How to monitor VoIP Traffic

This blog aims to do one thing, show you how to monitor VoIP traffic on your network. I get questions, almost daily, asking, “How can we use NetFlow to trouble shoot call quality issues?” Customers are usually shocked when I show them how easy it is to do. First we will need to go over what actually qualifies as a “call quality issue”.

VoIP Monitoring using NetFlow:

When a user on your network complains about poor call quality, there are usually three different things they could mean (or any combination):

• Latency – The end-to-end delay in delivering the voice content from the speaker’s mouth to the listener’s ear.
• Jitter – The unpredictable and variable delays in the delivery of each voice packet.
• Packet Loss – The dropping of individual voice packets due to network congestion.

Looking at the above, you probably already guessed which two cause the most issues, Jitter and packet loss. Jitter is the reason you get a choppy phone call and may have a hard time understanding the person on the other end. Packet loss also causes similar behavior, since VoIP packets are actually be dropped on the network. Latency can cause some annoyance, but if it is the only issue you have, you may not notice any call quality issues, unless jitter/packet loss are also affecting the call. So, now that we know what three things can cause call issues, let’s see how we can use NetFlow/IPFIX to troubleshoot an issue!

Troubleshooting your VoIP issues using NetFlow and IPFIX:

Before we start diving in, we want to make sure that our NetFlow monitoring tool can report on Cisco AVC and information outside of the standard tuple. Once you have figured this out and are exporting this information to your NetFlow collector, you should be able to see information similar to the image to the right. Now you may be asking yourself, what does all this stuff mean? Luckily for you our NetFlow monitoring tool lays out all this information, so it is pretty easy to understand; regardless, there are some keywords you may want to know.

• • DSCP – This column will show you what DSCP value the traffic is being marked with (we are looking for EF for VoIP traffic). This column can be handy if you are seeing call quality issues and find that your traffic has the wrong DSCP marking, or perhaps isn’t being marked at all!
  • SSRC – Synchronization source, this value is randomly generated with the intent that no two RTP streams will have the same SSRC. It is useful in tracking a specific conversation on your network.

See above for more information on Jitter/Trans Event Packet Loss (TEPL). After you’ve reviewed the image to the right, you can see how quickly you are able to see poor call quality on our network. From here it would be a matter of investigating that user’s phone to make sure that they are properly configured, or contact your service provider to verify that they are not having an outage. We can even take this a couple steps further, thanks to the new NBAR and exports from Cisco! Check out the image to the left to see what I came up with!

If you need any help configuring your devices for Cisco AVC, or have any questions on monitoring VoIP traffic on your network, feel free to reach out to us in support!