[VoiceOps] VoIP passive monitoring appliances or software - any recommendations?

[Brian Knight]

$DAY_JOB is at a national ISP/NSP where we resell VoIP services.  We do
peering with the VoIP carrier at one of our remote POP's.  We are looking
for a better way to be able to monitor the handoff of those calls to our
carrier over that peering link.

We have quite a bit of instrumentation within our walled garden to tell us
about call quality.  We can monitor our QOS policies to ensure packets
aren't being dropped by intermediate routers.  If the customer uses our
routers to terminate their SIP session, we can pull call quality stats from
those routers as well.  We can also use our own office telephones to make
and receive test telephone calls, and we can of course run Wireshark
captures from the switches to which those phones are connected.

However, we can't say for certain that the customer's RTP traffic actually
made it on the wire connecting us to the VoIP provider, nor can we say that
the traffic is being transmitted and received properly.  The peering link
is connected to a Cisco 12k router on our side, so there is no way (afaik)
to mirror the port, as on a switch.

For the moment, I am envisioning that we'll need to deploy a server running
Wireshark to the remote POP.  It will need two network interfaces; one
connected to a management network, the other a capture interface.  The
capture interface will connect to a network tap, and the network tap
connected in-line between our router and the patch panel.

Wireshark is probably adequate for what we need.  But I'm wondering if
there is any software or an appliance that would do the job better.  Given
the usual details - calling number, called number, date and time - we want
to be able to quickly inspect traffic and dig into the details of the
stream.  Do we see any missing packets from the media stream?  What is the
MOS score of a particular call?  Do we see any missing packets coming from
us?  Any missing packets from the provider?

Alerting on bad call quality would be a nice-to-have addition.

Any recommendation would be appreciated.  Thanks in advance.

-Brian Knight
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20140212/d0425b3f/attachment.html>