1 Building Web-base SIP Analyzer with Ajax Approach Yan-Hsiang Wang & Dr. Quincy Wu National Chi Nan University Graduate Institute of CSIE

2 Motivation Session Initiation Protocol is widely used as the signaling protocol for Voice over IP. Trouble-shooting may not be easy:  Only super-users can capture packets on Unix-like OS to capture packets on network interface cards.  Hard-phone users cannot install software to capture packets.

3 Ethereal

4 Motivation (cont.) Existing web-base systems cannot update data in pages seamlessly.  Distributed SIP Analyzer  WIST - Web Interface for SIP Trace

5 Existing system 1

6 Existing system 2

7 AJAX Asynchronous Javascript And XML This noun was born on February It is not a technology; it is an approach. Connect Web Browser and Web Server asynchronously. Reload data without refreshing pages. Create interactive web applications.

8 Ajax application Auto-Complete (Yahoo Dictionary) 

9 Ajax application (cont.) Drag & Drop (UrMap)  Real-Time Viewer (Digg Spy)  Slider (Google Finance) 

10 Ajax engine

11 System Architecture ApacheMySQL Ethernet card Captor (libpcap) AJAX engine HTML + Cascading Style Sheets Data JavaScript Call SIP Extractor (php) Server-side systemClient-side system web browser HTTP RequestXML Data PHP Query Data Ethernet Frame SIP Message SIP Header Field

12 Server-side system We use Libpcap to capture packets on udp port Strip off the Ethernet, IP and UDP headers by PHP script. Store the SIP messages in MySQL database for further querying.

13 Client-side system Our querying page is based on a Ajax engine.  Refresh data seamlessly  Update the latest packets in real time  Provide desktop-like application interface friendly Use tree menu as message browser.  Expend the message dynamically

14 Implementation

15 Advantage User can find the history with ordinary privilege. Surfing web-base system is convenient and easy. We can package these messages in a Pcap format file and mail it to users so that they can parse it with other tools (Ethereal, Wireshark).

16 Advantage (cont.) Refresh the message table when the latest message is captured.  Query the latest record from the database in each second  Compare the latest record from the database and the current record in browser  Refresh the message table if these two records are different

17 Experiment Environment  FreeBSD 5.4 as Operating System  MySQL as Database  Apache _2 as Web server  Ser-0.9.6_2 as SIP server  Sajax-0.12 as Ajax library  Two SIPp generators on WinXP as Client Call setup scenario (powered by SIPp)  Concurrent calls: 200, 500, 1000, 3000, 5000, 7000, 9000  Total calls: 20,000

18 Experiment (cont.) CPU loading test  Step1: only httpd, mysqld, ser  Step2: start stress testing  Step3: start capturing and pipe the output to the dissector  Step4: enable live update on the browser  Step5: work continuously without SIP traffics

19 Improvement Version 1  Consume the CPU loading quite a lot Version 2  The CPU loading is about 50% in comparison with Version 1 What’s different  The WHERE `timestamp` LIKE syntax '% %' => ' %'

20 CPU loading Reduce 0.5~1 at step 4 Reduce 1~1.5 at step 5 Version 2 Version 1

21 Reference Tcpdump  Ethereal  Ajax: A New Approach to Web Applications  s/archives/ php s/archives/ php SIPp 

22 Q&A Thanks for your coming!!