Remote monitoring of real-time internet protocol media streams

• US 8,023,419 B2
• Filed: 05/14/2007
• Issued: 09/20/2011
• Est. Priority Date: 05/14/2007
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Oran, David R.
• Primary Examiner(s): Sheikh; Ayaz R
• Assistant Examiner(s): HAMPTON, TARELL A
• Application Number:
  US11/748,379
• Publication Number:
  US 20080285452A1
• Time in Patent Office: 1,590 Days
• Field of Search: 370/241, 370/389, 370/250, 709/230, 379/35
• US Class Current: 370/250
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks

Abstract

In one embodiment, a packet filter (or “trap”) is installed on one or more interfaces of a router, switch (intermediary) or other node in an IP network that identifies multimedia packets for a particular media stream. A packet replicator (or “cloner”) duplicates the identified packets allowing the original packets to continue through the IP network. A forwarder (“tunneler”) encapsulates and sends the cloned media packets to a central facility where the tunneled media stream is further analyzed.

Claims

1. A method comprising:

receiving at least portions of media packets from a media stream, the media packets encapsulated in a tunnel having tunnel headers that include tunnel time stamps that identify approximate times when the media packets are initially trapped at an intermediary node, wherein the media packets include media packet headers including media time stamps that identify when the media packets were generated by a media source;

receiving a first set of sequence numbers in the tunnel headers identifying an order that the media packets are trapped and receiving a second set of sequence numbers in the media packet headers identifying an order that the media packets are output from the media source;

using the first set of sequence numbers to identify the media packets dropped over a first portion of a packet switched network using the second set of sequence numbers to identify the media packets dropped over a second portion of the packet switched network or while being trapped at the intermediary node; and

analyzing the media stream according to where the media packets were dropped.

2. The method according to claim 1, wherein the first portion of the packet switched network extends from the intermediary node to a central media monitor and the second portion of the packet switched network extends from the media source to the intermediary node.

4. The method according to claim 1, further comprising comparing the media packets dropped over the first portion of the packet switched network with the media packets dropped over the second portion of the packet switched network.

5. The method according to claim 4, including receiving the media packets in an Real-Time Protocol (RTP) tunnel that includes an RTP tunnel timestamp and a RTP tunnel sequence number, wherein the RTP media packets in the RTP tunnel include a second RTP timestamp and a second RTP sequence number.

3. A method comprising:

requesting remote monitoring of a media stream;

receiving in response to the request at least portions of media packets trapped from the media stream, the media packets encapsulated in a tunnel having tunnel headers that include tunnel time stamps that identify approximate times when the media packets are trapped at an intermediary node that receives the media packets over a packet switched network from a media source, wherein the media packets include media packet headers include media time stamps that identify when the media packets were generated by the media source;

receiving a reference media stream that includes media packets having headers and payloads;

receiving portions of the encapsulated media packets from the tunnel that only include headers and no payloads;

matching the headers for the media packets in the reference media stream with the headers for the encapsulated media packets from the tunnel; and

combining the payloads from the matching media packets in the reference media stream with the headers for the matching encapsulated media packets from the tunnel.

6. The method according to claim 3 including identifying an ingress or egress interface for trapping the media packets during the remote monitoring.

7. The method according to claim 3, including:

requesting one or more network nodes to locally trap the media packets and tunnel the locally trapped media packets back to a central media monitoring location;

sending flow identifiers to the network nodes identifying the media stream associated with the media packets;

sending tunnel identifiers to the network nodes identifying tunnel address information; and

sending trap information indicating what portions of the trapped media packets to encapsulate in the tunnel.

8. The method according to claim 3, including:

using a first signaling protocol to establish the tunnel; and

using a second signaling protocol to describe both the media stream and the tunnel.

9. An apparatus, comprising:

one or more processors; and

a memory coupled to the one or more processors comprising instructions executable by the processors, the processors operable when executing the instructions to;

capture media packets at an intermediary router or switch node that forwards the media stream from a media source to one or more media stream endpoints;

encapsulate the media packets in tunnel headers that include tunnel time stamps that identify approximate times when the media packets are received at the intermediary router or switch from a media source, wherein the media packets include media packet headers that are encapsulated in the tunnel headers and that include media time stamps that identify when the media packets were generated by the media source;

send the captured media packets encapsulated in the tunnel headers, or portions of the media packets encapsulated in the tunnel headers, to a Network Operation Center (NOC);

include sequence numbers in the tunnel headers that identify what sequence the media packets are trapped by the intermediary router or switch after being received over a packet switched network from the media source; and

encapsulate a second set of sequence numbers in the media packet headers, the second set of sequence numbers identifying an order that the media packets are output from the media source.

10. The apparatus according to claim 9, wherein the media packets are Real-Time Protocol (RTP) media packets, the tunnel time stamps are RTP tunnel time stamps and the media time stamps are RTP media time stamps, wherein the one or more processors identify RTP media packets dropped by the intermediary router or switch receiving the media stream and provide a dropped packet identifier in an RTP tunnel header to identify the packets dropped by the intermediary router or switch.

11. The apparatus according to claim 9, wherein the one or more processors:

conduct a classify stage to identify media streams requested for monitoring;

conduct a trap stage where packets from the identified media streams are captured;

conduct a clone stage where the captured packets are copied; and

conduct a tunnel stage where the copied packets are encapsulated in the tunnel headers and sent via the tunnel to the NOC.

12. The apparatus according to claim 9, wherein the one or more processors:

receive an ingress or egress interface identifier; and

trap the media packets at an ingress or egress interface corresponding with the ingress or egress identifier.

13. The apparatus according to claim 9, wherein the one or more processors receive a compression or filtering message indicating what portions of the captured packets to include or remove prior to being sent to the NOC.

14. A network processing device, comprising a processor configured to:

cause one or more network nodes to capture media packets;

cause the captured media packets to be encapsulated in real-time media headers, wherein the real-time media headers include a first set of time stamps that identify approximate times when the media packets are captured by the network nodes after being received over a packet switched network from a media source, and wherein the real-time media headers encapsulate a second set of media packet headers that include a second set of time stamps that identify when the media packets were generated by the media source, and wherein the real-time media headers include a first set of sequence numbers that identify what order the media packets were captured by the network nodes, and the real-time media headers encapsulate a second set of sequence numbers in the media packet headers that identify an order that the media packets are output from the media source; and

use the first set of sequence numbers in the real-time media headers to identify media packets dropped during transmission over a first portion of the packet switched network and use the second set of sequence numbers to identify the media packets dropped by the network nodes or dropped while the media packets are being transported over a second portion of the packet switched network.

15. The network processing device according to claim 14, wherein the processor uses a Session Initiation Protocol (SIP) to initiate remote monitoring of the media packets by the network nodes and uses a Session Description Protocol (SDP) to identify what media streams to monitor and describe a tunnel for sending the captured media packets.

18. The network processing device of claim 14, wherein the processor is further configured to cause the one or more network nodes to identify one or more media streams and associate the captured media packets with the identified media streams.

16. An apparatus, comprising

a network processing device configured to:

receive a reference media stream from a media source;

receive a tunneled media stream containing a media stream captured by an intermediary network node, the media stream comprising captured packets, wherein the captured packets are encapsulated in a tunnel having tunnel headers including a tunnel sequence number and tunnel time stamps identifying a time when the captured packets were captured by the intermediary network node, wherein the captured packets include packet headers each having a media sequence number and media time stamps that identify when the captured packets were generated by a media source;

identify a portion of a network where packet loss occurred based on an analysis of the tunnel sequence numbers and the media sequence numbers;

identify packets in the reference media stream corresponding with the captured packets in the tunneled media stream;

identifying the captured packets that do not have headers or payloads; and

use the headers or payloads from the corresponding packets in the reference media stream to recreate the media stream originally captured by the intermediary network node.

17. The apparatus of claim 16, wherein the network processing device is further configured to:

request the intermediary network node to locally capture packets and tunnel the locally captured packets back to a central media monitoring location;

send flow identifiers to the intermediary network node identifying a media stream associated with the captured packets;

send tunnel identifiers to the intermediary network node identifying tunnel address information; and

send capture information indicating what portions of the captured packets to encapsulate in the tunneled media stream.