CN101222383B - IP network telephone voice flux monitoring method based on H.323 protocol - Google Patents
IP network telephone voice flux monitoring method based on H.323 protocol Download PDFInfo
- Publication number
- CN101222383B CN101222383B CN2008100305339A CN200810030533A CN101222383B CN 101222383 B CN101222383 B CN 101222383B CN 2008100305339 A CN2008100305339 A CN 2008100305339A CN 200810030533 A CN200810030533 A CN 200810030533A CN 101222383 B CN101222383 B CN 101222383B
- Authority
- CN
- China
- Prior art keywords
- protocol
- port
- monitoring
- networking telephone
- stream
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Fee Related
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
- Telephonic Communication Services (AREA)
Abstract
To improve the accuracy of the prior IP network phone speech flow monitoring technology based on an H.323 protocol, the invention discloses an IP network phone speech flow monitoring method based on the H.323 protocol, which comprises four stages: an initialization call monitoring stage, a control channel establishment monitoring stage, a media transmitting channel monitoring stage and a call finish monitoring stage. The method of the invention can improve the monitoring accuracy and overcomes the disadvantage that a VoIP speech data stream can not be monitored caused by not analyzing a conversation establishing process dynamically by times so as to improve the efficiency and the performance of network detection and flow control.
Description
Technical field
The present invention relates to computer network flow monitoring analytical technology, specifically is a kind of based on the protocol of I P networking telephone (VoIP) voice flux monitoring method H.323.
Background technology
Along with networks development and universal, IP network phone (VoIP) becomes and becomes more and more popular, and increasing rapidly to network operation of its flow brings great pressure, voip traffic effectively controlled also become urgent day by day.Monitoring to voip traffic then is the basis of network control.It all is that exploitation is made on the H.323 standard base that ITU-T formulates that present most of manufacturer is directed to the IP network telephony, therefore occupies very big proportion based on the flow of agreement H.323 in the VoIP of network actual transmissions voice flux.H.323 the voip traffic of agreement monitoring for network test and network control all tool have very important significance.
Wherein flow monitoring is meant that some information of utilizing message in stream and the stream is divided into set some classifications (as long stream/weak point stream, fast stream/slug flow, the perhaps stream of various protocol types) with the stream on the network.Existing flow monitoring method, according to monitoring according to the difference of information can be divided into flow monitoring based on port, based on the flow monitoring of feature.
The simplest existing flow monitoring method is based on the monitoring of transport layer port.Traditional application layer protocol monitoring algorithm has only utilized the port numbers one-dimension information, and it comes identity protocol according to the port numbers that each application layer protocol is registered in IANA.For example, if certain TCP stream has used port numbers 80,8080 or 443, then it is labeled as web traffic.This method is simple, and expense is very little, easily realizes but maximum shortcoming is inaccurate, especially to some novel business, uses as P2P, VoIP.These new business are blocked in order to prevent, do not adopt static port, but the mode by dynamic assignment.
Flow monitoring method based on feature is to come the pairing business of Monitoring Data bag according to the different characteristic (Signature) of different application performance.Feature can be the feature string in the message, also can be the business conduct feature, or some statistical properties.For feature string, the feature string difference of different agreement need be at its feature string of each protocal analysis.Monitoring method based on statistical property has difficulties when real-time traffic is monitored.Autgmentability according to the signature analysis monitoring method is poor, needs a large amount of message ex ante analysises to determine feature.Present novel business it be unclear that based on the feature of the H.323 voice communication of agreement.
Simply be easy to realize but accuracy is not high based on the flow monitoring method of transport layer port; Based on traffic characteristic and not enough in existence aspect real-time, the autgmentability based on the monitoring method of agreement process analysis.At present novel service traffics Study of Monitoring is concentrated in the monitoring to the P2P flow mostly, very few to voice communication Study of Monitoring based on agreement H.323; The voip traffic monitoring system that in fact can directly be deployed to physical link is also immature.
And for based on the voice communication flow of agreement H.323, a complete communication process can relate to the foundation and the negotiation of a plurality of sessions, promptly controls session and voice conversation; A session (Session) is meant the data exchange process between the user, by the control session set up communication entity connection, consult the voice data transmission parameter, open logical channel and close logical channel and cancel transmission.The port of voice conversation, protocol information dynamic negotiation in the control session.
Summary of the invention
At above-mentioned prior art, the object of the invention is intended to overcome the defective that prior art exists, at protocol characteristic H.323 with propose a kind of based on the protocol conversation process analysis of the H.323 voice communication of agreement based on protocol of I P networking telephone voice flux monitoring method H.323, extract tuple by analysing in depth based on the process of the voice conversation of agreement H.323, from the control session, extract voice conversation information, monitor the voice conversation that this application relates to and the communication flows of whole service according to these information, reach precise monitoring based on the VoIP voice flux purpose of agreement H.323, to improve the efficient and the performance of network measuring and flow control.
For achieving the above object, the present invention proposes described based on protocol of I P networking telephone voice flux monitoring method H.323, comprise the call initiationc monitoring stage, set up the control channel monitoring stage, medium transmit channel monitoring stage and terminated call monitoring stage four-stage:
The described call initiationc monitoring stage, promptly set up the call signaling passage, set up one based on the H.323 point-to-point call of the voice conversation of agreement at two IP terminals, use Transmission Control Protocol to carry out call setup, the tcp data frame of catching source port this moment obtains source IP address, and the tcp data frame of catching purpose and be source IP address obtains the IP address and the port of session next time;
Described foundation the control channel monitoring stage uses Transmission Control Protocol to carry out control connection, is source IP address and destination IP address by the trap address, and port is the Frame of destination, and the medium that obtain sound, video transmission transmit the tunnel ends slogan;
Described medium transmit the channel monitoring stage, and purpose is that the final medium that obtain session transmit information, promptly set up between the communication entity based on the stream information number of the protocol of I P networking telephone H.323.Because Voice ﹠ Video (based on media transmission protocol RTP) and their control information (based on media delivery control protocol RTCP) all can be considered to not homogeneous turbulence, so many connections of this process need monitoring based on udp protocol, need store, mate these stream, safeguard;
The described terminated call monitoring stage obtains based on after H.323 the VoIP voice flux of agreement is cancelled the ending message of session, finishes observation process.
Described have when a plurality of based on the protocol of I P networking telephone H.323, also need to communicate the stream information storage and the stream identification of entity, identify based on after H.323 the protocol of I P networking telephone is set up the control message of session, need to analyze this message, therefrom extract the information of the relevant dynamic session that needs, and with flowing the stream tuple information that storage organization is stored these communication entities accordingly.
The storage organization that the storage of described stream information is adopted is the Hash chained list, at first calculates hash value, travels through the chained list node below this hash value again, inserts accordingly, search, deletion action, and the process of described stream information storage and stream identification is:
(1) packet of catching is extracted the tuple information of header, search Hash table, if with the Hash table in certain based on protocol of I P networking telephone voice flow node tuple information coupling H.323, then this packet of mark enters step (2); Otherwise change step (5);
(2) determine whether to be based on the H.323 request message of protocol of I P networking telephone voice flow; If, then with this stream (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) is labeled as the control session, enters step (3); Otherwise change step (5);
(3) determine whether to be based on the H.323 response message of protocol of I P networking telephone voice flow; If, then will flow (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) is labeled as the control session, enters step (4); Otherwise change step (5);
(4) will flow (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) writes the Hash table; Enter step (5);
(5) return 0; Analyze next packet;
Carry out at last based on the H.323 maintenance of protocol of I P networking telephone voice flow, when this based on after H.323 protocol of I P networking telephone voice flow finishes, in the Hash table with this stream node deletion.
In sum, the present invention is mated by header packet information and tuple structure to voice packet in the conversation procedure, and then the whole flow of communication is implemented monitoring.By the multi-party conversation process set up being extracted the tuple information of a plurality of communication peer-entities, can carry out merger to part stream, the node of whole stream information is carried out aging update, and then the whole flow of multi-party communication is realized monitoring.Contrast existing technology, this method can effectively improve monitoring accuracy.
Description of drawings
Fig. 1 is a call initiationc monitoring stage schematic diagram among the present invention;
Fig. 2 sets up control channel monitoring stage schematic diagram among the present invention;
Fig. 3 is that medium transmit channel monitoring stage schematic diagram among the present invention;
Fig. 4 is a whole monitoring schematic flow sheet of the present invention;
Fig. 5 is a stream storage organization schematic diagram among the present invention.
Embodiment
As Fig. 4, present embodiment provides based on protocol of I P networking telephone voice flux monitoring method H.323, comprises the call initiationc monitoring stage, sets up the control channel monitoring stage, and medium transmit channel monitoring stage and terminated call monitoring stage four-stage:
Phase I in the call initiationc monitoring stage, is set up one based on the H.323 point-to-point call of the protocol of I P networking telephone at two IP terminals, use Transmission Control Protocol foundation calling connection as shown in Figure 1.This connects carrying is defined call setup message (Q.931 passage or call signaling passage) call initiationc in the agreement H.225, and it is that 1720 TCP connects that terminal A can set up a port numbers, and B sends the message that connects to terminal.H.225, the message that connects is defining in the agreement: in this message, have a user to the user based on having comprised one group of destination address another name in the protocol communication data cell (PDU) H.323, can obtain common telephone number by resolving this destination address another name.After terminal B receives the message that connects, make an immediate response.If terminal B replys this calling, just send a connection message, this message comprises the link information unit of a user to the user, oneself IP address and the port numbers that has just comprised in this information unit that terminal B wishes to connect with terminal A.This stage is 1720 tcp data frame from the monitoring destination interface, obtains the port of control channel.
Second stage is set up the control channel monitoring stage as shown in Figure 2, uses Transmission Control Protocol to call out control connection.By the trap address is source IP address and destination IP address, and port is the Frame of destination, and the medium that obtain sound, video transmission transmit the port numbers that passage uses; The IP of terminal B and port are drawn by the connection message of previous call signaling passage at this moment.After receiving the port numbers of B, caller A opens this immediately based on the control channel of agreement H.245, and this passage keeps in whole communication process.The purpose in this stage is to obtain to transmit the port numbers that passage uses based on the medium of the protocol of I P networking telephone H.323.
Phase III, described medium transmitted the channel monitoring stage, comprise three steps: capability negotiation as shown in Figure 3; Master/slave (Master/Slave) confirms, calls out beginning (medium transmission lane negotiation will), and the medium that finally obtain terminal A and terminal B session transmit information.Voice conversation passage for the B that opens a terminal, terminal A sends one and opens logical channel (OpenLogicalChannel) based on the message of agreement H.245, comprises IP address and port based on the communication message of media delivery control protocol (RTCP) that terminal B sends to terminal A here.If terminal B has been ready to the data of receiving terminal A, terminal B should send acknowledge message (OpenLogicalChannel ACK) to this logical channel at once so; This message comprises the message communication port of terminal A transmission based on media transmission protocol (RTP), and terminal A sends the message communication port based on media delivery control protocol (RTCP).So just opened unidirectional medium and transmitted the duplex channel of media delivery control protocol (RTCP) use of passage and this media channel from terminal A to terminal B.It should be noted that when monitoring: H.323 agreement uses unique media transmission protocol (RTP) and media delivery control protocol (RTCP) port right to each session.Three kinds of main sessions are arranged: audio session (session id 1), video session (session id 2) and data session (session id 3) between terminal.For each session, can only use a media delivery control protocol (RTCP) port, and media transmission protocol (RTP) passage is unidirectional foundation, promptly have the rtp streaming of terminal A, but media delivery control protocol (RTCP) sender and the Receiver Report on both sides use same udp port to terminal B and terminal B to terminal A.Data session generally uses Transmission Control Protocol.This stage can be monitored many stream informations of specifying udp port by above step.
The quadravalence section: the terminated call monitoring stage, obtain based on after H.323 the VoIP voice flux of agreement is cancelled the ending message of session, finish observation process.
The process of terminated call is that terminal A must close logical channel (CloseLogicChannel) message to logical channel (media channel) transmission that each bar is opened.Terminal B utilizes and confirms to close logical channel (CloseLogicChannelAck) acknowledgement messaging.After all logical channels had all been closed, terminal A sent one based on the end of message session command (EndSessionCommand) of agreement H.245, and terminal B also sends same message to terminal A.This stage is determined the end of voice flow, so that upgrade stream information.
A plurality of during when existing based on protocol of I P networking telephone voice call H.323, set up some dynamic Business Stream matching structures.Identifying based on after H.323 the protocol of I P networking telephone is set up the control message of session, needing to analyze this message, therefrom extracting the information of the relevant dynamic session that needs, and storing these stream informations with corresponding stream storage organization.The stream storage organization is the Hash chained list in the present embodiment, and as shown in Figure 5, stream inserts, search, deletion all are at first to calculate hash value, travels through the chained list node below this hash value again, inserts accordingly, search, deletion action.Monitoring algorithm to whole flow process based on the H.323 voice communication of agreement is summarized as follows:
(1) packet of catching is extracted the tuple information of header, search Hash table, if with the Hash table in certain based on H.323 protocol of I P networking telephone voice flow node tuple information coupling, then this packet of mark (nfmark=1); Otherwise change step (5) over to.
(2) determine whether to be based on the H.323 conversation request message of the protocol of I P networking telephone; If, then with the tuple information of communication entity as a stream (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) is labeled as the control session, enters step (3); Otherwise change step (5) over to.
(3) determine whether to be based on the H.323 session response message of the protocol of I P networking telephone; If, then with the tuple information of communication entity as a stream (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) is labeled as the control session, enters step (4); Otherwise change step (5) over to.
(4) will flow (vsource_ip, vsource_port, vdest_ip, vdest_port TCP) writes the Hash table; Enter step (5).
(5) return 0; Analyze next packet.
Also having one in algorithm is the maintenance of flow information, a session stream finishes the back at it will be cancelled for 10 seconds, promptly in Hash table with this based on the H.323 words voice flow node deletion of agreement, above-mentioned recognizer will travel through a Hash table in 30 seconds and be safeguarded.
Claims (2)
1. one kind based on protocol of I P networking telephone voice flux monitoring method H.323, it is characterized in that, comprises the call initiationc monitoring stage, sets up the control channel monitoring stage, and medium transmit channel monitoring stage and terminated call monitoring stage four-stage:
The described call initiationc monitoring stage, promptly set up the monitoring of call signaling passage, set up one based on the H.323 point-to-point call of the protocol of I P networking telephone at two IP terminals, use Transmission Control Protocol to carry out call setup, the tcp data frame of catching source port this moment obtains end IP address, source, catches destination address and be IP address and port that the tcp data frame of end IP address, source is connected next time;
Described foundation the control channel monitoring stage uses Transmission Control Protocol to carry out control connection, is end IP address, source and destination IP address by the trap address, and port is the Frame of destination, and the medium that obtain sound, video transmission transmit the port numbers that passage uses;
Described medium transmit the channel monitoring stage, purpose is that the final medium that obtain session transmit information, be set up between the communication entity based on the stream information number of the protocol of I P networking telephone H.323, this stage need be monitored many connections based on udp protocol, and these streams are stored, mated and safeguard;
The described terminated call monitoring stage obtains based on after H.323 protocol of I P networking telephone voice flux is cancelled the ending message of session, finishes observation process.
2. described based on protocol of I P networking telephone voice flux monitoring method H.323 according to claim 1, it is characterized in that, described have when a plurality of based on the protocol of I P networking telephone H.323, also need to communicate the stream information storage and the stream identification of entity, identify based on after H.323 the protocol of I P networking telephone is set up the message of control session, need to analyze this message, therefrom extract the information of the relevant dynamic session that needs, and store these stream informations with corresponding stream storage organization;
The storage organization that the storage of described stream information is adopted is the Hash chained list, at first calculates hash value, travels through the chained list node below this hash value again, inserts accordingly, search, deletion action, and the process of described stream information storage and stream identification is:
(1) packet of catching is extracted the tuple information of header, search Hash table, if with the Hash table in certain based on protocol of I P networking telephone voice flow node tuple information coupling H.323, then this packet of mark enters step (2); Otherwise change step (5);
(2) determine whether to be based on the H.323 request message of protocol of I P networking telephone voice flow; If, then with this stream vsource_ip, vsource_port, vdest_ip, vdest_port, TCP are labeled as the control session, enter step (3); Otherwise change step (5);
(3) determine whether to be based on the H.323 response message of protocol of I P networking telephone voice flow; If, then will flow vsource_ip, vsource_port, vdest_ip, vdest_port, TCP are labeled as the control session, enter step (4); Otherwise change step (5);
(4) will flow vsource_ip, vsource_port, vdest_ip, vdest_port, TCP write the Hash table; Enter step (5);
(5) return 0; Analyze next packet;
To based on the H.323 maintenance of protocol of I P networking telephone voice flow,, in the Hash table, this is flowed node deletion at last when based on after H.323 the voice flow of agreement finishes.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100305339A CN101222383B (en) | 2008-01-23 | 2008-01-23 | IP network telephone voice flux monitoring method based on H.323 protocol |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100305339A CN101222383B (en) | 2008-01-23 | 2008-01-23 | IP network telephone voice flux monitoring method based on H.323 protocol |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101222383A CN101222383A (en) | 2008-07-16 |
| CN101222383B true CN101222383B (en) | 2010-06-02 |
Family
ID=39631974
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008100305339A Expired - Fee Related CN101222383B (en) | 2008-01-23 | 2008-01-23 | IP network telephone voice flux monitoring method based on H.323 protocol |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101222383B (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102118526A (en) * | 2009-12-30 | 2011-07-06 | 北京大唐高鸿数据网络技术有限公司 | VoIP (Voice over Internet Protocol) media communication method based on SIP (Session Initiation Protocol) |
| CN102006588B (en) * | 2010-12-28 | 2013-03-20 | 北京安天电子设备有限公司 | Method and system for monitoring network behavior of smart mobile phone |
| WO2016165088A1 (en) * | 2015-04-15 | 2016-10-20 | 华为技术有限公司 | Traffic statistics collecting method, device and terminal device |
| CN114024868B (en) * | 2022-01-06 | 2022-03-25 | 北京安博通科技股份有限公司 | Flow statistical method, flow quality analysis method and device |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1589051A (en) * | 2004-07-29 | 2005-03-02 | Ut斯达康通讯有限公司 | Dynamic flow control method based on paging zone |
-
2008
- 2008-01-23 CN CN2008100305339A patent/CN101222383B/en not_active Expired - Fee Related
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1589051A (en) * | 2004-07-29 | 2005-03-02 | Ut斯达康通讯有限公司 | Dynamic flow control method based on paging zone |
Non-Patent Citations (8)
| Title |
|---|
| Kun Xie,etc.A Scalable Bloom Filter for Membership Queries.Global Telecommunications Conference,2007,GLOBECOM＇07,IEEE.2007,第543-547页. * |
| KunXie etc.A Scalable Bloom Filter for Membership Queries.Global Telecommunications Conference |
| 崔亮,张大方,谢鲲.一种改进CARE业务流估计算法.计算机应用研究第24卷 第12期.2007,第24卷(第12期),第99-102页. |
| 崔亮,张大方,谢鲲.一种改进CARE业务流估计算法.计算机应用研究第24卷 第12期.2007,第24卷(第12期),第99-102页. * |
| 李峰,唐新怀,饶若楠.H323 VO IP Gateway通信控制模块的设计与实现.计算机应用与软件第24卷 第1期.2007,第24卷(第1期),第73-75页. |
| 李峰,唐新怀,饶若楠.H323 VO IP Gateway通信控制模块的设计与实现.计算机应用与软件第24卷 第1期.2007,第24卷(第1期),第73-75页. * |
| 毕夏安,张大方,谢鲲,牟晓玲.基于H.323协议的VoIP语音流量识别.计算机应用第28卷 第9期.2008,第28卷(第9期),第2204-2206页. |
| 毕夏安,张大方,谢鲲,牟晓玲.基于H.323协议的VoIP语音流量识别.计算机应用第28卷 第9期.2008,第28卷(第9期),第2204-2206页. * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101222383A (en) | 2008-07-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102138313B (en) | In-band DPI media reservation modifications to RFC 3313 | |
| JP2008508753A (en) | Method and apparatus for providing correlation means in a hybrid communication network | |
| CN104821909B (en) | End-to-end data transmission method and system | |
| CN101222383B (en) | IP network telephone voice flux monitoring method based on H.323 protocol | |
| US7865207B2 (en) | Method and apparatus for large scale analysis of push-to-talk traffic | |
| WO2011060721A1 (en) | Method and apparatus for monitoring service quality | |
| CN101605342A (en) | Monitor method, system and the device of Content of Communication in a kind of IMS network | |
| CN1897622B (en) | Method for inspecting and releasing abnormal realtime transmission protocol source of medium gateway | |
| CN102438243A (en) | Method for identifying harassing phone call by analyzing frequency of phone call | |
| WO2007079630A1 (en) | A method and system for testing quality of service qos in next generation network ngn | |
| WO2014173224A1 (en) | Session association method, apparatus, and system | |
| WO2010044082A3 (en) | A communications system and method | |
| CN101631174B (en) | Network telephone real-time identification and filtering method based on session initiation protocol | |
| CN104717184B (en) | A kind of acquisition methods and device of terminal applies session five-tuple | |
| CN100471182C (en) | Method and system of providing service of subsystem in IP multimedia for users in circuit switching domain | |
| CN102457494A (en) | Method and device for improving monitoring success rate based on session initiation protocol (SIP) signaling | |
| CN101335788B (en) | System and method for detecting and limiting line resource occupation by calling back | |
| CN106506122B (en) | A kind of signal transmission method and system set between network element for SCP and conjunction | |
| CN102420835B (en) | Method for realizing real-time transport protocol (RTP) media stream agent in unified communication system | |
| CN110099025A (en) | A kind of call method and device based on view networking | |
| TWI445434B (en) | Wireless access point device and method of avoiding communication collision | |
| CN101179784A (en) | Terminal configuration method and system | |
| CN101188546B (en) | Implementation method and system for packet network service and user-subscribed database | |
| CN101009604A (en) | System, method and network device for legal monitoring in the next-generation network | |
| CN100356737C (en) | System and method for detecting large volume of medium service |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| C17 | Cessation of patent right | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20100602 Termination date: 20110123 |