H.323 網路電話音訊監控 與錄製系統之研製 The Design and Implementation of Audio Monitoring and Recording System for H.323-based Internet Phone Speaker : 黃威穎 Advisor : 柯開維 教授 Data : /25 1

Outline Introduction Background Audio Recover System Framework Compare with Wireshark Conclusion Demo 2

Introduction VoIP has already been the killer application. Requirement of the audio recording system. VoIP protocol H.323 SIP (Session Initiation Protocol) Transport protocol RTP RTCP 3

Background H.323 H.323 Related Software H.323 Related Protocol WinPcap How to Build WAVE File 4

H.323 H.323 is a multimedia conferencing protocol, which includes audio, video, and data conferencing over packet- switched networks. Element of H.323 system Terminals Gatekeeper Multipoint Control Units (MCU) Gateway 5

H.323 Framework 6

The Flowchart of H.323 Call 7

H.323 Related Software OpenH323 An open source library for the development of applications using the H.323 protocol. GNU Gatekeeper (GUNGK) An open source project that implements an H.323 gatekeeper. Implement most of these functions based on the OpenH323 protocol stack. 8

H.323 Related Protocol Q,931/H.225 H.245 RTP 9

Q.931/H.225 Q.931/H.225 call signaling is used to establish a H.323 call. Q.931 Header Structure NameLength(Octets)Note Protocol Discriminator 1 Always 0x08 for ISDN Call Reference1,2 or 3 The call reference field Message Type2 Detail IEs (Information Elements) various Detail 10

H.245 H.245 is a control channel protocol and involves the line transmission of non-telephone signals. H.245 signaling is intended to be carried out in parallel to H.225 signaling. 11

Important H.245 Message MessageNotePossible reply Master-Slave Determination Determines which terminal is the master. Acknowledge, Reject, Release Capability Exchange Contains information about a terminal's capability. Acknowledge, Reject, Release Open and Close of Logical Channels Transport of audio and data information. Acknowledge, Reject, Confirm Close the H.245 Control Channel Indicates the end of the H.245 session. No other H.245 message 12

RTP Header Structure P : Padding Ex : Extension CSRC : contributing source identifiers count M : Mark 13

Payload Type RTP PTNameTypeClock rate (Hz) Audio channels References 0PCMUAudio80001RFC G721Audio80001RFC GSMAudio80001RFC PCMAAudio80001RFC G722Audio80001RFC G728Audio80001RFC G729Audio

WinPcap An architecture for packet capture and network analysis for the Win32 platforms. 15

How to Build WAVE File WAVE file format is a subset of RIFF (Resource Interchange File Format) specification. 16

WAVE file format ByteRate = SampleRate * NumChannels * BitsPerSample / 8 BlockAlign = NumChannels * BitsPerSample / 8 17

Audio Recover Silence Suppression Synchronization Problem 18

Silence Suppression Stop sending RTP packets during silent periods is known as "Silence Suppression". How to detect Silence Suppression? RTP mark bit RTP timestamp 19

Silence Suppression Handle = 240 (( – ) / 240) - 1 = 4 20

Synchronization Problem Handle 21

System Framework System Environment of Network System Structure The Flow of Packet Handle The Interface between RecDrv_h323.dll and RecApp.exe 22

System Environment of Network 23

System Structure 24

The Flow of Packet Handle 25

The Interface between RecDrv_h323.dll and RecApp.exe Callback function void handleData(int channelID, int evtType, struct tm *timeStamp, string sourceAddr, string destinAddr, char* buff, int buffSize, int xtraInfo); H323 Packet Analysis interface int RDSysStart(callback _callback); //return: 1 means success, 0 means failure int RDSetChannelParams(int buffSize); //return: 1 means success, 0 means failure 26

The Interface between RecDrv_h323.dll and RecApp.exe int RDInitChannel(string IPAddr, int& channelID); //return: 1 means success, 0 means failure int ReleaseChannel(string IPAddr) //return: 1 means success, 0 means failure int GetDrvCap(char** drvInfo) //return the number of network interface card int StartpCap(int inum) //input the NIC number //return: 1 means success, 0 means failure int RDSysShutdown() //return: 1 means success, 0 means failure 27

Compare with Wireshark Function Audio Monitoring and Recording System for H.323- based Internet Phone Wireshark Multiple conference monitoring Yes Silence suppression recovering Yes Asynchronization resolution Yes VoIP protocol support Only H.323, but system can be extend Many State monitoring YesNo 28

Compare with Wireshark (cont.) Function Audio Monitoring and Recording System for H.323- based Internet Phone Wireshark Raw/Wave file generation for tracking YesNo Ease for post processingYesNo Present detailed information Detail and easy to understand summary information Implicit and time- based handshaking message User interface miscellaneous Specific design for recording/monitoring Design for packet analyzing 29

Conclusion This research implements a system that provides H.323 audio phone analysis and audio recover. It can deal with silence suppression problem, asynchronization problem and multiple H.323 phone at the same time. 30

Future work Extend tp SIP or some famous protocols like skype, skinny(Cisco) Accommodate various audio codec, eg. GSM, ADPCM Monitor and recover the mulitpoint conference 31

Demo Other software OpenH323 Golasoft Packet Player Single phone call Multiple phone calls 64 phone calls 32

Q.931 Message Type ValueNameDirection 0x01AlteringCallee -> Caller 0x02Call ProceedingCallee -> Caller 0x05SETUPCaller -> Callee 0x07ConnectCallee -> Caller 0x45Disconnect 0x5ARelease Complete 33

Q.931 IEs ValueNameNote 0x04BearerRequired bearer service e.g. voice, data etc. 0x08CauseError/termination code/status 0x28DisplayDisplay user information 0x7EUser-UserConvey information between ISDN users 34