Sizing up VoIP listening tools

With corporate voice-over-IP activity on the rise, network professionals need to know whether network measurement and monitoring tools are available today that can keep pace. The answer, as determined by our test of a half-dozen software and hardware VoIP traffic analysis tools, depends on what specific measuring and monitoring functions you have in mind.

Our objective was to test the growing set of products - nearly two dozen on the market today - that have added VoIP traffic analysis to their repertoire of options. To be included in this test, products had to address the better portion of our seven-point criteria:

•  Real-time VoIP traffic monitoring and alarm generation.
•  Long-term VoIP activity recording and reporting.
•  VoIP traffic generation as used to verify proper call-controller operation, VoIP node availability and VoIP-bandwidth assessment.
•  Automated VoIP voice-quality assessment.
•  Measurement of VoIP-related quality-of-service (QoS) parameters.
•  VoIP traffic and protocol decode.
•  Intelligent diagnosis of VoIP service problems.

Acterna, Agilent, Brix, Finisar, NetIQ and Sniffer Technologies, a division of Network Associates , submitted multiple products to address as many of these functional categories as possible. All totaled, more than two dozen discrete products were tested, but none of these combination suites fully addressed all the tasks we defined in our methodology (see Hits and misses chart).

Products that were either not ready for public testing or addressed only one or two of these functional areas are discussed in a related story (see Other VoIP traffic-analysis options).

The VoIP traffic we applied in this test was real, bidirectional telephone traffic. Phone calls entered and egressed the IP network via several vendors' VoIP gateways or else were soft-phone calls, carrying VoIP end-to-end between laptops equipped with headsets (see How we did it with testbed diagram).

There are three deployment issues that users need to consider:

•  Whether to insert in-line or monitor via a mirrored port.
•  Whether to monitor passively or apply active test traffic.
•  Whether to measure and monitor from a single point, or multiple remote points.

In-line or mirrored port?

Four of the vendors' products we tested - Acterna, Agilent, Brix and Finisar - offer VoIP-analysis devices that can run in-line, meaning the device is inserted into the direct path of a backbone link so all traffic passes bidirectionally through it.

The alternative is to hang the device off a mirrored switch port, to which a copy of all bidirectional traffic from a key backbone link is sent. We tested Sniffer Technologies' Sniffer Distributed edition hanging off a mirrored switch port. Acterna, Agilent and Finisar suites also support mirrored-port deployment. Brix offers various flavors of its Verifier monitor modules; the Brix 100 Verifiers can insert in-line. The Brix 1000 and 2500, which generate active test streams, connect to conventional switch ports - not mirrored - the same way as the NetIQ PC nodes, which also actively generate test traffic.