Network traffic analyzing and monitoring locations in the IP Multimedia

Subsystem

Tomi Räty, Jouko Sankala and Markus Sihvonen

VTT Technical Research Centre of Finland, P.O. Box 1100, 90571-Oulu FIN,
NetHawk Oyj, Eletroniikkatie 2, 90570-Oulu FIN
{Tomi.Raty, Markus.Sihvonen}@vtt.fi, [email protected]

Abstract parameters in a network. [10] Koucheryavy, Krendzel,

Lopatin and Harju proclaim that when provisioning
A network analyzing and monitoring tool can be multimedia services pertained on IP technologies one
placed into the IMS to survey the protocol of the main aspects is assuring the Quality of Service
communication of SIP, SDP, UDP, RTP and RTCP. (QoS). [11]
Once a connection between the endpoints of
communication is formed, the network analyzing and Based on the remarks above, a network analyzing
monitoring tool can monitor the network protocol and monitoring tool would be an asset for surveying
communication traffic. The research problem of the the network for QoS attributes. Placing a network
paper is to discriminate the feasible placements of analyzing and monitoring tool into the IP Multimedia
network analyzing and monitoring tool to survey the Subsystem (IMS) can be used to survey the Session
protocol communication in IMS. The research is based Initialization Protocol (SIP) communication. After a
on the constructive method of the related publications SIP connection is formed, it can analyze the network
and technologies and the results are derived by the communication traffic (e.g. evaluate the total length of
abstractive analysis of the available material. The each User Datagram Protocol (UDP) datagram). By
placement of the tool can be either at 1) the endpoints surveying the SIP connections, singular calls can be
or 2) the common point(s) of the endpoints identified and categorized and then the traffic
communication path. evaluation could be performed on a single call basis. It
is not required that the SIP communication needs to be
monitored, but if it is not monitored, the Source
1. Introduction Addresses and the Destination Addresses need to be
constantly viewed, in order to associate the inbound
As Wong and Varma denote regarding the network and outbound information (e.g. total length) to the
operator perspective that there are both advantages and appropriate calls. If the SIP traffic is primarily
disadvantages in the provision of basic Internet monitored, then the classification into single calls is
Protocol (IP) connectivity. One advantage is that even facilitated. Once a certain type of protocol utilization is
if network operators want to enter the applications identified, it could be passed to the appropriate
business, defining profitable services is hard to protocol handler of the network analyzing and
achieve. The network should be open for third-party monitoring tool. Our research proves that the
applications. This approach will provides connectivity placement of the network analyzing and monitoring
and also enables flexibility for different services to be tool can be either 1) the endpoint(s), which are the
employed. A drawback would be the fact that careless User Agent Client (UAC) or the User Agent Server
reuse by subscribers of IP multimedia applications (UAS) or 2) the common point(s) of the endpoints,
originally created for the non-wireless environment which are the Proxy - Call Session Control Function
may result in quality issues and customer (P-CSCF) or the Serving - Call Session Control
dissatisfaction. Stereotypes of the lack of reliability of Function (S-CSCF), where the Record-Route can be
wireless networks may be prolonged, which results in applied in order to maintain the proxies on the SIP
the loss of customers/revenue. [9] Terplan states the signaling path of the endpoints. The Session
intention of network monitors is to continuously Description Protocol (SDP) message can be extracted
measure and analyze the most important control from the SIP message and handled according to SDP

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 messages, and the SDP message denotes the type of Du distinguishes two network management systems, 1)
media communication, such as UDP or Real-time a centralized management system, and 2) a distributed
Transport Protocol (RTP). The appropriate handlers management system. Centralized management has a
(e.g. UDP or RTP) would be notified for the media single point of failure and do not scale to larger
session extraction. Due to the fact that the Record- networks, because the computational power of the
Routing keeps the proxy in the SIP communication center point needs to be huge. By distributing the
path for the entire duration of the session, a change in network management, scalability and flexibility are
the media session communication would be detected at enhanced. The data processing can be set closer to the
the SIP communication level (through the SDP) and location of the data. Bottlenecks related to centralized
the endpoints would be able to be aware of the management are eliminated. The distributed
modification and the network analyzing and management is more robust, because it does not rely on
monitoring tool would be able to switch its state the central network management and continuous
according to protocol in use (e.g. to extract, copy or communication in the network. [17]
analyze protocol level information). The protocol
information of the media session, RTP and RTP 3. Session Initialization Protocol
Control Protocol (RTCP), can be either monitored at
the endpoints or by having the clients multicast the Numerous Internet applications require the creation
media session to the common point(s). and management of a session, where a session is
considered being an exchange of information among a
2. Monitor placement and motivation relationship of participants. The applications are
complex, because the participants may 1) convey
Tham, Jiang and Ko suggest that the intention of QoS between endpoints, 2) be addressable by a multitude of
monitoring research is to enable a network manager to names and 3) communicate, possibly simultaneously,
track the current QoS, compare monitored QoS against with different media. Many protocols can transmit
expected performance, detect possible degradation and different forms of real-time multimedia session data.
then tune the network resources to maintain the SIP operates harmoniously with these protocols by
delivered QoS. The real-time flow of multimedia enabling Internet endpoints (user agents) to locate each
applications may traverse through multiple network other and decide on the traits of a session that they
segments, which offer different levels of QoS. In order want to share. In order to discover viable session
to locate the segment(s) of possible degradation, QoS participants and other functions, SIP enables the
monitoring should be based on QoS distribution creation of an infrastructure of network hosts (proxy
monitoring instead of end-to-end monitoring. QoS servers) to which user agents can submit registrations,
information can be directly retrieved from RTCP invitations to sessions and other requests. SIP is a
messages, with RTCP monitors. The QoS information quick, generic-purpose tool for establishing, modifying
is obtained from sender(s) and receiver(s), thus only and ending sessions, which function independently of
end-to-end QoS can be monitored. [14] the underlying transport protocols and independent of
the session type being created. [3]
Jiang, Tham and Ko proclaim the mechanisms for QoS
monitoring can be categorized into two classes SIP is an application-layer management protocol
according to the QoS information that can be acquired that can generate, modify and terminate multimedia
from them: 1) end-to-end monitoring and 2) QoS sessions. SIP can invite participants to sessions that
distribution monitoring. In the end-to-end QoS already exist. Media can be removed from, or added to,
monitoring approach, only the end-to-end QoS among a prevailing session. SIP supports the mapping of
the sender and receiver of a real-time flow is names and redirection services transparently. These
monitored. The QoS distribution monitoring approach, services support personal mobility, hence the users can
the different network segments are monitored in uphold a single externally visible identifier regardless
addition to the end-to-end QoS. [15] of their actual location in the network. [3]

Shan and Li state that existing proposals for measuring The details of the session (e.g. the type of media)
network performance characteristics generally are not depicted using SIP. The body of a SIP message
postulate that the measurement instrumentation can be includes a description of the session, which is encoded
either distributed at different points in the network or in some other protocol format. One of such formats is
placed at the endpoints of the end-to-end path. [16] SDP. This SDP message is conveyed by the SIP

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 message in a manner which is analogous to a document 3.1 SIP Servers
attachment being conveyed by an email message. [3]
SIP servers are applications, which accept SIP
A proxy server receives SIP requests and forwards requests and respond to the SIP requests. A SIP server
them in behalf of the requestor. After the call set up should not be confused with a user agent server or the
has been performed and the two-phase exchange has client-server characteristics of the protocol, which
provided the basic negotiation capabilities of the media renders operation in terms of clients (originators of
session (see figure 2), the media session has begun and requests) and servers (originators of responses to
the two parties transmit media packets utilizing the requests). A SIP server is a different kind of logical
format to which they previously agreed to. Generally, entity. Real SIP server implementations may contain a
the end-to-end media packets take a different route different number of server types, or may act as a
from the SIP signaling messages. Disconnection also is different server type under certain circumstances.
routed directly between the endpoints, thus bypassing Servers offer services and features to user agents,
the proxies. [3] therefore they must support both TCP and UDP for
transportation. [7]
There are cases where it may be useful for proxies
in the SIP signaling path to perceive all the messaging 3.2 Proxy servers
between the endpoints for the duration of the session.
For example, if a proxy server would desire to remain The majority of SIP requests are end-to-end
in the SIP messaging path beyond the initial INVITE messages between user agents. To be more elaborate,
message, it would add to the INVITE a required proxies between two user agents simply forward the
routing header file, which is known as the Record- messages they receive and rely on the user agents to
Route. The Record-Route contains a Universal create acknowledgements or responses. [7] A SIP
Resource Identifier (URI) resolving to the hostname or proxy server that receives a SIP request from a user
IP address of the proxy. Briefly, the Record-Route agent acts in behalf of the user agent in responding to
header field is added by proxies in a request to force or forwarding the request. Typically, a proxy server
the future requests of the dialog to be routed through has access to a database or location service to assist it
the proxy. [3] in handling the request (e.g. determining the next hop).
A proxy server is separate from a user agent or a
A proxy is discriminated to be loose routing if it is gateway in two distinct ways [7]: 1) a proxy server
according to the procedures of its specification for does not issue a request, it only responds to requests
handling the Route header field. These procedures from a user agent. (A CANCEL request is an exception
distinguish the destination of the request from the set to this rule), or 2) a proxy server does not contain
of proxies that need to be visited along the path. A media capabilities.
proxy that is complies with these mechanisms is
known as a loose router. [3] The 3GPP IP Multimedia As perceivable from figure 1, all the protocols of
Call Control Protocol based on SIP and SDP states that the application layer and above reside on top of the
each IP Multimedia (IM) Core Network (CN) Internet layer (IP). These protocols contain the
subsystem functional entity shall apply the loose essential protocols apposite to IMS, which are RTP,
routing policy denoted in RFC 3261 [3], when a SIP including RTCP and SDP. Therefore, by tapping into
request is processed. [12] the transport layer, generic information can be obtained
regardless of the high-level protocol being employed.
A user agent delineates an end system. It includes a In addition to this, certain protocol specific information
UAC, which creates requests, and a UAS, which can be obtained. For instance, every RTP timestamp
responds to the requests. A UAC is able to generate a can be retrieved. The Internet media type of the
request based on some external stimulus and handling message body needs be given by the Content-Type
a response. A UAS is able to receive a request and header field. [3]. The Content-Type header field needs
generate a response based on user input, external to be present if the body is not empty. If the body is
stimulus, the result of a program execution or some empty, and a Content-Type header field is present, it
other mechanism. When a UAC transmits a request, denotes that the body of the specific type has zero
the request conveys through a number of proxy servers, length. [3]
which forward the request to the UAS. When the UAS
generates a response, the response is forwarded to the
UAC. [3]

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 3.3 Analyzing and monitoring locations for
SIP traffic 4. IP Multimedia Subsystem
Hence, the protocol that will be employed in the The IP Multimedia core network subsystems
communication can be resolved (e.g. application/sdp) comprise of core network components for provisioning
and additional processing can be applied according to multimedia services. This includes the set of signaling
the utilized protocol. For instance, the SDP message and bearer associated network designated in 3GPP TS
can be extracted from the SIP message and handled 23.002. IP multimedia services are based on an IETF
according to SDP messages. The SDP message denotes determined session control capability which employs
the type of media communication (e.g. UDP or RTP). the IP-Connectivity Access Network with other
The appropriate handlers (e.g. UDP or RTP) would be multimedia bearers. [1] & [2]
notified for the media session extraction.
Attaining access independence and sustaining a
Due to the fact that the Record-Routing keeps the smooth interoperation with wireline terminals over the
proxy in the SIP communication path for the entire Internet, the IP multimedia endeavors to accord to the
duration of the session, a change in the media session IETF (Internet Engineering Task Force) "Internet
communication would be detected at the SIP standards". The interfaces defined to correspond as
communication level through the SDP. The endpoints much as feasible to IETF "Internet standards" for the
would be able to be aware of the modification and the cases where an IETF protocol has been chosen. [2] 3G
network analyzing and monitoring tool would be able Packet-Switched (PS) multimedia terminals provision
to switch its state according to protocol in use. real-time video, Speech Enable Service (SES), audio or
data, in any kind of combination or even none, over
3GPP IMS. The terminals are based on IETF specified
multimedia protocols, which are SIP, SDP, RTP and
RTCP. [13]

4.1 Core entities of the IP multimedia

subsystem

The P-CSCF is the first point of contact within the

IM CN subsystem. The P-CSCF acts like a proxy, i.e.
it accepts requests and services them internally or
forwards them on. The P-CSCF shall not change the
Request URI in the SIP INVITE message. The P-
CSCF may act like a User Agent (UA), i.e. in the case
of abnormal situations it may terminate and
Figure 1. The Internet Multimedia Protocol independently create SIP transactions. [2]
stack. [7]
The S-CSCF does the session control services for
the User Equipment (UE). It upholds a session state as
required by the network operator for support of the
services. Within an operator's network, different S-
CSCFs may have different kinds of functionalities. A
few functionalities performed by the S-CSCF are the
ensuing:
‚ registration, S-CSCF may act as a Registrar,
‚ session-related and session-unrelated flows, S-
CSCF may act as a Proxy Server or as a User
Agent,
‚ endpoint destination, S-CSCF forwards a SIP
request or response to a P-CSCF for a mobile
terminated procedure to a home user within the
home network, or for a user roaming inside a
Figure 2. A simple example of SIP. [7] visited network where the home network

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 operator has chosen not to have an between the two endpoints cannot be surveyed because
Interrogating-CSCF (I-CSCF) in the path [2]. that connection will be end-to-end.

An Application Server (AS) provisions value added 5. Session Description Protocol over SIP
IP multimedia services. It is located either in the user's
home network or in a third party location. The third SDP was developed with the intention of scheduled
party can be a network or simply a stand-alone AS. [2] multicast sessions. Many of the fields have small or no
meaning in the context of dynamic sessions generated
using SIP. To maintain compatibility with the SDP
protocol all of the fields must be included. A typical
SIP use of SDP contains the version, origin, subject,
time, connection and one or more media and attributes
fields. The origin, subject, and media and attribute
Figure 3. The endpoints of the IMS and their fields are not utilized by SIP, but are included for
most relevant connections. [2] compatibility reasons. [7]

4.2 Analyzing and monitoring locations in SIP employs the connection, media and attributes
IMS fields to initialize sessions between user agents. The
types of media session and codec to be employed are
Based on the two preceding diagrams and the part of the connection negotiation, therefore SIP can
protocols used in IMS the network analyzing and employ SDP to designate multiple alternative media
monitoring tool could be placed into four viable, types and to selectively accept or decline those media
different locations, which are essential components of types. When multiple media codecs are listed, the
the IMS: 1) UE, 2) P-CSCF, 3) S-CSCF or 4) AS. caller and called party's media types need to be
There are different target scenarios that can be attained aligned. If the number and order of the media fields are
by placement of the network analyzing and monitoring not maintained, the calling party would not know for
tool. If it is set in the UE, in could be used as the end certain which media sessions were being accepted and
user's personal register that collects traffic information declined by the other party. [7]
of the phone. If it placed in the AS and the AS is a
service provider outside the operator's network, then The specifics of the session, such as the type of
the network analyzing and monitoring tool could be media, codec, or sampling rate, are not depicted using
used as previous described, as a personal register that SIP. The body of a SIP message contains a description
collects traffic information. The P-CSCF and S-CSCF of the session, which is encoded in another protocol
reside in the operator's network, and the operator may format. One of such a format is the SDP [6]. This SDP
also place Application Servers in their network also. message is conveyed by the SIP message in a way that
Placing the network analyzing and monitoring tool in is analogous to a document attachment being
the S-CSCF will result in placing the tool in the most transported by an email message, or a web page being
concentrated place as possible from the operator's point conveyed in an HTTP (Hypertext Transfer Protocol)
of view. Two feasible scenarios can be identified for message. The SDP needs be supported by all user
the placement of the network analyzing and monitoring agents as a means to depict sessions, and its utilization
tool: 1) the endpoints, or 2) the S-CSCF(s) or the for establishing offers and answers has to be according
viable proxies of the endpoints. to the procedures defined in RFC 3264. [3]

If the network analyzing and monitoring tool is 5.1 Analyzing and monitoring locations for
placed on the endpoints, then all the SIP SDP traffic
communication and the media communication can be
surveyed. Both endpoints can survey their own Once the SIP message can be received, the body of
connections and communications. If the network the SIP message can be extracted and the specific
analyzing and monitoring tool is placed on either the S- Internet media type in the message body can be
CSCF(s) or the P-CSCF(s) and the Record-Route is discriminated. Media types have the form of
added to the initial INVITE request, then the S- "type/subtype". If the header is does not exist, then
CSCF(s) and P-CSCF(s) will remain on the SIP "application/sdp" is assumed [7]. After the content type
messaging path for the duration of the session. Thus all has been checked, and it is "application/sdp" then by
the SIP messaging can be surveyed. The media session

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 employing a dedicated API the single fields according from the network analyzing and monitoring tool, which
to the SDP protocol can be extracted. is placed in the S-CSCF(s) or in the P-CSCF(s), the
method explained is applicable to this situation also.
If the SIP communication has been set to traverse Unfortunately, the information that traverses during the
through a certain proxy by applying the Record-Route media session, which is end-to-end, will not go through
header field, then the SDP messages utilized in the SIP the S-CSCF(s) or the P-CSCF(s). In order to collect
communication can also be retrieved and analyzed. this information, the endpoints will require the network
This would correspond to the proposal of placing the analyzing and monitoring tool to reside end in both or
network analyzing and monitoring tool in the S- either endpoint(s).
CSCF(s) or in the P-CSCF(s). The other option of
placing the tool(s) into the endpoints also utilizes the If the SIP communication has been set to traverse
same type of SIP message and SDP message through a certain proxy by applying the Record-Route
extraction. header field, then the UDP messages utilized in the SIP
communication can also be retrieved and analyzed.
6. User Datagram Protocol This would correspond to the proposal of placing the
network analyzing and monitoring tool in the S-
UDP is a simple, datagram-oriented, transport layer CSCF(s) or in the P-CSCF(s).
protocol. Every output operation by a process yields
precisely one UDP datagram, which causes one IP 7. Real-time Transport Protocol
datagram to be transmitted. UDP does not provide
reliability. The protocol transmits the datagrams that RTP offers end-to-end network transport functions
the application writes to the IP layer, but does not accommodative for applications transmitting real-time
assure that the datagrams ever reach their destinations. data over multicast or unicast network services. RTP
[8] does not consider resource reservation and does not
assure quality-of-service for real-time services. The
The UDP is specified to offer a datagram mode of data transport is enhanced by a control protocol
packet-switched computer communications in the (RTCP) to enable monitoring of the data delivery in a
environment of an interconnected set of computer fashion, which is scalable to large multicast networks
networks. The UDP protocol postulates that the IP is and to offer minimal control and identification
employed as the underlying protocol. UDP provisions functionality. Both RTP and RTCP are designed to be
a procedure for application programs to transmit independent of the underlying transport and network
messages to other programs with a minimum of layers. [4]
protocol mechanism. The protocol is not transaction
oriented, and the delivery and the duplicate protection RTP provisions end-to-end delivery services for
are not assured. [5] data with real-time qualities. Those services contain
payload type identification, sequence numbering,
The transport layer has the responsibility for the timestamping and delivery surveying. Typically,
actual transmission of requests and responses over applications run RTP over UDP in order to utilize its
network transports. This contains determining the multiplexing and checksum services. Both protocols
connection to use a request or response in the case of contribute areas of the transport protocol functionality.
connection-oriented transports. Every SIP element RTP may be employed with other accommodative
must be implemented on UDP or TCP. SIP elements underlying network or transport protocols. RTP
may implement other protocols also. [3] supports the data transfer to multiple destinations
utilizing distribution if offered by the underlying
6.1 Analyzing and monitoring locations for network. [4]
UDP traffic
The RTP payload is defined to be the data
The two monitoring situations need to be reflected transported by the RTP in a packet. The RTP packet is
to each protocol separately also. In the case where the a data packet that comprises of the fixed RTP header, a
network analyzing and monitoring tool is set to both possible empty list of contributing sources and the
endpoints, then the tool can extract the UDP payload data. Some underlying protocols may need an
information by first extracting the SIP information, encapsulation of the RTP packet to be specified.
then the possible SDP information and ultimately the Usually, one packet of the underlying protocol includes
UDP information. If the UDP information is collected

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 a single RTP packet, but multiple RTP packets may be distribution monitoring. The monitor function is
included if allowed by the encapsulation method. [4] probably constructed into the application(s)
participating in the session. It may also be in a separate
The RTP session is the relation among a set of application that does not otherwise participate and does
participants which communicate with RTP. For each not receive or send the RTP data packets. They are
participant, the session is specified by a certain pair of known as third-party monitors. [4]
destination transport addresses (one network address
and a port pair for RTP and RTCP). The destination 7.1.1 Analyzing receiver and sender reports
transport address pair may be the same for all
participants (e.g. in IP multicast) or may be unique for The reception of quality feedback will be useful for
each (e.g. in individual unicast network addresses plus the sender, for other receivers and also third party
a common port pair). In a multimedia session, every monitors. The sender may change its transmissions
medium is conveyed in discrete port number pairs based on the feedback; receivers can distinguish
and/or separate multicast addresses. [4] whether problems are local, regional or global;
network managers may employ profile-independent
7.1 RTP Control Protocol monitors, which receive only the RTCP packets and
not the related RTP data packets to estimate the
The RTCP is based on the periodic transmission of performance of their networks for multicast
control packets to all the participants in the session, by distribution. [4]
utilizing the same distribution method as the data
packets. The underlying protocol needs to offer Sender reports (SR) or receiver reports (RR) packets
multiplexing of the data and control packets (e.g. are transmitted most frequently. The utilization of
utilizing separate port numbers with UDP). The reports enables feedback on the quality of connection
primary function performed by RTCP is to offer containing information such as: 1) the number of
feedback on the quality of the data distribution. This packets sent and received, 2) the number of packets
feedback function is performed by the RTCP receiver lost, and 3) the packet jitter [7].
and sender reports. With a distribution mechanism like
IP multicast, it is contingent for an entity, such as a In a multimedia session generated with SIP, the
network server provider, who is not participating in the information required to choose codecs and transmit the
session to receive the feedback information and act as a RTP packets to the correct location is conveyed in the
third party monitor. [4] SDP message body. In some scenarios, it can be
desirable to modify the codecs during an RTP session.
RTCP monitors the quality of service and carries Switching codecs in general should not be performed
information about the participants in an on-going without a SIP signaling exchange (re-INVITE),
session. This latter trait may be enough for "loosely because the call could fail if one side switches to a
controlled" sessions (i.e. if there is no explicit codec that the other does not support. The SIP re-
membership control and set-up), but it is not meant to INVITE message exchange enables this change in
support all of an application's control communication media session parameters to fail without causing the
requirements. [4] established session to fail. [7]

RTCP packet is distinguished to be a control packet 7.2 Analyzing and monitoring locations of
comprising of a fixed header part similar to that of the media session
RTP data packets, succeeding with structural elements,
which vary depending on the RTCP packet type. The media session is end-to-end. Therefore the only
Usually, multiple RTCP packets are transmitted RTP related issues that will be in the path of the SIP
together as a compound RTCP packet in a single communication, even if the Record-Route is applied,
packet of the underlying protocol. This is enabled by will be contained in the SDP. An example of this is the
the length field in the fixed header of every RTCP definition of the codecs of the RTP communication. In
packet. [4] order for the network analyzing and monitoring tool to
monitor the RTP communication, it must reside on
A monitor is declared to be an application, which either end of the communication path. There is a slight
receives RTCP packets transmitted by participants in augmentation to this procedure, according to the
an RTP session. To be more elaborate, the application primary function of the RTCP, utilizing a distribution
receiving reports, fault diagnosis, long-term statistics mechanism would allow a third party monitor to
and estimates of the current quality of service for

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE
 receive the feedback. Therefore applying a distribution [12] 3GPP TS 24.229 V6.4.0 (2004-09).
mechanism to either or both endpoints that enables the [13] 3GPP TS 26.236 V6.1.0 (2004-12)
network analyzing and monitoring tool in the S- [14] Tham, C-K, Jiang, Y. and Ko, C-C, "Monitoring QoS
CSCF(s) to acquire the feedback information of the distribution in multimedia networks", International Journal of
Network Management 2000, issue 10, p. 75-90, John Wiley
RTP media session would result in the decentralized and Sons.
network analyzing and monitoring tool point(s) of the [15] Jiang, Y., Tham, C-K. and Ko C-C, "Challenges and
major communication in IMS regarding the most approaches in providing QoS monitoring, " International
important protocols of its communication (UDP, SIP Journal of Network Management 2000, issue 10, p. 75-90,
and RTP). John Wiley and Sons.
[16] Shan X. and Li, J.J., "A Case Study of IP Network
8. Discussion and Conclusion Monitoring Using Wireless Mobile Devices", IEEE, 2001.
[17] Du, X., "Toward Efficient Distributed Network
Monitoring", IEEE, 2004.
Positioning the network analyzing and monitoring
tool for information collection is essential to facilitate
acquiring protocol carried knowledge. Ultimately,
there are two scenarios for suitable locations: 1) the
network analyzing and monitoring tool(s) residing in
one or both endpoints, or 2) the network analyzing and
monitoring tool residing in the common point, or at
multiple common points, of the communication path
(e.g. the S-CSCF). In the first case, the protocol
information (i.e. SIP, SDP, UDP and RTP (RTCP)) can
be collected at the endpoints of sending and/or
receiving. In the second case, the SIP communication
can be mandated to go through the common point(s)
for the entire duration of the session. From this
connection the SDP, UDP and the RTP session
initialization related issues can be obtained. In order to
retrieve the entire media session communication (incl.
RTP and RTCP), multicasting to the S-CSCF(s) is
required by the endpoints. The monitoring is according
to the end-to-end monitoring and also the distribution
monitoring; both can be established and utilized
without a single monitoring point.

9. References
[1] 3GPP TS 23.002 V6.5.0 (2004-06).
[2] 3GPP TS 23.228 V6.7.0 (2004-09).
[3] RFC 3261, SIP: Session Initiation Protocol, 2002.
[4] RFC 1889, RTP: A Transport Protocol for Real-Time
Applications, 1996.
[5] RFC 768, User Datagram Protocol, 1980.
[6] RFC 2327, SDP: Session Description Protocol, 1998.
[7] Johnston, Alan B. (2001) Understanding the Session
Initiation Protocol. Norwood, Massachusetts: Artech House,
201 p.
[8] Stevens, W.R. (1994) TCP/IP Illustrated, Volume 1 The
Protocols. Longman: Addison-Wesley, 576 p.
[9] Wong, K. D. and Varma, V. K. "Supporting Real-Time IP
Multimedia Services in UMTS," IEEE 2003.
[10] Terplan, K., "Network Performance Reporting, ACM,
1982.
[11] Koucheryavy,Y., Krendzel, A., Lopatin, S. and Harju J.,
"Performance Estimation of UMTS Release 5 IM-Subsystem
Elements, IEEE, 2002.

Proceedings of the 2005 31st EUROMICRO Conference on Software Engineering and Advanced Applications (EUROMICRO-SEAA’05)
0-7695-2431-1/05 $20.00 © 2005 IEEE