SIPFIX: A scheme for distributed SIP monitoring

Voice-over-IP (VoIP) is a key component of next-generation-networks and rapidly becoming more and more common in the Internet in general. This also increases the demand of VoIP operators for a scalable, distributed and flexible monitoring. But current monitoring architectures are either not designed for including application layer protocol analysis and data acquisition, or they are very specific and static, interacting directly with a certain VoIP product and are not integrated into the general network monitoring. Fully based on the new standards of the IP flow information exchange (IPFIX) and the concept of Mediators we specify a monitoring scheme for the session-initiation-protocol (SIP), the most common protocol used for VoIP. Therefore it integrates the acquisition and processing of VoIP traffic measurements into the general traffic monitoring, building a cost-effective cross-layer monitoring system. In use case examples we show how SIPFIX can cope with many challenges and requirements of SIP monitoring, like correlation of SIP and media traffic observed at different probes, Quality- of-Service evaluation, security and integrity checks, Denial-of- Service defense and real-time status reports.