Generating service detail records

[0002] This invention relates to methods and apparatus for generating service detail records, and to monitoring systems for collecting data for these records from a network, such as a packet data network, which is used for example to carry multimedia telephony services as described in the International Telecommunication Union's commendation H.323 or the Internet Engineering Task Force's multimedia data and control architecture including the Session Initiation Protocol (SIP). These and similar standards define a set of protocols for establishing sessions or calls which may include one or more users and one or more services, communicating via one or more multimedia channels.

[0003] The provision of multimedia communications services over a packet data network (PDN) which may not provide quality of service guarantees has recently generated a great deal of interest due to the success of networks based on the internet protocols (TCP/IP). Network operators are currently trialing multimedia communications services over a variety of packet data networks such as Internet Protocol (IP), Frame Relay (FR) and Asynchronous Transfer Mode (ATM). A major problem is to generate service detail records (generalised call data records), in real-time or batch-mode, which measure the service usage of individual users and the service quality that was actually experienced by the user.

[0004] According to one aspect of this invention there is provided a method of generating generalised service detail records for communications (such as telephony) carried over a packet network, comprising the steps of:

[0005] acquiring packet network service data from packets carrying the communications;

[0006] acquiring signalling data from a signalling protocol to identify at least one of addressing, configuration, statue and timing information for endpoints, gatekeepers and connections involved in a call; and

[0007] combining said packet service data and said signalling data to generate service detail records.

[0008] According to another aspect of this invention there is provided a method of discovering the network configuration of the endpoints, gatekeepers and their relationships, for a communications service (such as telephony) carried by a PDN, by using a passive monitoring system to capture the signalling messages involved in the configuration and negotiation of relationships, addressing and resource allocation, between endpoints and gatekeepers.

[0009] According to a further aspect of this invention there is provided a method of generating generalised service detail records for communications carried over a packet network, comprising the steps of:

[0010] acquiring packet network service data for the packets carrying the communications service;

[0011] acquiring signalling data regarding at least one of call control, registration, admissions, bandwidth management, call status, address translation and intelligent network services;

[0012] acquiring quality of service data for the service transmission level; and

[0013] combining said service data, said signalling data and said quality of service data to generate generalised service detail records.

[0014] According to another aspect of this invention there is provided a method of monitoring a packet data sub-network (e.g. ethernet segment) or link (e.g. a T3 link carrying IP over a Point-to-Point Protocol—PPP), comprising the steps of: monitoring at a first location signalling messages to detect the existence of a call; and monitoring at multiple other locations to identify some or all packets associated with the call (in H.323, the Call ID can be used to identify all packets associated with a given call). The captured packets may include both signalling data and data from multimedia streams associated with the call. It may be required for wire-tap applications, for example, to use the signalling data to identify calls of interest, and then capture the entire multimedia stream. It may be necessary to buffer captured packets at each location to ensure that all packets associated with the call could be captured.

[0015] In addition, the packets associated with a conference call can be correlated together to form a service record for a conference call. This can be achieved by capturing all packets with the same conference ID in H.323, for example.

[0016] In some cases it may be desirable to monitor additional signalling messages, e.g. Signalling System No.7 (SS7) protocol messages or Integrated Services Digital Network (ISDN) messages, on signalling links in a switched circuit network (such as the public switched telephone network—PSTN) coupled to said packet data network, or Media Gateway Control protocol messages (for example MGCP or SGCP) which are used to control the gateway connection between the SCN and the PDN, to derive additional monitoring data, and correlate those additional monitoring data with at least some of first monitoring data. These can be correlated to the original call by using characteristics such as calling or called party numbers to identify the call.

[0017] Thus the invention can involve monitoring the control channels used for initiation, modification and termination of multimedia sessions, and may include the monitoring of the multimedia channels themselves, to provide a service detail record for a session.

[0018] The invention enables a network operator to generate service detail records on a pure PDN, or on a hybrid network of interconnected PDNs and switched circuit networks SCNs). There is also described a method for automatically discovering the network configuration information, including addressing and identifying the relationships between gatekeepers and endpoints.

[0019] Methods and apparatus in accordance with this invention for generating telephone service detail records will now be described, by way of example, with reference to the accompanying drawings, in which:

[0020] FIG. 1 shows a distributed monitoring system for a PDN carrying multimedia voice services;

[0021] FIG. 2 shows examples of extensions of this architecture to correlate data from the PDN with signalling data from the SCN;

[0022] FIG. 3 shows the sequence of message types which can be captured to construct a service detail record;

[0023] FIG. 4 shows an example of the structure of a service record that could be constructed from the data collected by the monitoring system;

[0024] FIG. 5 is a flow diagram of a process for monitoring signalling messages related to gatekeeper auto-discovery;

[0025] FIG. 6 is a flow diagram of a process for extracting data from gatekeeper auto-discovery messages;

[0026] FIG. 7 shows the relationship between the processes of FIGS. 5 and 6;

[0027] FIG. 8 illustrates a failure mode which can affect the gatekeeper auto-discovery procedure;

[0028] FIG. 9 is a flow diagram of a process for monitoring signalling messages related to registration of endpoints with gatekeepers;

[0029] FIG. 10 is a flow diagram of a process for extracting data from endpoint registration messages;

[0030] FIG. 11 is a flow diagram of a process for extracting data from endpoint unregistration messages;

[0031] FIG. 12 illustrates potentially anomalous registration of endpoints with a gatekeeper in a different sub-net;

[0032] FIG. 13 illustrates potentially anomalous load imbalance between two gatekeepers in a sub-net;

[0033] FIG. 14 is a flow diagram of a process for monitoring call signalling channels;

[0034] FIG. 15 is a flow diagram of a process for monitoring call signalling messages;

[0035] FIG. 16 is a flow diagram of a process for monitoring control channels; and

[0036] FIG. 17 is a flow diagram of a process for monitoring call signalling channels having dynamic TSAP identifiers.

[0037] The distributed monitoring system shown in the drawings has the capability to collect data from a combined PDN and SCN carrying multimedia services, correlate these data in real-time, and provide a real-time view of services on the network. These data can be used for applications such as troubleshooting, surveillance, security, network planning, provision of accounting information to customers, fraud detection, billing and acquisition of marketing information.

[0038] Referring to FIG. 1, the probes shown are part of the distributed monitoring system, and are passive link monitoring devices (using techniques similar to those in existing protocol analysers for example). The distributed monitoring system is constructed from the probes and standard computer and communications components, with special-purpose software which provides the applications described above. A principal function of this software is to correlate data from different probes to provide a record or real-time trace of calls, transactions and other services as they occur on the network. The Hewlett-Packard acceSS7 system is an example of a distributed passive monitoring system which could be used to implement parts of the system described above.

[0039] A Data Management Infrastructure (DMI) collects the data from the probes and processes the data to produce service detail records. The DMI may consist of software running oil one or more computers, and the processing of the data and its storage may be distributed across these compute The service detail record generation process may be split between the probes and the DMI. The probes may generate partial service detail records by correlating all the information available on that probe about a particular session, and forwarding those partial records to the DMI. The DMI is then responsible for correlation of partial service detail records from different probes to form the final service detail records. Alternatively the probes can forward uncorrelated data to the DMI, and the DMI is then responsible for generating the complete service detail records. In both cases the DMI is also responsible for the storage of the service detail records and for providing interfaces for application programs to analyse the service detail records. This aspect of the DMI may be implemented using data warehousing technology.

[0040] An example of a monitoring system architecture is given in FIG. 2. This shows probes monitoring the PDN, SS7 network and the ISDN. The SS7 probes could be for example from the Hewlett-Packard acceSS7 system. The ISDN primary rate access probes could for example be constructed using the same techniques as in existing protocol analysers (such as the Hewlett-Packard 37900D Signalling Test Set). The PDN probes could be constructed from Hewlett-Packard 4986/7 or 13457/8 LanProbes for example.

[0041] The distributed monitoring system is arranged to correlate real-time data from any combination of these probes. This includes, for example, signalling data from the SS7 links, signalling from the ISDN links (e.g. the D-channel for narrowband ISDN), the signalling data for the multimedia service from the PDN, and the multimedia stream data (e.g. data indicating packet loss, latency or jitter). It may also include the capture of the entire multimedia stream for applications like wire tapping or troubleshooting.

[0042] For convenience the invention is described primarily with reference to the H.323 recommendation, using IP as the PDN, and optionally connected to one or more SCNs using narrowband ISDN and/or SS7 signalling with trunk connections. However, it should be understood that this terminology is to be taken as including within its scope analogous functionality, whether or not they are customarily identified by the terms used in these standard recommendations.

[0043] The PDN is continuously monitored for packets that provide configuration information on H.323 endpoints and gatekeepers. These packets may be captured to create and maintain a database (the network discovery database) which gives configuration information, addressing information and relationships between the endpoints and gatekeepers. The network discovery database may also take data from additional sources to supplement or verify the captured data. Any discrepancies between the discovered data and the data from other sources should be used to generate an alarm to the network operator indicating a possible network configuration problem. The details of the data captured are described in the following paragraphs.

[0044] A type of transaction which is tracked by the monitoring system is the gatekeeper discovery process. This is used by an endpoint to automatically find a gatekeeper which will provide service to it. The monitoring system uses the data captured from the sequence of messages between the endpoint and the gatekeeper, to identify endpoints and gatekeepers and to build a database of the relationships between endpoints and gatekeepers The database stores information derived from the captured data which identifies the endpoint and gatekeeper. This includes the network addresses and port numbers. The monitoring system monitors continuously for endpoint discovery attempts, to maintain an accurate database of the network configuration. This monitoring process is described in more detail below with reference to FIGS. 5 to 8.

[0045] The endpoint may go through a registration process with its gatekeeper. This process may be repeated periodically if the registration has a finite lifetime. The monitoring system monitors the network continuously for packets involved in the registration process. The monitoring system captures the relevant packets and uses the data relating to the endpoint and gatekeeper to update and add information to the database. This typically includes any transport addresses (transport address=(Network address, Transport layer Service Access Point (TSAP) or port number)), any alias addresses and any other addressing or configuration information associated with the endpoint or gatekeeper.

[0046] Endpoints may also request from a gatekeeper location information for an endpoint for which it has the alias. The monitoring system will continuously monitor for the exchange of packets associated with this location process and capture data from the relevant packets. This data can be used to update or add information to the network discovery database that identifies the relationship between aliases, transport addresses and any other addressing or configuration information. This may include information which identifies how to connect to a destination on the SCN (e.g. E.164 addresses). More details of monitoring of the registration process are given below with reference to FIGS. 9 to 13.

[0047] Access tokens may be used to enable an endpoint to hide its transport address from the endpoint to which it is establishing communication. The monitoring system will continuously monitor the network to capture packets that are used in the process of distributing access tokens to endpoints. The captured data is used to add to or update information in the network database indicating the association between an access token and an endpoint.

[0048] This section lists the types of fields in service records, and describes how the distributed monitoring system could provide the required data A service record is generated for each instance of the usage of a specific service. This is a generalisation of a call record, which is generated by current switches. A service is normally defined from the perspective of the user. The service may actually involve a number of calls or transactions, for example. In the case where only the PDN is being monitored, these service records include data from the signalling between any combination of gateways, gatekeepers, terminals and multi-point controllers; and data from the multimedia streams controlled by this signalling. In the case where the SCNs connected to the PDN am being monitored, the service record will also include data from the signalling data on the SCN collected from the probes connected to the SCN. The network discovery database may be used in constructing the service records to fill any address or configuration information which is not available directly from the packets involved in the call.

[0049] FIG. 3 shows an example of the sequence of packets which may be captured at different levels in the overall stack of protocols (such as Q.931, II.245 and an unreliable datagram protocol—UDP) to provide a service detail record FIG. 4 illustrates how the information from these different parts of the overall transaction can be used to contribute to different respective parts of a service detail record.

[0050] 1. Calling Party Information.

[0051] This includes any information which can be derived about the calling party from the signalling data flowing on the PDN, and is therefore available to the link monitoring probes. Typical information includes: calling party number; any ISDN sub-addressing information; calling party name; network addresses; TSAP or port numbers; alias addresses; and any numbers or addresses related to billing. This information can be derived from the sequence of messages used to setup a call. In the H.323 recommendation, this can be achieved by extracting the relevant fields from the Q.931 messages used in setting up the call (set-up, call proceeding, alerting, connect for example). In the cases where one or more gatekeepers are involved the admission signalling (H.225 ARQ and ACF messages for example) between gatekeeper and endpoint is captured to identify the logical channel for call signalling. The logical channel is typically identified using the transport address.

[0052] Additional information may be derived from call setup messages on the ISDN D channels of an interconnected SCN, at either the originating or terminating end or both; and/or from call setup messages on any of the SS7 links of the SCN. Additional information may also be derived from any intelligent network service messages that flow over the SS7 links as part of the specific service usage.

[0053] 2. Called Party Information.

[0054] As for calling party information, but replace calling party by called party.

[0055] 3. Information on each party in a conference.

[0056] The equivalent data to the calling party information for each party in a conference, with additional information on the conference objective (join conference, create conference or invite for example) and a means to identify the conference (Conference ID for example).

[0057] 4. Network Routing and Logical Channel Information.

[0058] This may include any information on the network resources which were used to provide this specific service usage. The following are examples of data which might be provided:

[0059] logical channels associated with the call and their identifiers,

[0060] the requested media, codecs (coder/decoders), service quality and bandwidth for each channel,

[0061] the negotiated media, codecs, service quality and bandwidth for each channel,

[0062] any other performance or configuration data on the channels which are requested or established during the call or conference.

[0063] Each of these uses is time-stamped, and the sequence and nature of the use indicated. These data can be obtained in a similar way as was described for item 1 above from the capture of packets carrying signalling information. More specifically the logical channels can be identified by using the fields within an OpenLogicalChannel structure within certain messages defined in H.323 and associated recommendations. Subsequent messages which control the logical channels are also monitored and any changes in channel configuration can be time stamped and added to the service record.

[0064] A important additional set of information is the measured quality of service and bandwidth usage on each of the logical channels set-up as part of the call. This will typically include packet loss rates, latency and jitter measurements which are made over selected intervals by capturing packets from the logical channels and extracting the relevant fields.

[0065] 5. Supplementary Services Information.

[0066] This may include any information on supplementary services used for this specific service usage. The following are some examples of the data which may be provided:

[0067] call forwarding indication and address information;

[0068] interactive voice response information on the use of intelligent peripherals;

[0069] 800 number services;

[0070] any custom services that may be invoked during the call or conference.

[0071] This information includes time-stamps, duration and the nature of the use. These data can be obtained in a similar way as was described for item 1 above.

[0072] 6. Service Status and Term on Information.

[0073] This may include time-stamped information on the initiation of the service, time-stamped information on any status changes occurring during service and time-stamped information on the termination of the service. The termination information should include the reasons for termination.

[0074] These data can be obtained in a similar way as was described for item 1 above. In particular, the H.245 endSessionCommand message and the Q.931 call termination messages, the call clearing messages on the SS7 links and the ISDN D channels can provide details on the reasons for call termination.

[0075] 7. Additional Service Quality Information.

[0076] The service quality information provided is dependent on the service indicated in the service type field. The following gives some examples of what can be provided for specific services.

[0077] Voice quality is mainly indicated by the bit error rate, jitter and delay. These parameters can be measured using a passive monitoring system and monitoring at two points in the network. Signalling information can be used to identify the logical channels on the PDN, the ISDN B channels or the time slots on SCN trunks, that are carrying the voice signals. The bit streams from each of the channels or trunk time slots identified can be compared to derive the delay, jitter and bit error rate caused by the intermediate networks.

[0078] 8. Service Usage Information.

[0079] The type of usage data provided by the distributed monitoring system depends on the specific service. Some examples follow.

[0080] Voice, video and fax services require call duration and used bandwidth.

[0081] The data oriented services require data such as total bits, frames and packets in each direction. This may be provided for regular time intervals for the duration of the service. It may also be broken down into a traffic matrix, where the data protocol has additional addressing information (such as IP addresses). The data are obtained in a similar way as is described for item 1 above.

[0082] 9. Security Information.

[0083] A particular instance of service usage may be an attempt to obtain unauthorised access to resources. The service record includes information which may indicate this type of behaviour. This may include information about the duration of call, the way the call was terminated and details of the service used.

[0084] An example would be where there are repeated failed attempts to gain access to different resources.

[0085] The data that populates the service records described in the previous section can be collected in real-time from the monitoring probes. These data can be provided in real-time on remotely connected computers, as they become available. A user of the distributed monitoring system can apply filtering criteria on any of the information described in the previous section, to select those instances of service use for which real-time updates are required.

[0086] Any of the data extracted from the signaling messages can be used to match criteria set by the user of the monitoring system and trigger some or all of the logical channels to be captured in their entirety. This technique can be used to provide a wire-tap capability, which would allow real-time copies of the media streams to be routed through the monitoring system to a thud party, or stored for analysis. The filtering could also be on characteristics in the media stream (for example, a specific spoken word in an audio stream) which, if matched, would trigger the capture of all the service record information from the signalling messages, as described earlier.

[0087] The following applications can be implemented using the data from the service records described above or the real-time service updates. Data from other sources may be used to enhance the effectiveness of these applications.

[0088] A. Quality of Service and Service Level Agreements.

[0089] The service records described above can be used to provide service quality information on selected customer's service. This can be used to track conformance to service level agreements, and be provided to the customer as an additional service. It can be provided as periodic reports, or in real-time using the real-time updates described above.

[0090] B. Surveillance and Troubleshooting for Network Operations.

[0091] The service records and real-time updates can be used to identify service or network faults. The information can also be used to troubleshoot the faults.

[0092] C. Fraud Detection.

[0093] The service records and real-time updates can be used to identify potential fraudulent use of the network or service. Indications may include excessive use of high value services, unusual call termination behaviour and repeated failures to gain access to a service. The distributed monitoring system may be used to track the service usage of potential high-risk users in real-time.

[0094] D. Security and Hacking Detection

[0095] Potential security threats can be identified by repeated failures to gain access to a service. They also may be indicated by successful access to sensitive services, such as maintenance ports on customer premises equipment (CPE). This type of data is available from the service records and the real-time updates.

[0096] E. Billing Data

[0097] The service records can be used as a basis for billing which is dependent on any of the fields in the service record. This allows, for example, billing to be based on the actual service quality delivered It also enables billing to reflect the nature and generation of the usage of resources on the network, such as intelligent peripherals and databases. The billing data could be made available in real-time.

[0098] F. Customer Accounting Data

[0099] The detailed service usage information in the service records can be provided to customers for use in their internal accounting. This includes the traffic matrix information for packet and fame based protocols, which the system derives from the B and D ISDN channels.

[0100] G. Customer and Telecom Operator Network Planning

[0101] The service records can provide detailed information on the use of network resources which can be provided to network planning departments within the operator and the customer.

[0102] H. Wire-tap

[0103] The wire-tap capability described above can be used to provide wire tap services to authorized third parties, and potentially as a trouble shooting tool.

[0104] As noted above, the gatekeeper discovery process is the process an endpoint uses to determine which H.323 gatekeeper to register with. The process can be performed manually or automatically Manual discovery relies on information provided independently to the endpoint, and analysis of the endpoint registration procedure in this case can be used to identify inconsistencies in the available information.

[0105] The discovery process starts when an endpoint multicasts a Gatekeeper Request message (GRQ) to a predetermined address (Discovery Multicast Address). On receipt of such a message a gatekeeper can either accept (Gatekeeper Confirmation message—GCF) or reject (Gatekeeper Reject message—GRJ) the request.

[0106] If several gatekeepers responds positively with GCF messages to the GRQ message, the endpoint is free to choose among them arbitrarily. In this case, analysis of the choice of gatekeeper can usefully reveal if a suitable choice was made, or it can be used to verify assignment policies set by system managers. Analysis of the list of alternative gatekeepers is also worthwhile since it can provide information about network redundancy.

[0107] Rejection messages and no-answers to GRQ messages are valuable since they enable verification of assignment policies as well as investigation of problems related to multicasting.

[0108] Monitoring of the gatekeeper autodiscovery procedure is in this embodiment split into two processes:

[0109] Dispatcher process (FIG. 5); and

[0110] SigProcessing process (FIG. 6).

[0111] Referring to FIG. 5, the Dispatcher process collects all the GRQ, GCF and GRJ signalling messages detected by the link monitoring probes and determines the endpoint to which each refers. Then, as illustrated in FIG. 7, the messages are dispatched to an appropriate SigProcessing finite state machine (FSM) process which coordinates assembly of the data necessary to assess the gatekeeper auto-discovery procedure in relation to a specific endpoint. There need be only a single instance of the Dispatcher process, but several SigProcessing processes can be active at the same time.

[0112] Referring to the state definition language (SDL) chart in FIG. 6, the SigProcessing process consists of an FSM which keeps track of the evolution of the gatekeeper auto-discovery process for a specific endpoint For the sake of clarity and simplicity, the chart has been designed with the assumption that the monitoring system is installed before endpoints start the gatekeeper discovery process. In practice some endpoints might already be in the middle of the gatekeeper discovery process when the monitoring system is first installed. In this case a CTCF or GRJ message is the first to be received in respect of such an endpoint, and the behaviour of the FSM shown in FIG. 6 may be determined at the discretion of the system operator incomplete information may be collected or, alternatively, the signalling information involved may be discarded.

[0113] In relation to an endpoint, the measurements that can be collected and used to assess the overall gatekeeper auto-discovery process include:

[0114] list of available gatekeepers (derived from GCF messages time-stamped and ordered);

[0115] list of gatekeepers that rejected the GRQ request (derived from GRJ messages time-stamped and ordered);

[0116] list of alternative gatekeepers;

[0117] alarms (no answers to GRQ messages; GRQ retransmissions too quick or too numerous);

[0118] warnings (RIP messages, i.e. gatekeepers too slow to answer).

[0119] The 1^stGRQ and the GCF or GRJ can be time-stamped and statistics about response times can be derived.

[0120] Similar statistics can be also obtained for discovery process performance from the point of view of gatekeepers.

[0121] The case of endpoints that do not receive any answer to their GRQs can be worthy of study. Two causes can be identified for this behaviour; GRQs may be seat to a multicast address different from the predetermined Discovery Multicast Address, revealing mis-configuration at the endpoint; or, as shown in FIG. 8, there may be configuration problems within a router causing the router to fail to forward multicast requests from one sub-net to another. Clearly there is also the possibility of network disruption that occurred at the time an endpoint initiated the gatekeeper discovery procedure. For this reason it is important to keep a record of timing information since it allows later correlation with other network events.

[0122] The signalling messages involved in the gatekeeper discovery procedure and, in particular, the fields carrying key data for monitoring this procedure, are summarized below. This summary focuses on the essential fields, though more data can be extracted if desired from the signalling messages in order to provide more complete information about the overall gatekeeper discovery process.

[0123] Gatekeeper Request (GRQ)

[0124] reqSeqNum. This allows correlation with subsequent signalling (GCF and GRJ messages) originated in response to this request.

[0125] rasAddress. Transport address of the endpoint (Registration, Admission and Status—RAS—channel).

[0126] endpointType. This identifies the type of endpoint (useful for consistency checks).

[0127] gatekeeperIdentifier. This should be empty. Otherwise, it contains the identifier of the gatekeeper the endpoint is interested in registering with.

[0128] Gatekeeper Confirmation (GCF)

[0129] reqSeqNum. Must be the same as in the corresponding GRQ message.

[0130] gatekeeperIdentifier. This identifies the gatekeeper that is sending the GCF.

[0131] rasAddress. Transport address used by the gatekeeper for registration and status messages.

[0132] alternateGatekeeper. Prioritised sequence of alternative gatekeepers and related RAS addresses.

[0133] Gatekeeper Reject (GRJ)

[0134] reqSeqNum. Must be the same as in the corresponding GRQ message.

[0135] gatekeeperIdentifier. This identifies the gatekeeper that is sending the GRJ.

[0136] rejectReason. Cause code related to this rejection.

[0137] alternateGatekeeper. Prioritised sequence of alternative gatekeepers and related RAS addresses.

[0138] altGKisPermanent. This indicates if future RAS messages should be rejected to the alternative gatekeepers or not.

[0139] The endpoint registration procedure is complementary to the gatekeeper discovery procedure, and enables an endpoint to join a “zone” managed by a chosen gatekeeper and inform the gatekeeper of its Transport Address and Alias addresses. Monitoring of this procedure enables the zone managed by one gatekeeper to be independently determined. It also allows correlation of the information gathered during monitoring of the gatekeeper discovery procedure in order to assess the choice of specific gatekeeper by an endpoint.

[0140] Registration is mandatory and must be done before any call is attempted. Furthermore, it may occur periodically according to the gatekeeper's policy. It might happen that the frequency of the registration process is very low and that therefore signalling related to the registration process is rarely captured. As an alternative monitoring of the admission procedure (eg. according to recommendation H.225) can be used to create similar information to that gathered through monitoring of the registration process.

[0141] The registration process involves only three signalling messages; usually it follows the gatekeeper discovery process. An endpoint sends a Registration Request message (RRQ) to a gatekeeper, using the gatekeeper's RAS address, which is known from the previous gatekeeper discovery process. On receipt of such a message the gatekeeper can either accept or reject the request and replies with a Registration Confirmation (RCF) or Registration Reject (RRJ) message, respectively. Reasons for rejection of the registration can include ambiguous registrations and security issues.

[0142] The registration process can be periodically repeated since each registration may have a file life. Moreover, updates in an endpoint's Transport Addresses and/or Alias addresses are notified through new registrations.

[0143] Closely related to the registration process is the unregistration process, by which and endpoint and a gatekeeper cancel the relationship which exists between them. Either an endpoint or a gatekeeper can initiate it. It also consists of three messages. The Unregister Request (URQ) message triggers the procedure. If initiated by a gatekeeper the endpoint has to acknowledge it by replying with an Unregister Confirmation (LCF) message. If initiated by an endpoint the gatekeeper might reply with an Unregister Reject message (URJ). This might be due to the fact that the endpoint was not in fact previously registered with this gatekeeper. The unregistration procedure may or may not he invoked before a re-registration.

[0144] A gatekeeper must keep a one-to-one mapping between Transport and Alias addresses. Changes of both Transport and Alias addresses at once can occur and they should be preceded by use of the registration procedure.

[0145] Monitoring of the registration procedure is valuable for several reasons. It can provide information needed to define zones and provide a mapping between Transport Addresses and Aliases. Furthermore, security policies can be monitored and verified and, eventually, fraud or fraud attempts discovered. Gatekeeper load balance can also be usefully analysed. Finally, mapping of the endpoints that belong to a zone in conjunction with depiction of the physical representation of the network topology (e.g. derived using auto-discovery facilities in the Hewlett-Packard OpenView network management tool) can be extremely useful to identify network problems such as connectivity bottlenecks or unsuitable gatekeeper choices.

[0146] As mentioned earlier, the admission procedure can be used similarly to the registration procedure to generate data about the zone discovery. In this case, algorithms similar to those described herein can be used by replacing RRQ with ARQ, RCF with ACF and RR with ARJ, respectively.

[0147] Processing of the registration and unregistration signalling is split into two. A first Dispatcher process (shown in FIG. 9) recogniser if any of the registration or unregistration messages that are captured refers to any endpoint already registered or in the process of doing so. As illustrated by reference again to FIG. 7, the Dispatcher process also dispatches the signalling message to one of two SigProcessing processes which extract the data necessary for zone discovery. SDL charts for these two processes are shown in FIG. 10 (registration) and FIG. 11 (unregistration), respectively.

[0148] The measurements that can be collected in this way and used to generate data about zones include:

[0149] endpoint⇄gatekeeper relationship (dynamic relationship);

[0150] Transport Address⇄Alias Address correspondence (dynamic relationship);

[0151] gatekeeper load balance;

[0152] alarms (no answers to request messages);

[0153] warnings (RIP messages, i.e. gatekeepers too slow to answer);

[0154] mapping of a zone over the physical network topology;

[0155] assessment of the choice by endpoints of the gatekeeper to register with;

[0156] analysis of rejections of registration and unregistration attempts.

[0157] The endpoint-gatekeeper relationship is a temporal relationship which has a related start and end time. Similarly, the identification of endpoints through Alias and Transport Addresses is dynamic and it must be associated with timestamps. Consistency checks should preferably be carried out to verify that a unique mapping exists between an Alias Address and the related Transport Address.

[0158] It is possible to highlight cases of endpoints that do not receive any answer to RRQ or URQ messages. This might be due, for example, to the use of an incorrect gatekeeper RAS address. The information gathered about the registration procedure can be used to assess the choice of gatekeeper with which endpoints register and, ultimately, to determine abnormal configurations.

[0159] Moreover, it is useful to map zones relative to physical network topologies. For example, FIG. 12 shows two sub-nets, each with a gatekeeper and several endpoints. More specifically, two endpoints in the sub-net A are registered with a gatekeeper GK_Bthat is associated with another sub-net, sub-net B. This may be a desirable behaviour justified by gatekeeper load balancing policies. However, it might also be anomalous behaviour.

[0160] With regard to gatekeeper load balance, FIG. 13 shows schematically the traffic between the endpoints and the gatekeepers on the same sub-net. Clearly load imbalance exists between the two gatekeepers. As in the previous case, this may be a desirable behaviour. But it might also reveal the existence of a situation that does not match the desired policy put in place by the system administrator.

[0161] Rejection messages, such as RRJ or URJ, can be useful to highlight either configuration or security related problems, e.g. fraud attempts.

[0162] The signalling messages involved in the registration and unregistration procedure and, in particular, the fields that carry the key data for the monitoring of these procedures, are summarized below:

[0163] Registration Request (RRQ)

[0164] requestSeqNum. Monotonically increasing number unique to the sender.

[0165] discoveryComplete. Set to TRITE if the registration follows the gatekeeper discovery process. It could happen that when a registration ages, the gatekeeper discovery has to be invoked before attempting a new registration. This is one possible reason for rejecting an RRQ or ARQ.

[0166] callSignalAddress. Call signalling address for the endpoint.

[0167] rasAddress. Transport address of the endpoint (RAS channel).

[0168] terminalType. This identifies the type of endpoint (useful for consistency checks).

[0169] terminalAlias. This should be empty. Otherwise, it contains a list of Aliases to identify the endpoint.

[0170] Gatekeeperidentifier. The gatekeeper with which the terminal wishes to register.

[0171] alternateEndpoints. A sequence of endpoint alternatives for CallSignallingAddress, rasAddress, termninalType, or terminalAlias.

[0172] Registration Confirmation (RCF)

[0173] requestSeqNum. Same value as for the RRQ.

[0174] callSignalAddress. Transport Addresses for H.255.0 signalling.

[0175] terminalAlias. A list of Alias Addresses assigned by the gatekeeper by which other terminals identify the endpoint.

[0176] GatekeeperIdentifier. The gatekeeper that has accepted the endpoint registration.

[0177] timeToLive. Duration of the validity of the registration.

[0178] preGrantedARQ. Special pre-granted permission to make phone calls.

[0179] Registration Reject (RRJ)

[0180] requestSeqNum Same value as for the RRQ.

[0181] rejectReason. The reason for the rejection of the registration.

[0182] GatekeeperIdentifier. The gatekeeper that has rejected the endpoint registration.

[0183] alternateGatekeeper. Sequence of prioritised alternative gatekeepers with which to retry requests.

[0184] altGKisPermanent. True or False. Indicates if all subsequent messages are to be redirected to the alternative gatekeepers.

[0185] Unregistration Request URQ

[0186] requestSeqNum. Monotonically increasing number unique to the sender.

[0187] callSignalAddress. Call signalling address for the endpoint.

[0188] reason. Reason for the unregistration initiated by the gatekeeper.

[0189] Unregistration Confirmation (UCF)

[0190] requestSeqNum. Same value as for the URQ.

[0191] Unregistration Reject (URJ)

[0192] requestSeqNum. Same value as for the URQ.

[0193] rejectreason. The reason for the rejection of the unregistration.

[0194] alternateGatekeeper. Sequence of prioritised alternative gatekeepers with which to retry requests.

[0195] altGKisPermanent. True or False. Indicates if all subsequent messages are to be redirected to the alternative gatekeepers.

[0196] In this first example it is assumed that:

[0197] the underlying network is an IP network, TCP is used to provide reliable connections and UDP is used to provide unreliable connections;

[0198] the two endpoints communicate directly without the use of a gatekeeper—this simplifies the process because the Call Signalling Channel uses a “well-known” TSAP identifier (specified in recommendation H.225); the case where the Call Signalling Channel is identified through an interaction with a gatekeeper is described in Example 2 below;

[0199] there are only two endpoints, which initiate one or more audio or video connections using Real Time Protocol (RTP);

[0200] the call is not modified during the session, for example by adding new participants or requesting changes in bandwidth;

[0201] the Call Signalling Channel remains open for the duration of the session, and a RELEASE COMPLETE message is used to terminate the session.

[0202] The finite state machine processes required to monitor this type of session are as follows:

[0203] 1. Call Signalling Channel FSM (see FIG. 14)

[0204] This monitors all links continuously looking for a reliable-connection setup (for example, the SYN of a TCP connection) using the well-known TSAP identifier for the Call Signalling Channel. In response to a Call Signalling Channel being established, this process initiates a new Call Signalling Message FSM (CSM-FSM—see item 2 below) to monitor the Channel and passes to it the transport addresses of the two endpoints.

[0205] 2. Call Signalling Message FSM (see FIG. 15)

[0206] This is initiated to monitor a specific Call Signalling Channel, and is terminated when the reliable connection is terminated for that Channel (for example, by the FYN of the TCP connection). It continuously monitors the Channel for signalling messages. A SETUP message indicates the start of a new call, and causes We process to create a new service detail record (SDR) for the call The call identifier is used to uniquely identify the service detail record for the duration of the call, and to identify subsequent call signalling messages. The service detail record is populated with a time stamp, and any useful fields from the SETUP message.

[0207] The CONNECT message sent from the called endpoint normally carries the transport addresses to be used for the H.245 Control Channel. In response to this message an H.245 Control Channel FSM (HCC-FSM—see item 3 below) is started, to monitor the H.245 signalling for the session. The service detail record is populated with an additional time stamp if required, and any of the useful fields from the CONNECT message.

[0208] A RELEASE COMPLETE message indicates the termination of the session. The service detail record is updated with any relevant data and time stamps, and then closed. The H.245 Control Channel FSM monitoring the H.245 signalling is terminated. However, monitoring for subsequent signalling messages is continued in order to capture further calls between the two endpoints.

[0209] The main paths in this FSM are shown in FIG. 15; however in the interests of clarity error conditions have been omitted. The capture of other signalling messages, particularly those involved in modifying calls, could also be captured and used to update the service detail record with additional information and time stamps. It may also be required to initiate further FSMs to monitor other aspects of the call

[0210] 3. H.245 Control Channel FSM (see FIG. 16)

[0211] This is initiated from the Call Signalling Message FSM and monitors all messages on the H.245 Control Channel for the duration of the call. The FSM is terminated by the detection of an endSessionCommand message on the H.245 Control Channel. Logical channels are opened and closed using the openLogicalChannel and closeLogicalChannel messages. The FSM detects the opening of a Channel, extracts the relevant data and initiates two new FSMs to monitor the forward and reverse Real Time Control Protocol (RTCP) connections (RS-FSMs—see item 4 below). A logical Channel is uniquely identified by the Logical channel Number (LCN). This is used to identify the RS-FSMs to be terminated when the closeLogicalChannel messages are received.

[0212] The main process paths are indicated in FIG. 16; however there are many more messages on the Control Channel which could be captured to provide additional information in the service detail record.

[0213] 4. RTCP Session FSM

[0214] The RTCP connection provides detailed information on the performance of the RTP connection that it controls. This can be captured as required to provide quality of service information in the service detail record. The RTP stream itself may be monitored at multiple points in its path to make quality of service measurements which can be added to the service detail record.

[0215] When a gatekeeper is involved the Call Signalling Channel may no longer be cared on the well-known Transport Address; instead a dynamic TSAP identifier which the endpoint obtains from the gatekeeper may be used. The FSM for this situation is shown in FIG. 17. This process uses the information about gatekeepers and endpoints acquired during the gatekeeper discovery process. The RAS Channel between all gatekeepers and endpoints is continuously monitored for control messages. An Admission Request (ARQ) followed by an Admission Confirmation (ACF) means that the endpoint has requested to setup a call and has been allowed to do so by the gatekeeper. The Transport Address which will be used for the Call Signalling Channel can be obtained from the Admission Confirmation message. A Call Signalling Message FSM is initiated to monitor the reliable connection for that Transport Address. The remainder of the processing proceeds in a similar manner to Example 1.

[0216] The example in FIG. 17 shows the generic case of simply identifying the Call Signalling Channel. It is straightforward to extend this to include the creation of the service detail record in response to an Admission Request message from the endpoint to the gatekeeper. This enables the creation of service detail records which include information and time stamps taken from the call related messages on the RAS Channel. It also enables the generation of service detail records in the case where an Admission Reject message is received and no Call Signalling Channel is ever established.

[0217] The presence of gatekeepers may also affect the call clearing process. Typically a disengage request (DRQ) message is transferred between the endpoint and the gatekeeper as part of the call clearing process.

[0218] The Call Reference Value (CRV), in cases where it is implemented by vendors, can be used throughout the call as a unique identifier for all the messages.

[0219] The processes described above can be split in many different ways between the probes and the other processors in the Distributed Management Infrastructure. There are established methods for choosing how to distribute the processing; the Hewlett-Packard acceSS7 architecture provides one example of how this may be achieved.