Port Mirroring in complex call scenarios

This article gives some recommendations for "Port Mirroring" configuration on different types of voip network.

First of all it is necessary to decide, which calls is necessary to record.

There are three types of calls:

• Outbound (local phone makes a call to the external phone)
• Inbound (call is received from the external phone to the local phone)
• Local or Internal (call is established between two local phones)

If recording of local calls is not necessary (or there are no such calls), then a configuration of "Port Mirroring" is very simple.

You need to mirror the port, where IP PBX is connected to (see Figure 1).

Figure 1. Recording of Inbound and Outbound calls only

On Figure 1 it is shown that RTP audio traffic is sent from IP Phone to IP PBX. This traffic is mirrored to MiaRec server, where it is decoded.

This solution works for both inbound and outbound calls.

But it may not work for local calls. On most of IP PBX systems there is an optimization for network bandwidth usage: if the call is made between two local IP Phones, then RTP traffic is sent directly between phones without reaching of IP PBX (see Figure 2).

Figure 2. Recording of Inbound, Outbound and Local calls

In order to record Local calls as well as Inbound and Outbound it is necessary to mirror every port, where IP Phones are connected to.

Recording calls on the second switch

If IP Phones are connected through multiple switches, then additional effort is necessary to make call recording works.

Configuration of "Port Mirroring" is easy if recording of local calls is not required.

In this case "Port Mirroring" is required only on the main switch (see Figure 3).

Figure 3. Recording of calls on the second switch

In the case that recording of local calls is required, then there are three solutions:

1. Install additional network adapter into MiaRec server and connect multiple switches to it (see Figure 4)

Figure 4. MiaRec server with two network adapters

2. Install a separate MiaRec server for the second switch (see Figure 5).

Figure 5. Two MiaRec servers

3. Use Remote SPAN (RSPAN) capability of Cisco Catalyst Switches (see Figure 6)

Figure 6. RSPAN configuration

RSPAN allows you to monitor source ports that are spread all over a switched network, not only locally on a switch with SPAN. This feature appears in CatOS 5.3 in the Catalyst 6500/6000 Series Switches and is added in the Catalyst 4500/4000 Series Switches in CatOS 6.3 and later.

The functionality works exactly as a regular SPAN session. The traffic that is monitored by SPAN is not directly copied to the destination port, but flooded into a special RSPAN VLAN. The destination port can then be located anywhere in this RSPAN VLAN. There can even be several destination ports.

More about RSPAN (link to Cisco web-site) >>