Real-time monitoring of SIP infrastructure using message classification

  • Authors:
  • Arup Acharya;Xiping Wang;Charles Wright;Nilanjan Banerjee;Bikram Sengupta

  • Affiliations:
  • IBM TJ Watson Research Center, Hawthorne, NY;IBM TJ Watson Research Center, Hawthorne, NY;IBM TJ Watson Research Center, Hawthorne, NY;IBM India Research Lab, New Delhi, India;IBM India Research Lab, New Delhi, India

  • Venue:
  • Proceedings of the 3rd annual ACM workshop on Mining network data
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Session Initiation Protocol (SIP) is a control-plane protocol for multiple services such as VoIP, Instant Messaging and Presence, and in addition, is key to IP Multimedia Subsystem (IMS). A SIP message consists of plain-text headers and their corresponding values, which are used to route the message between one or more endpoints, resulting in a media session. These headers and values are often transformed/re-written at intermediate SIP servers ("proxies"). It is important to monitor the flow and transformation of such messages in real-time, for functional testing of a SIP overlay network containing malfunctioning or ill-configured SIP entities, or for efficient run-time SIP network operation, including problem determination and load balancing. Towards that end, we have designed and implemented a programmable in-kernel Linux SIP message classification engine. The classifier can be configured to intercept incoming and outgoing SIP messages from a server, extract appropriate message meta-data including distinguishing header-value pairs and their transformations, and forward the same to a monitoring engine. The engine collates this information from different classifiers across the network, to infer the state of a SIP call on individual servers on the call path as well as aggregated call-state.