Acme Packet Media (RTP) Troubleshooting

Who loves troubleshooting media issues? Not me. While some issues require a full packet capture, you can find out a number of things from a simple command. Like when you realize put a steering-pool in the wrong vlan…

I find myself using ‘show nat by-addr ‘ frequently. You do need to know the IP from the SDP c=line. A call must also be active when troubleshooting.

Basically this command gives you the VLAN info on the East / West sides from the call. It also provides the port used by the SDP (you can match this with your INVITE / 200OK ). It also displays the init_flow_guard, which in a normal scenario should be 4294967295.

The init_flow_guard is a timer that is set when the SBC receives a final 200OK of an INVITE transaction. If no media is sent, the timer begins to count down. As soon as the NAT table receives a single RTP packet, the ifg changes to 4294967295.

As always, mess around with it on your lab. See what you can discover on your network.
==========
sd1.# show nat by-addr 10.1.1.1

———————————
NAT table search address 801 :
Flow type: Fully qualified flow. Weight = 31
SA_flow_key : 10.1.1.1 SA_prefix : 32
DA_flow_key : 172.1.1.1 DA_prefix : 32
SP_flow_key : 0 SP_prefix : 0
DP_flow_key : 21136 DP_prefix : 15
VLAN_flow_key : 252
Protocol_flow_key : 17
Ingress_flow_key : 0
Ingress Slot : 0
Ingress Port : 0
NAT IP Flow Type : IPv4 to IPv4
XSA_data_entry : 72.X.X.X
XDA_data_entry : 216.X.X.X
XSP_data_entry : 24194
XDP_data_entry : 24120
Egress_data_entry : 1
Egress Slot : 1
Egress Port : 0
flow_action : 0X41
optional_data : 0
FPGA_handle : 0x00000000
assoc_FPGA_handle : 0x00000000
VLAN_data_entry : 193
host_table_index : 801
Switch ID : 0x00000002
average-rate : 0
weight : 0x1f
init_flow_guard : 4294967295
inact_flow_guard : 2
max_flow_guard : 86397
payload_type_2833 : 0
index_2833 : 0
pt_2833_egress : 0
qos_vq_enabled : 11
codec_type : 578155832
Call Recorder : 31304, Egress, Signal
HMU_handle : 578155832
sd1.ord1#

Speed up RTP packetloss troubleshooting with tshark read filters

I hate waiting for Wireshark to load a 20+meg capture file to review RTP streams. Once it loads you  browse  to “Telephony > RTP > Show All Streams”. Then you wait for it analyze the RTP streams…..

If you have a fair amount of memory it might not be too horrible of a wait, but it can always be quicker. Especially for those who are dowloading captures from a remote capture point. Often you download 5-6 files before you find one with any RTP loss or massive amounts of jitter.

Using “tshark” from the CLI ( Windows or *Nix) you can set a read filter and show the RTP stream analysis  in a few seconds.  The syntax is “tshark -r <filename > -qz rtp,streams“.  This process through the GUI takes about 3 minutes on my Windows Vista Laptop.  Running through the Windows CLI it takes under 10 seconds.

After running this you are presented with the same output seen through “Telephony > RTP > Show All Streams” (GUI).

Of course this method doesn’t allow listen to the G.711 streams like you can through the GUI. The GUI has the eavesdropping capabilities that allow you to hear issues that occurred before packetization (Stream shows no loss, however audio sounds choppy).  There is however a definite advantage to this method. Below a sample of the output :

[12:10:36][FSLab]$ tshark -r capture1.pcap -qz rtp,streams
========================= RTP Streams ========================
    Src IP addr  Port    Dest IP addr  Port       SSRC          Payload  Pkts         Lost   Max Delta(ms)  Max Jitter(ms) Mean Jitter(ms) Problems?
    192.168.3.38 23988    192.168.2.146 20000 0xFBD96BBC ITU-T G.711 PCMU   127     0 (0.0%)           20.07            0.03            0.02 X
   192.168.2.146 20000     192.168.3.38 23988 0x1D2E1E1A ITU-T G.711 PCMU   130     0 (0.0%)           23.48            0.43            0.07 X
    192.168.3.38 24016    192.168.2.146 20000 0x9F3C715C ITU-T G.711 PCMU   127     0 (0.0%)           20.16            0.03            0.02 X
   192.168.2.146 20000     192.168.3.38 24016 0x28781E1C ITU-T G.711 PCMU   130     0 (0.0%)           22.77            0.41            0.11 X
    192.168.3.38 23952    192.168.2.146 20000 0x173A4637 ITU-T G.711 PCMU   127     0 (0.0%)           20.07            0.03            0.02 X
   192.168.2.146 20000     192.168.3.38 23952 0x03C61E1E ITU-T G.711 PCMU   130     0 (0.0%)           20.32            0.11            0.08 X
    192.168.3.38 24012    192.168.2.146 20000 0x753488EF ITU-T G.711 PCMU   127     0 (0.0%)           20.09            0.03            0.02 X
    192.168.3.38 20372    192.168.2.146 20000 0xAB77B2B9 ITU-T G.711 PCMU   127     0 (0.0%)           20.19            0.04            0.02 X
   192.168.2.146 20000     192.168.3.38 20372 0x10021E47 ITU-T G.711 PCMU   130     0 (0.0%)          282.48           24.18            5.84 X