2. Thomas Lee Chief Architect Global Knowledge EMEA UNC404

3. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

4. Introduction Why this talk? Why does SIP matter? Expectations

5. Who Am I? Chief Architect at Global Knowledge Author/Writer

6. Who Am I? Chief Architect at Global Knowledge Author/Writer Blogs: http://cacorner.blogspot.com http://tfl09.blogspot.com http://pshscripts.blogspot.com My email: Thomas.Lee@GlobalKnowedge.eu

7. Tools We’ll Use WireShark Snooper OCS 2007 and OCS 2007 R2 Pre-canned Traces Sample Traces uploaded to: http://www.reskit.net/ocs/ocs.ziphttp://www.reskit.net/ocs/ocs.zip

8. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

9. SIP Overview What is SIP? A signalling protocol for IM, presence, conferencing and voice Carried over TCP and TLS in OCS 2007 Usually carried in TLS/TCP, can be carried in TCP IPv4 only - at present Text based Similar to SMTP, HTTP Text headers plus body Body type described in header

10. SIP and RFCs Lots, lots, lots Starting point: RFC 5411 - “A Hitchhiker's Guide to the Session Initiation Protocol (SIP)”

11. SIP RFCs (some) RFC 3261 – The Session Initiation Protocol RFC 3262 – Reliability of Provisional Responses RFC 3263 – Locating SIP Servers RFC 3264 – Offer/Answer Model with SDP RFC 3265 – SIP Event Notification RFC 2976 – The SIP INFO Method

12. SIP RFCs (some) RFC 3261 – The Session Initiation Protocol RFC 3262 – Reliability of Provisional Responses RFC 3263 – Locating SIP Servers RFC 3264 – Offer/Answer Model with SDP RFC 3265 – SIP Event Notification RFC 2976 – The SIP INFO Method [SIMPLE] - SIP Instant Message and Presence Leveraging Extensions (SIMPLE) made Simple http://www.ietf.org/internet-drafts/draft-ietf-simple- simple-05.txt

13. Microsoft and SIP Microsoft has extended SIP and related protocols These extensions are well documented! Microsoft Office Protocol Documents http://msdn.microsoft.com/en-us/library/cc307432.aspx Or http://tinyurl.com/c3wuae For OCS, start at: [MS-OCSPROT]: Office Communications Server Protocols Overview

14. SIP Entities Entities send request messages and/or receive response message(s) Entities include: User Agent – aka Endpoint Proxy Server Redirect Server Registrar Server Presence Server

15. SIP Messages Header Structure similar to HTTP Body can be anything (SDP, Presence XML) Body type indicated by the header Request messages start with a Start Line requesting something Response messages return a response code (plus an optional body)

16. SIP Message Parts Start Line METHOD (i.e. The request) URI Message Headers : Blank Line Body SDP MIME XML

17. SIP Request Messages REGISTER - Logon SUBSCRIBE – requests for presence, etc NOTIFY – notifies change in presence, etc INVITE – request for a conversation ACK – affirmation a previous msg received BYE – Ends a conversation gracefully CANCEL – cancels less gracefully OPTIONS – stuff a User Agent can offer MESSAGE – IM Message

18. SIP Messages - Response Provisional 1xx – ringing, searching, queuing Final 2xx – success 3xx – redirection or forwarding 4xx – request failure 5xx – server failure 6xx – global failure

19. Example SIP Message Start-Line: REGISTER sip:gktrain.net SIP/2.0 From: ;tag=6b2c500b2d;epid=24eae58f68 To: CSeq: 2 REGISTER Call-ID: 068878a83a6e4da0b35bfb8b5b7cfc5e Via: SIP/2.0/TLS 10.100.100.100:24195 Max-Forwards: 70 Contact: ;methods="INVITE, MESSAGE, INFO, OPTIONS, BYE, CANCEL, NOTIFY, ACK, REFER, BENOTIFY";proxy=replace;+sip.instance=" " User-Agent: UCCAPI/3.5.6907.0 OC/3.5.6907.0 (Microsoft Office Communicator 2007 R2) Supported: gruu-10, adhoclist, msrtc-event-categories Supported: ms-forking ms-keep-alive: UAC;hop-hop=yes Event: registration Proxy-Authorization: Kerberos qop="auth", realm="SIP Communications Service", targetname="sip/OCSEE.gktrain.net", version=4, gssapi-data=“ Deleted!" Content-Length: 0 Message-Body: – $$end_record

20. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

21. SIP And The TCP/IP Stack SIP is an APPLICATION PROTOCOL SIP is carried by a transport protocol TLS/TCP or TCP Transport Protocol carried in datagram protocol IPv4 IPv6 not supported IP is carried in a physical layer protocol Ethernet Or...

22. Why Use TCP? UDP part of SIP RFCs, but... UDP “unreliable” TCP includes retry mechanism UDP has limited size packets OCS Sends large XML presence documents TCP can be secured Using TLS

23. Why TLS? SIP originally UDP based Can’t be secured SIP can be carried in TCP Insecure, Insecure, Insecure TLS encrypts Requires a PKI! Why? Security, security, security

24. Examining SIP using WireShark

25. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

26. SDP – Session Description Protocol Text based Originally used on MBone Used to specify RTP Sessions Can negotiate Carried in body of SIP message Usually seen in Invite and 200 OK messages

27. SDP RFCs RFC 2327 - SDP: Session Description Protocol RFC 3264 - An Offer/Answer Model with SDP RFC 3311 - SIP UPDATE Method Look at MS Protocol documents too

28. Sample SDP – in IM Invite v=0 o=- 0 0 IN IP4 10.100.100.100 s=session c=IN IP4 10.100.100.100 t=0 0 m=message 5060 sip null a=accept-types:text/plain multipart/alternative image/gif text/rtf text/html application/x-ms-ink application/ms- imdn+xml text/x-msmsgsinvite

29. SDP Sample – Invite for Phone Call v=0 o=- 0 0 IN IP4 16.0.0.100 s=session c=IN IP4 16.0.0.100 b=CT:99980 t=0 0 m=audio 63488 RTP/AVP 114 111 112 115 116 4 8 0 97 101 k=base64:SUi3f4QkyWbNmf7KBimV2MQMnMJncGc5Pj+3G8iTCQVOJn+7MM/0mRdsYLDr a=candidate:917TIvZhmZbBU4T//p3jlck05H0S2pUd7Muzz4GDkZE 1 To4CceJ4l+1/tAiH3hQw6g UDP 0.900 16.0.0.100 63488 a=candidate:917TIvZhmZbBU4T//p3jlck05H0S2pUd7Muzz4GDkZE 2 To4CceJ4l+1/tAiH3hQw6g UDP 0.900 16.0.0.100 28416 a=cryptoscale:1 client AES_CM_128_HMAC_SHA1_80 inline:0obtBkF7k+iljDXOL+8sJBUZ/OmNclZhxjFBCyqw|2^31|1:1 a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:ixW+BiAyYe12QLbPjoH91gy7xmcSu6vGeYdhit3Z|2^31|1:1 a=maxptime:200 a=rtcp:28416 a=rtpmap:114 x-msrta/16000 a=fmtp:114 bitrate=29000 a=rtpmap:111 SIREN/16000 a=fmtp:111 bitrate=16000 a=rtpmap:112 G7221/16000 a=fmtp:112 bitrate=24000 a=rtpmap:115 x-msrta/8000 a=fmtp:115 bitrate=11800 a=rtpmap:116 AAL2-G726-32/8000 a=rtpmap:4 G723/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:0 PCMU/8000 a=rtpmap:97 RED/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-16 a=encryption:optional

30. Examining SIP/SDP Traffic Using Snooper

31. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

32. RTP: Real-Time Transport Protocol Not Real-Time Protocol! Carries A/V samples Thin header Runs over UDP Secured using SRTP MS Extension: SSRTP

33. RTP RFCs RFC 3550 - RTP: A Transport Protocol for Real-Time Applications RFC 3551 - RTP Profile for Audio and Video Conferences RFC 3711 – Secure Real-time Transport Protocol RFC 2198 - RTP Profile for Audio and Video Conferences RFC 4733 - RTP Payload for DTMF, etc RFC 2190 - RTP Payload Format for H.263 Video Streams

34. RTP Packet Structure

35. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

36. SIP – Register Register – what a client does to “logon” Initial register always fails (unauthenticated) SSO attempted (if appropriate) Third time lucky Look at post sign-on activity

37. Examining REGISTER

38. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

39. Sip – Invite Invite – invites an endpoint into a conversation Invite can invite into IM Session A/V Call Conference Responses Provisional Responses Final 200 OK response Final non-OK responses

40. Examining INVITE

41. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

42. SIP – Message Message is an IM Message – part of an IM Conversation Message contents are sent in rich text (HTML) Snooper removes PII (i.e. the message itself) File transfer is interesting!

43. Examining MESSAGE, etc

44. Agenda Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

45. SIP Troubleshooting For the most part, not much you can really do to troubleshoot SIP If it works – well it works If it doesn’t – call MS – it’s a bug Knowing what to look for can help in OCS troubleshooting Determine what is normal Look for the differences

46. SIP TroubleshootingPotential Check correct version of the client Ensure client can connect to server(s) Confirm ports and IP addresses Check ICE candidates CODEC selection Unknown contacts Certificate errors etc

47. An Interesting Problem On DC – replication was turned off OCS relies on GC New user created No GC replication User did not get proper Location Profile No obvious errors in event log Snooper trace helped to point to AD

48. Summary Introduction SIP Overview TCP/IP Stack SDP RTP SIP – Register SIP – Invite SIP – Message Troubleshooting

50. www.microsoft.com/teched Sessions On-Demand & Community http://microsoft.com/technet Resources for IT Professionals http://microsoft.com/msdn Resources for Developers www.microsoft.com/learning Microsoft Certification and Training Resources www.microsoft.com/learning Microsoft Certification & Training Resources Resources

51. More Resources OCS Learning Plan - http://tinyurl.com/cwp27h and http://tinyurl.com/23w3l6http://tinyurl.com/cwp27hhttp://tinyurl.com/23w3l6 OCS R2 Resource Kit - http://tinyurl.com/cxv6gwhttp://tinyurl.com/cxv6gw R2 Learning Portal - http://tinyurl.com/cmo54shttp://tinyurl.com/cmo54s OCS R2 Ignite - http://www.globalknowledge.be/pdf/GKOCS.pdf http://www.globalknowledge.be/pdf/GKOCS.pdf

52. Related Content UNC201 – Lap around Release 2 of the Microsoft Unified Communications Platform UNC303 Deep Dive into the Edge Server in Microsoft Office Communications Server 2007 R2 UNC304 Deploying Administering, and Managing Microsoft OCS 2007 R2 UNC232 – Troubleshooting Microsoft Communications Server 2007

53. Call to Action Learn More! Related Content at TechEd on “Related Content” Slide Attend in-person or consume post-event at TechEd Online Check out online learning/training resources http://technet.microsoft.com/exchange/2010 http://technet.microsoft.com/office/ocs Try It Out! Download the Exchange Server 2010 Beta Evaluation http://www.microsoft.com/exchange/2010/try-it Get a 5-Day Trial of Office Communications Server 2007 R2 https://r2.uctrial.com/

54. Complete an evaluation on CommNet and enter to win!

55. © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.