Sniffing VOIP

Opinion
Mar 21, 20053 mins

Nutter helps a reader weigh his options on determining and monitoring how well VoIP traffic is running over his net

When our current PBX goes off maintenance, we will look at making the change to a newer system, probably one based on voice over IP. Since how well the system works will be depend on how well the network is running, what type of tools should I have to be able to properly tell what’s going on?

– Via the Internet

There are several things to look at. What you will need will depend in part as to what VoIP solution you choose. From a hardware perspective, there are several good tools to look at. Fluke is one example of something that should be in your bag of tricks if it isnt already. The Fluke Enterprise LANmeter is a now-discontinued product that will do well at a basic level of telling you how well your network infrastructure is doing. If money is tight, you can probably pick up one of these used on eBay for less than $1,000 (they sold for around $13,000 new). New-and-improved versions of this are sold under the names of OptiView and Etherscope. This is just one vendor that makes equipment that can help with the hardware part of your network.

The other tool you should have is a protocol analyzer. There are commercial and open-source versions of this item that should be looked at when getting a tool of this type. Ethereal is the open-source version of a protocol analyzer that can handle some – if not all – of the VoIP analysis needs you may have (more features are being added all the time). Network General’s Sniffer and WildPacket’s EtherPeek VX are two of the commercial packages I’m familiar with. Both of the commercial packages should have a evaluation version you can download or access after filing out a brief questionnaire. Selecting the right network analyzer to use will depend in part on the vendor whose VoIP product you select. Ask each of the vendors which network protocol analyzer has the best decodes for their VoIP solution. No one package will have the best decodes for every solution, so make sure you have the right one for your situation. It is entirely possible that you may get one of the commercial packages and add Ethereral to the collection so that, like going to a doctor, you have more than one opinion when trying to diagnose a problem.

Getting some experience with capturing and analyzing VoIP traffic is something you will acquire over time. Another good question to ask VoIP vendors is whether they can supply capture files for the different analyzers you’re looking at to see how normal VoIP traffic should look for their products. A low-cost method you can also use to gain some experience is to either get a Vonage VoIP box, or find a friend that is using one, and see about capturing some traffic to get an idea of what the traffic should look like. Vonage is just one of the VoIP options you can use as a starting ground to gaining experience on capturing and analyzing VoIP traffic. Also check with the vendors to see what type of training they have available to help you learn more in this area.