Signaling Packet Capture Tool tip

The Signal Packet Capture tool can potentially cause a Link Detection Group (LDG) failure due to how the tool manipulates the NIC and associated NP rules. To avoid this, Ribbon recommends to increase the LDG timer values.

  • Response Timer—Double the response timer to 1000 ms (from 500 ms).
  • Retries—Increase the retry count by 1 (default is 3).

Additionally, you can increase the LDG's threshold value to 2 (default) so that even if an echo response is delayed and the link monitor fails, the LDG does not go into a failed state and attempt to trigger a switchover upon an initial failure.


In this section:

Related article:

Call Trace Filtering

The SBC supports configuring Call Trace Filters using the Signaling Packet Capture command to establish criteria to determine call events and logging PES call trace messages (using the ".TRC" file extension) to the system trace data event log. This information is used for debugging policy and call routing issues.

The following default information is collected during a call trace:

  • Service group configuration
  • DSP T.38 event information, if applicable
  • DSP channel statistics
  • DEBUG/SYS log information

The first three Call Trace filters are automatically logged unless the stopMatch flag in enabled, whereby the number of filters logged may be less than three. The stopMatch flag will halt filter profile matching once a match is found.

When call trace filter criteria is provisioned and a call meets the criteria, trace information is written to a tracing file. Call trace is enabled using the provisioning interface.A callTraceTimer configuration is provided along with the maxTriggerCount configuration to limit the logging of call/error filter events in the TRC file. The SBC may be configured to stop call tracing if either of following criteria is met:

  • Configured maxTriggerCount is reached or,
  • Configured callTraceTimer expires

The maxTriggerCount parameter is used to set/reset the Trigger Count, a mechanism used to limit the logging of call/error filter events in the .TRC file.

Note

A system reboot, an application restart or a Live Software Upgrade (LSWU) causes the following call trace filters to go offline:

  • callFilter
  • mediaPacketCapture
  • signalingPacketCapture

To rectify this, disable and then reenable the applicable filters using the following CLI command syntax: 

% set global callTrace signalingPacketCapture state disable 
% set global callTrace signalingPacketCapture state enable
% set global callTrace callFilter <filterName> state disabled
% set global callTrace callFilter <filterName> state enabled
% set global callTrace callFilter <filterName> mediaPacketCapture disable
% set global callTrace callFilter <filterName> mediaPacketCapture enable
Note

As a general rule, set Call Trace to ingress mode unless egress mode is mandatory. 

Warning

Do not turn on the call trace filter to trace all calls unless using level4. The use of the Call Trace feature at other levels significantly impacts the SBC system's network performance. Ribbon strongly recommends configuring Call Filters, which result in small quantities of calls being traced to avoid heavy loads. Also, be sure to delete Call Trace Filters once you have obtained the necessary information.


Use the following criteria to establish a Call Trace Filter:

  • Called Party Number
  • Calling Party Number
  • Contractor Number
  • Peer IP Address
  • Redirecting Number
  • Transfer Capability
  • Trunk Group

Use the match keyword to specify criteria to use to capture call data upon a match. Use the key keyword to specify criteria on which to filter call data.
Call events captured are:

  • Call attempt
  • Lookup request sent
  • Lookup request received
  • Alerting received
  • Cut-through received
  • Call Answer received
  • Cut-through complete
  • Service established
  • Disconnect Request received
  • Call terminated
  • Wait for more digits
  • Extra digits received
  • Initiating new attempt
  • Signal messages received or sent
  • Egress call setup message
  • Route lookup failure
  • Call blocked
  • Policy Request
  • Policy Response
  • Policy processing of calls in different layers like pre-processor, services, pre-router, router, and post-router.
  • SIP signaling events for a single call incoming/outgoing to a particular source/destination IP endpoint
  • SIP Protocol Data Units (PDUs) for a single call incoming/outgoing from/to a particular source/destination IP endpoint
  • SIP out-of-dialog PDUs such as 18X, BYE, and INFO, regardless of whether they are successfully parsed

The TRC event log level must be info for this facility to operate properly.

Use the maxTriggerCount parameter to limit the logging of call/error filter events in the .TRC file. After configuring and enabling the callFilter, an ingress/egress call that matches the filter criteria causes the corresponding events to be logged to the .TRC file, as long as the Trigger Count has not been reached. Once the configured Trigger Count has been reached, the matching callFilter will not be triggered and events associated with the call trace filter will not be logged in the .TRC file. To reenable triggering, you must configure the Trigger Count to a non-zero value less than 65.

Once the maxTriggerCount is reached or callTraceTimer expires, the call trace stops. To restart the call trace without changing the callTrace configuration, use following CLI command:

% request global callTrace action command start 
Note

This command is only exposed after callTrace configuration is established. If no entries are present in the callTrace, this command is not available from CLI.


Note

When you enable Signaling Packet Capture without any configuring any signaling filter (the default behavior), the SBC creates a default filter using all the configured signaling IP addresses and ports. The default filter collects only the first fragmented IP packet and ignores the rest. This happens because the UDP/TCP ports are also included in the default filter, but the IP packet fragments except the first fragment does not include the relevant headers. For the same reason, even if you create a filter which includes only the Local Port Number, the fragments except the first one are not captured.

To capture all packet fragments, create a Signaling Packet Capture filter with specific Local IP Address, or Peer IP Address, or both, and then enable Signaling Packet Capture.  

Command Syntax

Use following CLI syntax to configure call trace filters:

Note

The maximum number of call trace filters allowed is 100. 

Global Call Trace Syntax

Global Call Trace Syntax
% set global callTrace 
	callFilter <callFilter_name> 
	callTraceTimer <1-360>
	errorFilter errorType <any | earlyAttempt | none | outOfDialog | parseError>
	level4TraceMessages <allMessages | rcvdInvite>
    maxTriggerCount <0-64>	
	sageFingerprint <disable | enable>
	sageTracing <disable | enable>
	signalingPacketCapture
		devices <mgmt0 | mgmt1 | pkt0 | pkt1 | pkt2 | pkt3> <VLAN tag>
		filter <signaling trace filter name>
		signalingPacketCaptureTimer <0-360 minutes>
		state <disable | enable>

Call Filter Syntax

Call Filter Syntax
% set global callTrace callFilter <callFilter_name> 
	key <called | calling | cddn | contractor | peerIpAddress | redirecting | transferCapability | trunkGroup>
	level <level1 | level2 | level3 | level4>
	match
		called <string>
		calling <string>
		cddn <string>
		contractor <string>
		peerIpAddress <IP address>
		redirecting <string>
		transferCapability <audio31Khz | speech | unrestricted | unrestrictedWithTones | video>
		trunkGroup <trunkGroup_name>
	mediaPacketCapture <disable | enable>
	sipRecLegsCapture <disable | enable>
	state <disabled|enabled>
	stopMatch <supported | unsupported>
Note

The default value for vlanTag is "0". If you want to configure VLAN and capture the packets on a specific VLAN, you must provide the devices name and the vlanTag value.


To configure signaling state:

% set global callTrace signalingPacketCapture state <enable | disable>

Command Parameters

Global Call Trace Parameters

Parameter

Length/Range

Description

callFilter

1-23

The name of a call trace filter to apply to the system trace data log file. This filter may be created, configured, and deleted. See Call Filter Parameters table below for details.

callTraceTimer1-360

Duration in minutes that call trace is enabled.

(default = 180)

errorFilter

N/A

Use this object to specify the system-wide call trace error filter trigger criteria.

  • errorType– Type of error to log:
    • any – Log all SIP PDUs that meet the requirement of the parseError, outOfDialog, and earlyAttempt options below.
    • earlyAttempt – Logs incoming SIP PDUs that result in early termination of the call (by either the pre-parser or SIP signaling).
    • none (default) – No SIP PDU logging for this error filter.
    • outOfDialog – Log incoming syntactically correct SIP PDUs (except INVITE) that do not belong to an existing dialog.
    • parseError – Logs the number of malformed SIP PDUs. If an error is detected by SIP signaling, the accompanying PDUs is not associated with any dialog, including an existing dialog. Hence all in dialog and out of dialog PDUs are assigned to this category. If an error is detected at the front end pre-parser, the PDU is logged and not forwarded to SIP signaling to prevent logging an offending PDU by both the pre-parser and SIP signaling.


Note

The system-wide error filter triggers a call trace based on the selected type of error. If you select to trace calls with errors as well as define call filters to trace, the error filter runs in parallel with the call filters. Both may trigger producing a double-PDU output, one for the conditions matched in the call filter, and one for the detected error.

level4TraceMessages N/A

Control to limit traces only to INVITE messages.

    • allMessages – Level 4 call traces contain all matching messages.
    • rcvdinvite – (default) Level 4 call traces contain only matching received INVITE messages.

maxTriggerCount

0-64

Maximum number of calls that match the callFilter criteria and the errorFilter type that may be logged to the .TRC file, per slot. When this limit is reached on a module in a particular slot, this parameter value becomes 0 and matching events are no longer logged. To re-enable logging, you must issue a CLI command that configures this parameter to a nonzero value.

(default = 0)

sageFingerprintN/A

Enable this flag to generate an audio fingerprint for the incoming calls that can aid in robocalling campaign identification. The back-end systems (such as Identity Hub) use this feature to identify robocalling campaigns and classify individual calls that belong to a robocalling campaign. For more information, refer to Voice Analytics to Identify Voice Campaigns.

Audio fingerprinting is enabled by default. A global configuration option is provided to disable the fingerprinting on the SBC.

  • disable – Disabling audio fingerprinting can free the memory allocated to store the associated captured media.
  • enable (default)
sageTracingN/A

Use this flag to allow a sampling of the call flows in the network using the L4 call trace.

When the Sage Tracing feature is enabled, the SBC captures a small set of level 4 SIP PDU trace logs automatically in order to help debug field issues. This logging utilizes a small amount of CPU, for example, 1%. This functionality has no impact if Level 4 SIP PDU tracing is already enabled to capture allMessages for all IPs, or the trace files are disabled in the eventLog configuration.

  • disable

  • enable (default)

signalingPacketCapture

N/A

Signaling Packet Capture configuration.

  • devices – Choose a port to perform signaling packet capture against.
    • mgmt0
    • mgmt1
    • pkt0
    • pkt1
    • pkt2
    • pkt3
  • <VLAN tag> – Enter VLAN tag of the device used for signaling capture (or enter "0" for no VLAN).

  • filter – Enter the user name of this signaling trace filter.

  • signalingPacketCaptureTimer – Call trace timer for both call and error trace filters. (range: 0-360 minutes / default is 180)

  • state – Use this flag to enable/disable Signaling Packet Captures.

    • disable (default)

    • enable

Call Filter Parameters

Parameter

Description

key

Choose one or more active key components for this filter:

  • called
  • calling
  • cddn
  • contractor
  • peerIpAddress
  • redirecting
  • transferCapability
  • trunkGroup
level 

 The trace level of this call trace entry.

  • level1 – Trace everything.
  • level2 (default) – Trace everything but raw hex dumps.
  • level3 – Trace only external message information (ISDN/ ISUP/CAS etc.) and errors.

  • level4 – Trace all SIP Protocol Data Unit (PDU) calls (without logging other trace messages) at the line-rate without any dropping any SIP PDUs.

Note: Level 4 Call Trace Filter conditions/behavior:

  • Level 4 filters based ONLY on peerIpAddress. This call trace method does not trace/filter based on trunk group, called number, calling number, etc.
  • Configure a Level 4 filter with a wildcard peerIpAddress of 255.255.255.255 to match ALL packets to/from any IPv4 or IPv6 address.
  • Level 4 filters identify GCID when possible. However, some messages do not contain GCIDs and may have 0xfffffffff as the GCID (registration, notify, options ping, etc.).

For more information on the effect of different levels with respect to the flag sipRecLegsCapture, refer to Call Trace to Capture SIPRec Legs.

match

Use this keyword to specify criteria to use to capture call data upon a match. Options are:

  • called – Called number being traced. (range: 0-30).
  • calling – Calling number being traced. (range: 0-30).
  • cddn – Called directory number being traced. (range: 0-30).

  • contractor – Contractor number being traced. (range: 0-30).

  • peerIpAddress – The peer IPv4 or IPv6 address for call tracing.
  • redirecting – The redirecting number being traced (default is "").
  • transferCapability – Transfer capability of the call trace filter. Options are:
    • audio31Khz – 3.1 kHz Audio – ITC 3.1 kHz audio calls are traced.
    • speech – ITC Speech based calls are traced.
    • unrestricted – (default) Calls with ITC Unrestricted are traced.
    • unrestrictedWithTones – Calls with ITC Unrestricted Digital Information With Tones Announcements are traced.
    • video – Calls with ITC Video are traced.
  • trunkGroup – Trunk group name to match against.

Note: For called, calling, cddn, contractor parameters, use "X" or "x" wildcard character to match any single digit, and "%" symbol to match any digits from that point forward. For example, using "978xxx1212" returns all calls between 9780001212 and 9789991212, and using "978%" returns all calls with a 978 prefix.

mediaPacketCapture 

Specifies whether to enable or disable media packet capture settings. These files will be stored as ".pkt"files.

  • disable (default)

  • enable


Note

NICE and Media Packet Capture cannot be used simultaneously because the Splitter resource can only be configured for one feature.

sipRecLegsCapture

Enable this flag to trace and capture packets for SIPREC legs.

  • disable (default)
  • enable

For more information on this flag, refer to Call Trace to Capture SIPRec Legs.

state

Administrative state of this filter:

  • disabled (default) – Call filter is off. In this state no calls will be traced by this filter. The filter must be in this state to change its configuration.
  • enabled – When enabled, all calls are processed by this filter for possible inclusion in the system trace data log file.

stopMatch 

 Use this flag to stop matching filter profiles once a match is found:

  • unsupported (default) – Continue matching filter profiles even after a match is found (up to three profiles can be matched).
  • supported – Stop matching filter profiles once a match is made.

Command Examples

To enable call tracing based on the called number:

% set global callTrace callFilter CF-1 level level1 state enabled key called,calling match called 978%  
% set global callTrace callFilter CF-1 mediaPacketCapture enable

To view the recently-enabled call trace filter:

% show table global callTrace callFilter  
   callFilter CF-1 {  
	state enabled;  
	level level1;  
	key called,calling; 
	match {  
		called 978%;  
	}  
	mediaPacketCapture enable;

To enable signaling packet capture:

% set global callTrace signalingPacketCapture state enable

To enable the sageFingerprint: 

set global callTrace sageFingerprint enable
commit

To disable the sageFingerprint: 

set global callTrace sageFingerprint disable
commit

Offline Call Trace Analysis Using LX Utility

The TRC files can be analyzed offline using the LX tool, which generates a SIP ladder diagram from the TRC or DBG files. The LX tool is a Windows PC application available free of charge to all customers and partners with a license agreement, and can be downloaded as part of your software download request. For details, refer to LXDOC.

LX Main User Interface: