Re: Traffic Monitoring

[Tyler Johnson <>]

Barry,

We are looking at the general issue of identifying voice/video traffic 
on the network, not only for measurement, but for policy, QoS and other 
issues. There seem to be a growing number of network systems out there 
that examine the packet payload or header information to make policy 
decisions. I personally think that encrypted media and signaling will be 
the norm. Therefore, policy systems that rely on packet inspection will 
fail. So, I think anything that performs stateful inspection should be 
viewed as a short term solution.

What's a better solution? Good question, and one we don't have an answer 
to, though I think it has a lot to do with authentication and 
authorization at the application and network layers.

Candace Holman wrote:

> You should be able to use protocol (tcp vs udp) and port numbers to 
> differentiate traffic.
>
> If you're using SIP over UDP it should be easy.  For voice, use port 
> 5060 and all your RTP ports on UDP.
>
> Candace
>
> At 05:40 PM 6/23/2005, Barry Wray wrote:
>
> > I have a question that must be prefaced with the fact that I am not a
> > programmer.   However, I am looking for some guidance on what it would
> > take to monitor IP voice/video traffic on interface (T-1, DS3, etc.).
> >
> > Today we have "built" our own monitoring system that monitors traffic on
> > edge routers, using SNMP and MRTG, but it is shown only as "data."  The
> > result of this snapshot is a graph showing the latest data with peaks
> > over the past say 24 hours or whatever time frame the user would choose.
> >
> > I would like to see the same type of graph with data traffic in one
> > color, voice in a different color and so on.  What it comes down to is,
> > what should I use to differentiate traffic?
> >
> > Thank you.
> >
> > Barry A. Wray
> > State Networks Voice Engineer
> > Indiana Higher Education Telecommunications Systems
> > Indianapolis, Indiana
> > 317.263.8934
> >
> > http://www.ihets.org