System and method for end-to-end communications tracing

• US 7,209,548 B2
• Filed: 07/09/2004
• Issued: 04/24/2007
• Est. Priority Date: 06/15/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Firestone, Scott S., Ethier, Randall P. J., Hammer, Michael P.
• Primary Examiner(s): TRAN, QUOC DUC
• Application Number:
  US10/888,905
• Publication Number:
  US 20050276388A1
• Time in Patent Office: 1,019 Days
• Field of Search: 379/32.01, 379/32.02, 379/32.03, 379/32.04, 379/32.05, 379/112.06, 379/112.07, 379/112.08, 379/114.01, 379/126, 379/133, 379/134, 379/135, 379/137, 379/138, 379/139, 379/140, 379/207.02, 379/207.04, 379/229
• US Class Current: 379/32.05
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04M 3/2254 in networks
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/0084 Network monitoring; Error detection; Error recovery; Network testing
• CPC Class Codes: H04M 7/009 in systems involving PBX or KTS networks
• CPC Class Codes: H04Q 3/0025 Provisions for signalling
• CPC Class Codes: H04Q 3/0087 Network testing or monitoring arrangements

Abstract

A method for tracing communications includes receiving trace criteria from a first remote element and determining whether a call signaling message matches the trace criteria. The method includes attaching a trace tag to the call signaling message, if the call signaling message matches the trace criteria. The method further includes transmitting the call signaling message to a second remote element.

Claims

1. A method of tracing communications, comprising:

receiving a trace trigger request from a management node, the trace trigger request comprising a unique identifier, a trace start time, a trace stop time, and trace criteria;

receiving a call signaling message;

determining whether a current time is between the trace start time and the trace stop time;

if the current time is between the trace start time and the trace stop time, determining whether the call signaling message matches the trace criteria; and

attaching a trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag comprising the unique identifier.

2. The method of claim 1, wherein receiving the trace trigger request further comprises receiving the unique identifier, wherein the unique identifier comprises:

a requestor domain name specifying a domain of the management node; and

a requestor identifier specifying an address of the management node with the domain; and

further comprising transmitting a trace report to the management node based on the requestor domain name and the requestor identifier.

3. The method of claim 1, wherein receiving the trace trigger request further comprises receiving the unique identifier, wherein the unique identifier comprises:

a request identifier specifying trace parameters from which the trace trigger request was generated; and

a request time specifying a time at which the management node received the trace parameters; and

further comprising transmitting a trace report to the management node that includes the request identifier and the request time.

4. The method of claim 1, wherein receiving the trace trigger request further comprises receiving the trace trigger request at a tracing node, and wherein the unique identifier comprises a trace sequence number associated with the tracing node.

5. The method of claim 1, wherein attaching a trace tag to the call signaling message further comprises attaching a call identifier to the call signaling message, and wherein the call identifier uniquely identifies a call with which the call signaling message is associated.

6. The method of claim 1, wherein the trace criteria includes trace parameter criteria, the trace parameter criteria identifying a parameter and a parameter value, and wherein determining whether the call signaling message matches the trace criteria comprises determining whether the identified parameter of the call signaling message matches the identified parameter value.

7. The method of claim 1, wherein the trace criteria includes trace sub-parameter criteria, the trace sub-parameter criteria identifying a sub-parameter and a sub-parameter value, and wherein determining whether the call signaling message matches the trace criteria further comprises determining whether the identified sub-parameter of the call signaling message matches the identified sub-parameter value.

8. The method of claim 1, wherein the trace criteria includes a trace message type and wherein determining whether the call signaling message matches the trace criteria further comprises determining whether a message type of the call signaling message matches the trace message type.

9. The method of claim 1, wherein the trace criteria includes a trace protocol type and wherein determining whether the call signaling message matches the trace criteria further comprises determining whether a protocol type of the call signaling message matches the trace protocol type.

10. The method of claim 1, wherein the trace criteria further includes a trace event trigger that specifies a condition, and wherein determining whether the call signaling message matches the trace criteria further comprises:

determining whether the trace event trigger is satisfied; and

determining, if the trace event trigger is satisfied, whether the call signaling message matches the trace criteria.

11. The method of claim 1, wherein attaching the trace tag further comprises:

initializing a trace call counter, and

attaching the trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag including the trace call counter.

12. The method of claim 1, wherein the trace trigger request further comprises trace scope parameters that identify a protocol stain;

and wherein attaching the trace tag further comprises attaching the trace tag to the call signaling message if the call signaling message matches the trace criteria and a protocol of the call signaling message matches the protocol stain.

13. The method of claim 1, wherein the trace trigger request further comprises trace scope parameters that identify a report protocol;

and further comprising transmitting a report to a remote element if the call signaling message matches the trace criteria and the protocol of the call signaling message matches the report protocol.

14. The method of claim 1, wherein the trace trigger request further comprises a frequency indicator and wherein receiving a call signaling message comprises receiving a plurality of call signaling messages and wherein attaching the trace tag to the call signaling message further comprises attaching the trace tag to particular call signaling messages that match the trace criteria at a frequency determined based on the frequency indicator.

15. A device for tracing communications, comprising:

a management interface module operable to receive a trace trigger request from a management node, the trace trigger request comprising a unique identifier, a trace start time, a trace stop time, and trace criteria;

a call control module operable to receive a call signaling message;

a filter module operable to;

determine whether a current time is between the trace start time and the trace stop time; and

if the current time is between the trace start time and the trace stop time, determine whether the call signaling message matches the trace criteria; and

a tagging module operable to attach a trace tag to the call signaling message if the filter module determines that the call signaling message matches the trace criteria, the trace tag comprising the unique identifier.

16. The device of claim 15, wherein the unique identifier comprises:

a requestor domain name specifying a domain of the management node; and

a requestor identifier specifying an address of the management node with the domain; and

further comprising a reporting module operable to transmit, if the call signaling message matches the trace criteria, a trace report to the management node based on the requestor domain name and the requestor identifier.

17. The device of claim 15, wherein the unique identifier comprises:

a request identifier specifying trace parameters from which the trace trigger request was generated; and

a request time specifying a time at which the management node received the trace parameters; and

further comprising a reporting module operable to transmit a trace report to the management node that includes the request identifier and the request time.

18. The device of claim 15, wherein the management interface module is further operable to receive the trace trigger request that includes the unique identifier, wherein the unique identifier comprises a trace sequence number associated with the device.

19. The device of claim 15, wherein the tagging module is further operable to attach a trace tag to the call signaling message by attaching a call identifier to the call signaling message, and wherein the call identifier uniquely identifies a call with which the call signaling message is associated.

20. The device of claim 15, wherein the trace criteria includes trace parameter criteria, the trace parameter criteria identifying a parameter and a parameter value, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified parameter of the call signaling message matches the identified parameter value.

21. The device of claim 15, wherein the trace criteria includes trace sub-parameter criteria, the trace sub-parameter criteria identifying a sub-parameter and a sub-parameter value, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified sub-parameter of the call signaling message matches the identified sub-parameter value.

22. The device of claim 15, wherein the trace criteria includes a trace message type and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether a message type of the call signaling message matches the trace message type.

23. The device of claim 15, wherein the trace criteria includes a trace protocol type and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether a protocol type of the call signaling message matches the trace protocol type.

24. The device of claim 15, wherein the trace criteria further includes a trace event trigger that specifies a condition, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by:

determining whether the trace event trigger is satisfied; and

determining, if the trace event trigger is satisfied, whether the call signaling message matches the trace criteria.

25. The device of claim 15, wherein the tagging module is further operable to attach the trace tag by:

initializing a trace call counter, and

attaching the trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag including the trace call counter.

26. The device of claim 15, wherein the trace trigger request further comprises trace scope parameters that identify a protocol stain;

and wherein the tagging module is further operable to attach the trace tag by attaching the trace tag to the call signaling message, if the call signaling message matches the trace criteria and a protocol of the call signaling message matches the protocol stain.

27. The device of claim 15, wherein the trace trigger request further comprises trace scope parameters that identify a report protocol, and wherein the tagging module is further operable to transmit a report to a remote element, if the call signaling message matches the trace criteria and the protocol of the call signaling message matches the report protocol.

28. The device of claim 15, wherein:

the trace trigger request further comprises a frequency indicator;

the call control module is operable to receive a call signaling message by receiving a plurality of call signaling messages; and

the tagging module is operable to attach the trace tag to the call signaling message by attaching the trace tag to particular call signaling messages that match the trace criteria at a frequency determined based on the frequency indicator.

29. A computer program stored on a computer readable medium, the computer program operable when executed to:

receive a trace trigger request from a management node, the trace trigger request comprising a unique identifier, a trace start time, a trace stop time, and trace criteria;

receive a call signaling message;

determine whether a current time is between the trace start time and the trace stop time;

if the current time is between the trace start time and the trace stop time, determine whether the call signaling message matches the trace criteria; and

attach a trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag comprising the unique identifier.

30. The computer program of claim 29, wherein the computer program is further operable to receive the trace trigger request by receiving the unique identifier, wherein the unique identifier comprises:

a requestor domain name specifying a domain of the management node; and

a requestor identifier specifying an address of the management node with the domain; and

wherein the computer program is further operable to transmit, if the call signaling message matches the trace criteria, a trace report to the management node based on the requestor domain name and the requestor identifier.

31. The computer program of claim 29, wherein the computer program is further operable to receive the trace trigger request by receiving the unique identifier, wherein the unique identifier comprises:

a request identifier specifying trace parameters from which the trace trigger request was generated; and

a request time specifying a time at which the management node received the trace parameters; and

wherein the computer program is further operable to transmit a trace report to the management node that includes the request identifier and the request time.

32. The computer program of claim 29, wherein the computer program is further operable to receive the trace trigger request by receiving the trace trigger request at a tracing node and wherein the unique identifier comprises a trace sequence number associated with the tracing node.

33. The computer program of claim 29, wherein the computer program is further operable to attach a trace tag to the call signaling message by attaching a call identifier to the call signaling message, and wherein the call identifier uniquely identifies a call with which the call signaling message is associated.

34. The computer program of claim 29, wherein the trace criteria includes trace parameter criteria, the trace parameter criteria identifying a parameter and a parameter value, and wherein the computer program is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified parameter of the call signaling message matches the identified parameter value.

35. The computer program of claim 29, wherein the trace criteria includes trace sub-parameter criteria, the trace sub-parameter criteria identifying a sub-parameter and a sub-parameter value, and wherein the computer program is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified sub-parameter of the call signaling message matches the identified sub-parameter value.

36. The computer program of claim 29, wherein the trace criteria includes a trace message type and wherein the computer program is further operable to determine whether the call signaling message matches the trace criteria by determining whether a message type of the call signaling message matches the trace message type.

37. The computer program of claim 29, wherein the trace criteria includes a trace protocol type and wherein the computer program is further operable to determine whether the call signaling message matches the trace criteria by determining whether a protocol type of the call signaling message matches the trace protocol type.

38. The computer program of claim 29, wherein the trace criteria further includes a trace event trigger that specifies a condition, and wherein the computer program is further operable to determine whether the call signaling message matches the trace criteria by:

determining whether the trace event trigger is satisfied; and

determining, if the trace event trigger is satisfied, whether the call signaling message matches the trace criteria.

39. The computer program of claim 29, wherein the computer program is further operable to attach the trace tag by:

initializing a trace call counter, and

attaching the trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag including the trace call counter.

40. The computer program of claim 29, wherein the trace trigger request further comprises trace scope parameters that identify a protocol stain;

and wherein the computer program is further operable to attach the trace tag by attaching the trace tag to the call signaling message, if the call signaling message matches the trace criteria and a protocol of the call signaling message matches the protocol stain.

41. The computer program of claim 29, wherein the trace trigger request further comprises trace scope parameters that identify a report protocol, and wherein the computer program is further operable to transmit a report to a remote element, if the call signaling message matches the trace criteria and the protocol of the call signaling message matches the report protocol.

42. The computer program of claim 29, wherein the trace trigger request further comprises a frequency indicator, and wherein the computer program is operable to:

receive a call signaling message by receiving a plurality of call signaling messages; and

attach the trace tag to the call signaling message by attaching the trace tag to particular call signaling messages that match the trace criteria at a frequency determined based on the frequency indicator.

43. A system for tracing communications, comprising:

a management node, operable to transmit trace trigger requests to one or more remote elements; and

a tracing node, comprising;

a management interface module operable to receive a trace trigger request from a management node, the trace trigger request comprising a unique identifier a trace start time, a trace stop time, and trace criteria;

a call control module operable to receive a call signaling message;

a filter module operable to;

determine whether a current time is between the trace start time and the trace stop time; and

if the current time is between the trace start time and the trace stop time, determine whether the call signaling message matches the trace criteria; and

a tagging module operable to attach a trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag comprising the unique identifier.

44. The system of claim 43, wherein the unique identifier comprises:

a requestor domain name specifying a domain of the management node; and

a requestor identifier specifying an address of the management node with the domain; and

wherein the tracing node further comprises a reporting module operable to transmit, if the call signaling message matches the trace criteria, a trace report to the management node based on the requestor domain name and the requestor identifier.

45. The system of claim 43, wherein the unique identifier comprises:

a request identifier specifying trace parameters from which the trace trigger request was generated; and

a request time specifying a time at which the management node received the trace parameters; and

wherein the tracing node further comprises a reporting module operable to transmit a trace report to the management node that includes the request identifier and the request time.

46. The system of claim 43, wherein the management interface module is further operable to receive the trace trigger request that includes the unique identifier, wherein the unique identifier comprises a trace sequence number associated with the device.

47. The system of claim 43, wherein the tagging module is further operable to attach a trace tag to the call signaling message by attaching a call identifier to the call signaling message, and wherein the call identifier uniquely identifies a call with which the call signaling message is associated.

48. The system of claim 43, wherein the trace criteria includes trace parameter criteria, the trace parameter criteria identifying a parameter and a parameter value, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified parameter of the call signaling message matches the identified parameter value.

49. The system of claim 43, wherein the trace criteria includes trace sub-parameter criteria, the trace sub-parameter criteria identifying a sub-parameter and a sub-parameter value, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether the identified sub-parameter of the call signaling message matches the identified sub-parameter value.

50. The system of claim 43, wherein the trace criteria includes a trace message type and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether a message type of the call signaling message matches the trace message type.

51. The system of claim 43, wherein the trace criteria includes a trace protocol type and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by determining whether a protocol type of the call signaling message matches the trace protocol type.

52. The system of claim 43, wherein the trace criteria further includes a trace event trigger that specifies a condition, and wherein the filter module is further operable to determine whether the call signaling message matches the trace criteria by:

determining whether the trace event trigger is satisfied; and

determining, if the trace event trigger is satisfied, whether the call signaling message matches the trace criteria.

53. The system of claim 43, wherein the tagging module is further operable to attach the trace tag by:

initializing a trace call counter, and

attaching the trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag including the trace call counter.

54. The system of claim 43, wherein the trace trigger request further comprises trace scope parameters that identify a protocol stain;

and wherein the tagging module is further operable to attach the trace tag by attaching the trace tag to the call signaling message, if the call signaling message matches the trace criteria and a protocol of the call signaling message matches the protocol stain.

55. The system of claim 43, wherein the trace trigger request further comprises trace scope parameters that identify a report protocol, and wherein the tagging module is further operable to transmit a report to a remote element, if the call signaling message matches the trace criteria and the protocol of the call signaling message matches the report protocol.

56. The system of claim 43, wherein:

the trace trigger request further comprises a frequency indicator;

the call control module is operable to receive a call signaling message by receiving a plurality of call signaling messages; and

the tagging module is operable to attach the trace tag to the call signaling message by attaching the trace tag to particular call signaling messages that match the trace criteria at a frequency determined based on the frequency indicator.

57. A system of tracing communications, comprising:

means for receiving a trace trigger request from a management node, the trace trigger request comprising a unique identifier, a trace start time, a trace stop time, and trace criteria;

means for receiving a call signaling message;

means for determining whether a current time is between the trace start time and the trace stop time;

means for determining, if the current time is between the trace start time and the trace stop time, whether the call signaling message matches the trace criteria; and

means for attaching a trace tag to the call signaling message if the call signaling message matches the trace criteria, the trace tag comprising the unique identifier.