REMOTE MONITORING OF REAL-TIME INTERNET PROTOCOL MEDIA STREAMS

• US 20080285452A1
• Filed: 05/14/2007
• Published: 11/20/2008
• Est. Priority Date: 05/14/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Oran, David R.
• Granted Patent: US 8,023,419 B2
• Time in Patent Office: Days
• US Class Current: 370/235
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks

Abstract

In one embodiment, a packet filter (or “trap”) is installed on one or more interfaces of a router, switch (intermediary) or other node in an IP network that identifies multimedia packets for a particular media stream. A packet replicator (or “cloner”) duplicates the identified packets allowing the original packets to continue through the IP network. A forwarder (“tunneler”) encapsulates and sends the cloned media packets to a central facility where the tunneled media stream is further analyzed.

Claims

1. A method comprising:

requesting remote monitoring of a media stream;

receiving in response to the request at least portions of media packets trapped from the media stream, the media packets encapsulated in a tunnel including headers that identify approximate times when the media packets where initially trapped;

decapsulating the trapped media packets; and

arranging and providing the media packets for decoding or further analysis according to the trap times identified in the tunnel headers.

2. The method of claim 1 including:

receiving sequence numbers in the tunnel headers;

using the sequence numbers in the tunnel headers to distinguish between the media packets dropped during tunnel transmission and the media packets lost before or while the media packets were being trapped; and

taking the distinguished types of lost media packets into account when decoding or further analyzing the media stream.

3. The method according to claim 1 including identifying different headers or payload portions of the trapped media packets to either include or not include payloads of encapsulated media packets.

4. The method according to claim 1 including:

receiving a reference media stream that includes media packets having headers and payloads;

receiving portions of the encapsulated media packets from the tunnel that only include headers and no payloads; and

matching the headers for the media packets in the reference media stream with the headers for the encapsulated media packets from the tunnel;

combining the payloads from the matching media packets in the reference media stream with the headers for the matching encapsulated media packets from the tunnel.

5. The method according to claim 1 including receiving the media packets in a Real-Time Protocol (RTP) tunnel that includes a RTP tunnel timestamp and a RTP tunnel sequence number.

6. The method according to claim 5 including receiving RTP media packets in the RTP tunnel that include a second RTP timestamp and a second RTP sequence number.

7. The method according to claim 1 including identifying an ingress or egress interface for trapping the media packets during the remote monitoring.

8. The method according to claim 1 including:

requesting one or more network nodes to locally trap media packets and tunnel the locally trapped media packets back to a central media monitoring location;

sending flow identifiers to the networks nodes identifying the one or more media streams associated with the media packets;

sending tunnel identifiers to the network nodes identifying tunnel address information; and

sending trap information indicating what portions of the trapped media packets to encapsulate in the tunnel.

9. The method according to claim 1 including:

using a first signaling protocol to establish the tunnel; and

using a second signaling protocol to describe both the media stream and the tunnel.

10. An apparatus, comprising:

one or more processors; and

a memory coupled to the one or more processors comprising instructions executable by the processors, the processors operable when executing the instructions to;

receive a request to capture packets from a media stream and send the captured packets to a remote monitoring location;

capture Real-Time Protocol (RTP) media packets at an intermediary router or switch node that forwards the media stream from a media source to one or more media stream endpoints; and

send the captured RTP media packets, or portions of the RTP media packets, to a Network Operation Center (BOC) that is located outside of a primary network path for the media stream.

11. The apparatus according to claim 10 wherein the one or more processors:

encapsulate the media packets in a tunnel header that identifies when the media packets are captured by the intermediary router or switch and in what sequence the media packets are encapsulated and sent over the tunnel to the NOC.

12. The apparatus according to claim 10 wherein the one or more processors identify media packets dropped by the intermediary router or switch receiving the media stream and provide a dropped packet identifier in the tunnel header identify the packets dropped by the intermediary router or switch.

13. The apparatus according to claim 10 wherein the one or more processors:

conduct a classify stage to identify the media streams requested for monitoring;

conduct a trap stage where the packets from the identified media streams are captured;

conduct a clone stage where the captured packets are copied; and

a tunnel stage where the copied packets are encapsulated in the tunnel headers and sent via the tunnel to the NOC.

14. The apparatus according to claim 10 wherein the one or more processors:

receive an ingress or egress interface identifier; and

trap media packets at an ingress or egress interface corresponding with the ingress or egress identifier.

15. The apparatus according to claim 10 wherein the one or more processors receive a compression or filtering message indicating what portions of the captured packets to include or remove prior to being sent to the NOC.

16. A network processing device, comprising

a processor to cause one or more network nodes to identify one or more media streams and capture media packets associated with the identified media streams, the processor further causing the captured media packets to be encapsulated in real-time media headers that allow the processor to recreate the media stream as originally received by the one or more network nodes.

17. The network processing device according to claim 16 wherein the real-time media headers identify when the packets were trapped by the network nodes and identify packets dropped while being sent from the network nodes to the processor.

18. The network processing device according to claim 16 wherein the processor uses a Session Initiation Protocol (SIP) to initiate remote monitoring of the media streams by the network nodes and uses a Session Description Protocol (SDP) to identify what media streams to monitor and describe a tunnel for sending the captured media packets.

19. The network processing device according to claim 16 wherein the processor is configured to:

receive a reference media stream from a media source;

receive a tunneled media stream from one of the network nodes;

identify packets in the reference media stream corresponding with packets in the tunneled media stream; and

use the corresponding packets from the reference media stream and the tunneled media stream to reproduce the media stream as received at one of the network nodes.

20. The network processing device according to claim 19 wherein the processor is configured to:

identifying packets in the tunneled media stream that do not include headers or payloads; and

use the headers or payloads from the corresponding packets in the reference media stream to recreates the media stream originally captured by the network nodes.