Best Practices for Analyzing VoIP at 10G

www.wildpackets.com© WildPackets, Inc.

Jay Botelho

Director of Product Management

WildPackets

[email protected]

Follow me @jaybotelho

Show us your tweets!Use today’s webinar hashtag:

#wp_timelinewith any questions, comments, or feedback.

Follow us @wildpackets

Network Analysis At 10G

Real-time Statistics and VoIP

Jim Frey

Managing Research Director

Enterprise Management Associates

[email protected]

© WildPackets, Inc. 2A Confluence of Flows

Agenda

• Network Analysis Challenges at 10G

• Network Impacts Amplified by VoIP

• Combining Real-time Statistics And Post-Capture Analysis

• Monitoring and Analysis for Heavily Utilized 10Gig Network

Segments with Mixed Data

• Understanding and Interpreting VoIP Metrics

• TimeLine – Real-time Statistics AND Performance

• Company Overview


Network Analysis

Challenges at 10G


10G: Brave New World for Network Mgt

• 10x higher speeds, but what is impacted?‒ Device Monitoring: not greatly affected

‒ Flow Record Monitoring: increases incrementally

‒ Packet Monitoring: BIG IMPACT

• Early Approach‒ Put 10G interfaces on 1G instrumentation

‒ Worked great as long as 10G links not fully utilized

‒ Total throughput constrained by instrumentation capacity

‒ Typical breakpoint: 2-3 Gbps


10G Driving New Monitoring Architectures

• Performance tools need to be re-architected

• Focus on high-volume, accurate collection and

storage of packet streams

• Can’t afford to miss anything – must assure

complete record

• Moore’s Law helps, but additional optimization

required‒ High capacity NICs

‒ High capacity backplanes

‒ High speed on-board storage

‒ Options for off-board storage for longer captures


Network Impacts Amplified by VoIP


VoIP/RTP: A special netizen

• VoIP and other real-time, interactive IP-based

(RTIPC) communications require special handling

‒Close monitoring of quality required

‒Specific Planning steps required

‒When problems occur, they are Real-Time!


6%

36%

53%

57%

66%

0% 20% 40% 60% 80%

Other (Please specify)

Implementing access controls

Upgrading core network

Implementing QoS policies

Upgrading WAN links

EMA 2009: Sample Size = 47

Which changes has your company made to the network

infrastructure in order to support RTIPC?


35%

76%

76%

88%

94%

0% 20% 40% 60% 80% 100%

R Factor

MOS

Jitter

Packet Loss

Latency


Which of the following quality metrics are you monitoring?


53%

53%

71%

76%

0% 20% 40% 60% 80% 100%

Active (synthetic) agents

Call/session recording for forensic troubleshooting

Passive, packet-based monitoring

Call detail record analysis

Title

What monitoring techniques are you using for RTIPC?



Combining Real-time Statistics +

Post-Capture Analysis


Core Requirements: R/T+Capture for 10G

1. Protect Full Capture‒ Full line-rate streaming capture/storage

‒ Efficient retrieval for analysis

2. Real-time Statistics For Visibility‒ Reactive Workflows

• History + Top N (focuses/accelerates identification)

• Context-based drill-downs (accelerates analysis)

‒ Proactive Workflows• Recent history trending (reveals anomalies / potential issues)

• Top N views (guides issue assessment)

• Context-based drill-down (facilitates investigations)

‒ Metrics/measures appropriate for type traffic/activity• MOS for VoIP

• Bit/Packet/Protocol Volumes for non-real-time types


Monitoring and Analysis for

Heavily Utilized 10Gig Network

Segments with Mixed Data


Typical Network Analysis Workflow

Let It Roll!Alerts/Alarms

User Complaints

Problem?

Connect the Analyzer

Start a TraceReproduce

if Necessary

NO

YES


1Gig Is Easy - Now

• Use almost any NIC

• Use almost any computer

• Capture and analyze all in real-time

• Little or no special hardware needed (taps, etc.)

• Little to no impact on existing network traffic

• ―Analysis on the fly‖ still feasible


10Gig Network Analysis Workflow

Identify Key Analysis Pts

Deploy 24x7 Monitoring

Alarms/Alerts

Problem?

Rewind Data

AnalyzeTune if

Necessary

NO

YES


Understanding and Interpreting

VoIP Metrics


Key VoIP/Video Issues

CAMP IT Pinpointing the Problem 18

JitterLatency

Packet

Loss


Latency's Effects• Talkover

‒ Occurs when excessive latency delays audio

– Conversation cadence is not natural or comfortable

– Callers feel as if they must “push to talk” or say “over” to control the

conversation

• Echo

‒ The speaker’s voice feeds back into the listener’s microphone

‒ The speaker then hears his own voice returning from the listener’s end,

but delayed due to latency

‒ Most callers find it difficult to maintain normal speech when echo delay

is prolonged

‒ Some VoIP systems attempt to cancel echo, but are not always

successful

High latency may also cause additional troubles such as loss of

synchronization between audio and video for multimedia sessions.


Jitter's Effects

• Jitter causes weird ―sound effects‖ that vary with

jitter severity and environmental factors

• Examples include:‒ Static

‒ Stuttering or uneven audio – abnormal speech rhythm

‒ For multimedia systems, video may be “jerky” or irregular

• If jitter levels are high, packet loss can result‒ In some cases, severe jitter may sound similar to packet loss,

even if no packets are actually dropped


Packet Loss Effects

• Causes missing sounds, syllables, words, or phrases

‒ DSP algorithms may compensate for up to 30 ms of missing data

‒ More than 30 ms of missing audio is noticeable by listeners

• An average person speaks at a rate of about 200 words per

minute

‒ That’s 3.33 words/sec = 300 ms per word

‒ For G.711, we would need to lose 15 consecutive RTP packets to lose

a whole word

‒ Dropping 15 packets/sec for G.711 would be a loss rate of 30%

• But losing only a few packets can still be very noticeable

‒ Loss of more than 2 consecutive packets will be heard

‒ Loss rates ≥ 2% will have a strong impact on quality

‒ Losses of 5 – 10% make calls all but intolerable

‒ Bursty periods of packet loss are worse than more dispersed loss


VoIP Dashboard View


Media View


TimeLine – Real-time Statistics

AND

Performance


TimeLine Unique Value Proposition

• Capture every single packet in highly-utilized

networks

• See the most real-time data possible for immediate

assessment of ongoing network performance

• Know exactly when to drill in based on real-time data

displays

• Maximize historical data retrieval efficiency


Fast Network Recording

11 Gbps sustained CTD with zero packet loss


Real-time Statistical Display


Real-time Media Metrics

• Call Quality

• Call vs. Network Utilization


Forensics Search


Forensics Search Results _ VoIP


Company Overview


Corporate Background

• Experts in network monitoring, analysis, and troubleshooting

‒ Founded: 1990 / Headquarters: Walnut Creek, CA

‒ Offices throughout the US, EMEA, and APAC

• Our customers are leading edge organizations

‒ Mid-market, and enterprise lines of business

‒ Financial, manufacturing, ISPs, major federal agencies,

state and local governments, and universities

‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000

• Award-winning solutions that improve network performance

‒ Internet Telephony, Network Magazine, Network Computing Awards

‒ United States Patent 5,787,253 issued July 28, 1998• Different approach to maintaining availability of network services


What We Do

• Provide network visibility and intelligence …‒ WatchPoint, OmniPeek, OmniEngines

• Expert systems – we find the problems for you

• Superior drill-down capability – trouble-shoot from anywhere

• Flexible, customizable, extensible – leverage your investment

‒ Professional services, training, best practices

• For all network segments …‒ Data center to desktop to remote office

‒ LAN, WAN, Wireless …

‒ HTTP, Email, Database, VoIP, Video …

• To …‒ Network engineers; IT Management; Developers


Real-World Deployments

Education

Health Care / Retail

Financial

Telecom

Government

Technology

http://www.fbiband.com/

http://www.dea.gov/


Product OfferingsSoftware and Turnkey Appliances

• Enterprise Monitoring and Reporting‒ WatchPoint Server

‒ OmniFlow, NetFlow, and sFlow Collectors

• Network Probes & Recorders‒ Omnipliance Network Recorders – Edge, Core

‒ TimeLine Network Recorder

‒ OmniAdapter Analysis Cards

• Distributed Analysis Software‒ OmniPeek – Enterprise, Professional, Basic, Connect

‒ OmniEngine – Enterprise, Desktop, OmniVirtual

• Portable Solutions‒ OmniPeek software

‒ Omnipliance Portable


TimeLine Network Recorder11.7Gbps Sustained Capture

• Fastest network recording and real-time statistical

display — simultaneously‒ Network statistics display in TimeLine visualization format

• Rapid, intuitive forensics search and retrieval‒ Historical network traffic analysis and quick data rewinding

‒ Several pre-defined forensics search templates making

searches easy and fast

• A natural extension to the WildPackets product line

• Turnkey bundled solution


Omnipliance Network RecordersPrice/performance solutions for every application

Portable Edge Core TimeLineRuggedized

Troubleshooting

Small Networks /

Remote Offices

Regional Offices /

Small Datacenter

Datacenter

Workhorse

Chassis 1U 3U 3U

Memory 2 GB / 8 GB 4 GB / 8 GB 6 GB / 24 GB 18 GB / 24 GB

Expansion 1 PCI-E / 2 PCI-X 1 PCI-E or 1 PCI-X 4 PCI-E 4 PCI-E

Storage 500 GB / 2.5 TB 1 TB 8 TB 8 TB / 16 TB / 32 TB


Key Differentiators

• High-level network monitoring to root-cause analysis

• Single solution for today’s converged networks‒ Wired, Wireless, 1GB, 10GB, VoIP, Video, TelePresence, IPTV

• Reduce and even eliminate network downtime‒ Automated monitoring 24x7

‒ Speedy resolution of network bottlenecks

• Improve network and application performance

• Uniquely Extensible Platform – tailored to your needs‒ Plug-ins and APIs for integration and customization


Q&A

Show us your tweets!Use today’s webinar hashtag:

#wp_timelinewith any questions, comments, or feedback.

Follow us @wildpackets

Follow us on SlideShare!Check out today’s slides on SlideShare

www.slideshare.net/wildpackets


Thank You!

WildPackets, Inc.

1340 Treat Boulevard, Suite 500

Walnut Creek, CA 94597

(925) 937-3200