by a signaling plane probe in a fashion that matching correlation keys are generated for a respective service. By identifying reports on the media streams and reports on the signaling session that contain matching correlation keys respectively, the media streams and the signaling streams are correlated in a correlation unit.

Claims

1. A method comprising:

a) providing a signaling plane probe operatively connected to a network for monitoring signaling sessions of different services on the network and generating, for a monitored signaling session of one of said services that is passively monitored by the signaling plane probe, a correlation key for each of at least two directions of media data paths of said monitored service based on information of the signaling session of said monitored service, wherein the at least two correlation keys generated for said monitored service are generated by the signaling plane probe using a timestamp indicative of a point in time at which an end of the respective signaling session of the respective service has been detected by the signaling plane probe and using information on a direction of the respective service;

b) storing, by the signaling plane probe and for each signaling session monitored by the signaling plane probe, a signaling session report in one or more databases, wherein the signaling session report for said monitored signaling session of said one of said services that is passively monitored by the signaling plane probe comprises the at least two correlation keys generated for the at least two directions of the media data paths of said monitored service;

c) providing a media plane probe operatively connected to the network for monitoring media streams on the network of at least one of said media data paths of said one of said services that is monitored by the signaling plane probe and generating for each media stream passively monitored by the media plane probe, a correlation key, wherein the correlation key is generated by the media plane probe using a timestamp indicative of a point in time at which a respective media stream has ended and using information on the media data path of the respective media stream, d) storing, by the media plane probe and for each said media stream being monitored by the media plane probe, a media stream report in the one or more databases, wherein each said media stream report comprises at least the correlation key generated for the respective media stream, and e) providing a correlation unit operatively associated with the one or more databases and adapted for correlating the media streams and the signaling sessions by matching the correlation keys comprised within media stream reports and signaling session reports, respectively.

2. The method according to claim 1, wherein the generation of the respective correlation keys for the respective media streams by the media plane probe is based on the media data path information of the respective media stream and the timestamp indicative of the point in time at which the respective media stream ended.

3. The method according to claim 1 or 2, wherein information on the direction of said one of said services that is passively monitored by the signaling plane probe is information on one or more media data paths of media streams of the said monitored service learned from messages of the signaling session of said monitored service.

4. The method according to claim 1 or 2, further comprising:

f) monitoring, by the signaling plane probe, signaling messages of the respective signaling sessions of the services, and

g) detecting, by the signaling plane probe, media streams belonging to each service associated to a respective monitored signaling session based on the signaling messages of the respective signaling sessions, wherein the at least two correlation keys are generated based on information on the media data path of the media streams belonging to said monitored service associated to one of the signaling sessions and the timestamp indicative of the point in time at which the end of the one signaling session has been detected by the signaling plane probe.

5. The method according to claim 1 or 2, wherein information on a media data path of a media stream is a destination IP address and port number of the media stream.

6. The method according to claim 1 or 2, wherein the timestamps used for the generation of the correlation keys by the signaling plane probe and the media plane probe are rounded before the generation of the correlation keys or have a granularity in the range of one to ten seconds.

7. The method according to claim 1 or 2, wherein the signaling plane probe generates for each direction of said one of said services that is passively monitored by the signaling plane probe at least one correlation key using a timestamp indicative of the point in time at which the end of the respective signaling session of said monitored service has been detected by the signaling plane probe and being rounded to the next lower timestamp value according to a rounding interval, and at least another correlation key using the timestamp indicative of the point in time at which the end of the respective signaling session of the said monitored service has been detected by the signaling plane probe and being rounded to the next higher timestamp value according to the rounding interval.

8. The method according to claim 1 or 2, wherein the media plane probe generates for each media stream at least one correlation key using a timestamp indicative of the point in time at which the respective media ended and being rounded to the next lower timestamp value according to a rounding interval, and at least another correlation key using the timestamp indicative of the point in time at which the respective media stream ended and being rounded to the next higher timestamp value according to the rounding interval.

9. The method according to claim 1 or 2, wherein the correlation of the media streams and the signaling session of the respective services is performed periodically or in response to a query.

10. The correlation device according to claim 1, wherein the correlation keys provided in a respective one of the signaling session reports have been generated using a timestamp indicative of a point in time at which an end of a respective signaling session of a corresponding one of the services has been detected and using information on media streams of said corresponding one of the services.

11. The correlation device according to claim 1, wherein a correlation key provided in a respective one of the media stream reports has been generated using a timestamp indicative of a point in time at which a respective media stream has ended and using information on the media data path of the respective media stream.

12. The correlation device according to claim 1, wherein correlating the media streams and the signaling sessions of said one or more services comprises:

identifying identical correlation keys comprised in respective ones of said media stream reports and comprised in the signaling session reports, wherein identical correlation keys of a one of the media stream reports and one of the signaling session reports yield the media stream of said one media stream report belonging to the same service to which the signaling session of said one signaling session report belongs.

13. The correlation device according to claim 1, wherein the service report comprises information on the service and the quality information of the media streams of the service.

14. The correlation device according to claim 1, wherein correlating the media streams and the signaling sessions of one or more services based on the correlation keys comprised within media stream reports of the media streams and signaling session reports of the signaling sessions comprises:

obtaining from a signaling session report correlation keys identifying the media streams belonging to the same service as the signaling session, and identifying those media stream reports which include one of the correlation keys obtained from the signaling session report.

15. The correlation device according to claim 1, wherein correlating the media streams and the signaling sessions of one or more services based on the correlation keys comprised within media stream reports of the media streams and signaling session reports of the signaling sessions comprises:

obtaining from a media stream report a correlation key identifying the media stream, and identifying a signaling session report among the signaling session reports which includes the same correlation key obtained from the signaling session report.

16. The method correlation device according to claim 1, wherein steps a) and b) are performed periodically for all signaling session reports and media stream reports generated within a configurable time interval, or in response to a request.

17. The correlation device according to claim 1 further comprising:

a) generating at least one correlation key for each direction of a service based on information of the signaling session of the respective service monitored at the signaling plane probe, wherein the correlation keys for a respective service are generated using a timestamp indicative of the point in time at which the end of the respective signaling session of the respective service has been detected by the signaling plane probe and using information on the direction of the respective service;

b) storing, by the signaling plane probe, a signaling session report for each signaling session in a database, wherein each signaling session report comprises the at least two correlation keys generated for the respective directions of the service;

c) generating a correlation key for each media stream monitored by the media plane probe, wherein the correlation key is generated using a timestamp indicative of the point in time at which the respective media stream has ended and using information on the media data path of the respective media stream; and

d) storing, by the media plane probe, a media stream report for each media stream in a database, wherein each media stream report comprises at least the correlation key generated for the respective media.

18. A passive mid-point monitoring apparatus comprising:

a network interface card operatively connected to a packet-switched network for receiving packets of signaling sessions of multiple media services, and a processor adapted to monitor the signaling sessions based on the packets of the signaling sessions received by the network interface card to thereby obtain information on a respective one of the signaling sessions, wherein the processor is further adapted to automatically detect a point in time at which a respective one of said signaling sessions of a respective one of the multiple media services terminates, and wherein the processor is adapted to generate at least one correlation key for each direction of a respective one of said multiple media services based on a timestamp indicative of the detected point in time at which the end of the respective signaling session of the respective one media service has been detected by the processor and based on information on a direction of the respective one media service,

wherein the processor is further adapted to store a signaling session report for each signaling session in a database, wherein each signaling session report comprises correlation keys generated for each direction of the media service.

19. A passive mid-point monitoring apparatus comprising:

a network interface card operatively connected to a packet-switched network for receiving packets of media streams of multiple media services, a processor adapted to monitor the media streams based on the packets of the media streams received by the network interface card to thereby obtain information on a media data path a respective one of the media streams, wherein the processor is further adapted to automatically detect in real-time a point in time at which a respective one of the media streams of a respective one of the media services terminates, and wherein the processor is adapted to generate a correlation key for each media stream monitored by the processor, wherein the correlation key is generated using a timestamp indicative of the detected point in time at which the respective one media stream has ended and using information on a media data path of the respective one media stream, and wherein the processor is further adapted to store a media stream report for each media stream in a database, wherein each said media stream report comprises at least the correlation key generated for the respective media service.

20. A correlation device comprising:

a database access unit adapted to access one or more databases containing signaling session reports for signaling sessions of one or more services generated by a signaling plane probe and media stream reports of media streams of the said one or more services generated by media plane probe, wherein each of the signaling session reports contains at least one correlation key for each direction of a respective one of said one or more services, and each of the media stream reports contains one correlation key indicative of a direction of a media stream of the respective media stream report,

a processor is operatively coupled to the database access unit and adapted to automatically correlate the media streams and the signaling sessions of the one or more services by identifying identical correlation keys comprised within the media stream reports and the signaling session reports to thereby recognize at least two of said media stream reports and one of said signaling session reports belonging to a respective one of said one or more services, and wherein the processor is further adapted to generate a service record for a respective one of said one or more services based on information contained in the media stream reports and based on information contained the signaling session report of said respective one service.

21. A passive monitoring system for correlating media streams and signaling sessions of services in a packet-switched network, comprising:

a signaling plane probe operatively connected to the packet-switched network for monitoring signaling sessions of different services on the network and generating, for a monitored signaling session of one of said services that is passively monitored by the signaling plane probe, a correlation key for each of at least two directions of media data paths of said monitored service based on information of the signaling session of said monitored service, wherein the at least two correlation keys generated for said monitored service are generated by the signaling plane probe using a timestamp indicative of a point in time at which an end of the respective signaling session of the respective service has been detected by the signaling plane probe and using information on a direction of the respective service, the signaling plane probe storing for each signaling session monitored by the signaling plane probe, a signaling session report in one or more databases, wherein the signaling session report for said monitored signaling session of said one of said services that is passively monitored by the signaling plane probe comprises the at least two correlation keys generated for the at least two directions of the media data paths of said monitored service,

a media plane probe operatively connected to the network for monitoring media streams on the network of at least one of said media data paths of said one of said services that is monitored by the signaling plane probe and generating for each media stream passively monitored by the media plane probe, a correlation key, wherein the correlation key is generated by the media plane probe using a timestamp indicative of a point in time at which a respective media stream has ended and using information on the media data path of the respective media stream, the media plane probe storing for each said media stream being monitored by the media plane probe, a media stream report in the one or more databases, wherein each said media stream report comprises at least the correlation key generated for the respective media stream; and

a correlation unit operatively associated with the one or more databases and adapted for correlating the media streams and the signaling sessions by matching the correlation keys comprised within media stream reports and signaling session reports, respectively.