NEMO 3.0 Product Description NetAxis Solutions

Transcription

1 NEMO 3.0 Product Description NetAxis Solutions Page i of 18

2 NEMO 3.0 Product Description NetAxis Solutions Release Version 3.0 Copyright NetAxis Solutions Page ii of 18

3 NEMO 3.0 Product Description Table of Contents Contact... 1 Introduction... 2 NEMO Product Description Overview Main features Monitoring Statistics and Reporting Alarms definition and collection Fast access to records for debugging Troubleshooting (only with Network probes) Fraud detection Profiling Logical Architecture Dimensioning & Performance Centralized server (CDR storage and statistics computation) Probes Scalability NEMO Stats Reference List Call Statistics Voice Quality Statistics Fraud Detection Statistics Page iii of 18

4 Contact Contact All inquiries related to the features described in this document can be ed to Page 1 of 18

5 Introduction Introduction NEMO is an All-In-One product for VoIP Services and Networks, covering the following functions: Monitoring Reporting Troubleshooting Alarming Debugging Fraud detection NEMO is a vendor agnostic monitoring and reporting platform, designed to reflect the usage of a VoIP network by gathering data using probes and CDRs, irrespective of format. Following Netaxis Solutions' product philosophy, NEMO has been thought and designed from day one for flexibility and easiness to operate. Indeed, NEMO can be deployed in many different ways thanks to the range of probes developed by NetAxis: from the portable probe (not bigger than a book, can be easily moved from one place to another) to the Probe L which can cope with thousands of simultaneous calls. In case probes are complicated to be deployed, NEMO can rely on CDRs produced by network equipment to provide valuable network indicators. NEMO can also work in hybrid mode (Probes and CDRs) when needed. Flexible reporting The reporting aspect of NEMO is particularly strong, allowing network operators to flexibly slice and dice information for resellers and end-users in many ways: by reseller, customer, site, individual end-user etc. This flexibility, combined with the fact that NEMO is natively multi-tenant and comes with fine-grained user profile definition, gives the possibility to make the NEMO portal accessible to different types of users: from very technically skilled engineers for troubleshooting, to customers for end-user reporting only. Troubleshooting features The gathering of SIP/RTP data using probes allows NEMO to troubleshoot problems with calls, by providing end-to-end call flows, SIP message details, media stream analysis and media replay possibility. NetAxis Solutions' probes are not only passive probes that sniff the network traffic: they are also capable to generate programmable traffic patterns that will be monitored by NEMO. Fraud detection NEMO is designed to monitor traffic quality based on a on in-depth analysis of probes' captures and of customer-originating CDRs. If fraud detection is needed, Page 2 of 18

6 Introduction Netaxis Solutions provides also ENGO, a powerful solution using other very specific fraud detection tools on the same data from probes and CDRs. ENGO can easily and rapidly be installed next to NEMO or integrated with it. Page 3 of 18

7 NEMO Product Description NEMO Product Description Abridged version - A full version with advanced technical information is available on request. 1. Overview This document introduces NEMO, the Voice Over IP network reporting/monitoring tool developed by NetAxis Solutions. It intends to provide the information needed to understand the features, architecture, and operation of NEMO. Page 4 of 18

8 NEMO Product Description 2. Main features NEMO is a monitoring and reporting platform able to reflect the usage of a network. NEMO gathers network information using network probes and CDRs. The CDR interfacing architecture is fully modular in order to further enhance NEMO s ability to interface with different network elements. This modularity is based on plugins, which are currently available for the following vendor equipments: Acme/Oracle Net-Net SD (1100, 3820, 4500, 4600, 6300, 9200) Acme/Oracle SMX Audiocodes Mediant series (800, 1000, 2000, 3000) Genband S3 Broadsoft Sonus Mitel Huawei Thanks to its proprietary process, NetAxis Solutions can develop in no time a new plugin for any equipment not listed above. This process is based on existing CDRs analysis, whatever the format. By relying on existing network elements monitoring features, NEMO natively avoids that probes need to be installed in the network, which greatly reduces costs as well as maintenance activities. However, when needed, the Probe module can be added: served with the call data coming from appropriate networks taps, it allows packets capture and in-depth analysis. NEMO is an All-In-One product for VoIP Services and Networks, covering the following functions: Monitoring Reporting Troubleshooting Alarming Debugging Fraud detection Page 5 of 18

9 NEMO Product Description 2.1. Monitoring NEMO allows monitoring the usage of the VoIP network made by the users, the call destinations, durations,... as well as the quality of the IP network (packet loss, jitter, latency, MOS, R-Factor, codecs, media bandwidth). NEMO offers a set of very flexible graphs to visually inspect all aspects of the VoIP network traffic Statistics and Reporting NEMO automatically compiles all the metrics consolidated by the platform into customized reports, generated on a regular basis and made available to Operators, Integrators, and End-Customers. This ensures that all parties get access to the statistics they are interested in. One of the formats used for reporting is fully editable, allowing for a more advanced customization if needed Alarms definition and collection Anomaly definition and alarm generation Alarm types, criteria and thresholds can be easily defined and modified from a large set of pre-defined alarms. Thanks to its traffic patterns' analysis engine, NEMO is able to detect traffic anomalies which are not usually notified via discrete alarms (such as SNMP traps): sudden call rate drop, abnormal calls duration, high error rate, and more Alarms collection The SNMP Traps Management tool allows defining SNMP rules to raise, from traps/ events selected from the vendor's MIBs, customer-defined alarms with significant name, severity, and notifications. Upon anomalies detection, NEMO generates an alarm that can be sent using SNMP, mail or SMS Fast access to records for debugging The NEMO interface provides direct access to the calls records, allowing the system operator to search the calls details on a reported alarm or anomaly. This makes debugging easy and fast Troubleshooting (only with Network probes) NEMO can capture both signalling and media of calls and gather this information to provide a graphical end-to-end call flow as well as the possibility to listen to the RTP media flows (directly form the GUI) of the call to troubleshoot the voice quality. NEMO allows the retrieval and download of the call trace in.pcap format. NEMO offers also the possibility to compare two media streams using PESQ standard. Page 6 of 18

10 NEMO Product Description Media capture can be activated either for all monitored calls or depending on call criteria (for example calling/called number) Fraud detection 2.7. Profiling The ENGO module provides, besides usual protection appliances, a solution able to analyze the voice traffic, to compute KPI and to provide tools (for example Call blocking) to fight against abuse of infrastructure, and to reduce exposure to potential financial losses. This module comes with a frequently updated list of the number ranges considered as fraudulent. Monitoring/reporting/alarming fine-grained profiles are created for every single entity monitored by NEMO. The same applies for web portal user access; the rights provided to a user are fully customizable, allowing one user to see the whole network and another user to have restricted access (monitored entity he can view, statistics, available reports ) Page 7 of 18

11 3. Logical Architecture NEMO Product Description NEMO logical architecture is a three-layer one: Interface Layer, Data Storage Layer and Application Layer. NEMO has been designed to be modular: all these logical layers can either run on the same physical entity or be spread on different physical entities. The picture below describes the logical architecture of a NEMO platform using Probes. Page 8 of 18

12 NEMO Product Description 4. Dimensioning & Performance 4.1. Centralized server (CDR storage and statistics computation) Centralized server can be virtualized Performance The table below provides typical performance values for a single-node deployment. These are strongly linked to the available hardware configuration: the reference system used to collect these values is a Quad-core CPU, 8 GB RAM, 500 GB HD, 2 x 7200 RPM Hard Disks. Average CDR processing performance Peak CDR processing performance Maximum number of realms with statistics active 200 calls/sec 300 calls/sec 2000 Maximum number of users 5000 Maximum number of simultaneous user sessions/requests Maximum number of CDRs in database Further performance can be achieved in multi-nodes deployment: performance scales linearly with a number of back-end nodes. Note that in virtualized environments, performance might degrade depending on other guest VMs running on the same host. The most important factor is I/O performance, rather than CPU performance Dimensioning The following data provide the dimensioning information for the elements of the NEMO platform: OS + Nemo: 15 GB database filesystem: calls: 1.8 KB * number of CDRs to hold statistics: 3 MB * (number of groups with stats active + number of individual IPs with stats active) * number of days to hold reports: 200 KB * number of reports to hold plan 25% of free storage for database management (repair, etc...) plan 20% of unallocated storage to snapshot the database raw CDRs filesystem: uncompressed (current day and previous day): 400 MB per day KB * number of CDRs 50 Page 9 of 18

13 NEMO Product Description 4.2. Probes backup filesystem: compressed CDRs: 20% original size database: 25% original size temporary storage of DB before compression: same as original DB Network Probes cannot be virtualized. Three network probes models are available: S, M and L. Probe Model S M L Capture Interfaces 2 x 1 Gbps 4 x 1 Gbps 4 x 1 Gbps Power Single Redundant Redundant Storage Single Redundant (RAID 1) Redundant (RAID 1) Storage Type HD HD SSD Values Unit S M L Maximum packet rate per probe server packets per second Maximum bandwidth per probe server Gbps 1,6 2 2,4 Maximum call rate per probe server calls/second Maximum packet rate per interface packets per second Maximum bandwidth per interface Gbps 0,8 0,8 0,8 Maximum call rate per interface calls/second Maximum simultaneous calls SIP signaling capture calls count Maximum simultaneous calls RTP media capture calls count Maximum simultaneous calls RTP media stats calls count RTP media storage capacity hours Page 10 of 18

14 NEMO Product Description 5. Scalability As already mentioned, NEMO can be spread over several servers to improve performance and security. Such a configuration would include: a dedicated Radius server a replicated DB server having a slave DB replication several replicas of the DB allowing load sharing on data access operations. Page 11 of 18

15 NEMO Product Description END OF DOCUMENT Page 12 of 18

16 NEMO Stats Reference List NEMO Stats Reference List 1. Call Statistics Label Sessions Total Capacity Usage Minutes of Usage Traffic Intensity Maximum simultaneous calls Call rate Calls Durations Connection Phase Duration Description Illustrates the proportion of time where various levels of total capacity usage have been reached. Describes the total duration of calls in minutes, hourly or daily, depending on the window of time selected. Describes the average number of concurrent calls in progress. The erlang is the unit used to represent this measurement. The maximum number of concurrent calls observed. The number of call attempts (successful and failed) per second. The connection phase is the period of time between the moment the call is answered (connected) and the moment the call is released (disconnected). This histogram represents the distribution of these durations. Each bar represents the percentage of calls (vertical axis) which have a specific duration (horizontal axis). Average Connection Phase Duration This chart represents the average connection phase duration over time. Alerting Phase Duration The alerting phase is the period of time between the moment the call is initiated (setup) and the moment the call is answered (connected). This histogram represents the distribution of these durations. Each bar represents the percentage of calls (vertical axis) which have a specific duration (horizontal axis). Average Alerting Phase Duration Calls Destinations & Sources Destination : National vs International Source : National vs International Destination : National This chart represents the average alerting phase duration over time. This chart illustrates the destination distribution between national and international calls. This chart illustrates the source distribution between national and international calls. This chart illustrates the destination distribution for national calls. Page 13 of 18

17 NEMO Stats Reference List Label Source : National Destination International : Source : International Release Causes Description This chart illustrates the source distribution for national calls. This chart illustrates the destination distribution for international calls. This chart illustrates the source distribution for international calls. Ingress Calls ISDN Cause This chart illustrates the distribution of calls ISDN causes. Egress Calls ISDN Cause This chart illustrates the distribution of calls ISDN causes. Ingress Calls Disconnect Cause Egress Calls Disconnect Cause Ingress Calls SIP Status Egress Calls SIP Status Ingress Calls Termination Cause Egress Calls Termination Cause Session Establishment Ratio SER (aka: ASR) Session Establishment Effectiveness Ratio SEER (aka: NER) Ineffective Session Attempts Ratio ISA This chart illustrates the distribution of calls disconnect causes, grouped in classes. This chart illustrates the distribution of calls disconnect causes, grouped in classes. This chart illustrates the distribution of individual SIP error codes. This chart illustrates the distribution of individual SIP error codes. This chart illustrates the distribution of Broadworks termination causes. This chart illustrates the distribution of Broadworks termination causes. The session establishment ratio (SER, also known as answer seizure ratio, ASR) is the percentage of calls answered with respect to the total number of call attempts. The scale goes from 0% (no calls answered) to 100% (all calls answered). The session establishment effectiveness ratio (SEER, also known as Network Efficiency Ratio, NER) is the percentage of calls answered with respect to the total number of call attempts. Calls released because of user busy, no answer, etc... are excluded from this metric. It is designed to eliminate user behavior as factor and better represent pure network performance. The scale goes from 0% (no calls answered) to 100% (all calls answered). The ineffective session attempts ratio (ISA) is the percentage of calls released with a failed or overload condition. The scale goes from 0% (no ineffective session attempts) to 100% (all session attempts are ineffective). Page 14 of 18

18 NEMO Stats Reference List Label RCS Sessions Types Ingress RCS Session Type Description This chart illustrates the distribution of RCS session types. Egress RCS Session Type This chart illustrates the distribution of RCS session types. User-Agent Ingress RCS Terminal Egress RCS Terminal RCS File Transfers (as above) Ingress RCS File Transfer Type Egress RCS File Transfer Type RCS File Transfer Bandwidth 2. Voice Quality Statistics This chart illustrates the distribution of RCS terminal models. This chart illustrates the distribution of RCS terminal models. This chart illustrates the distribution of RCS file transfer types. This chart illustrates the distribution of RCS file transfer types. This chart illustrates the bandwidth consumed for RCS file transfers over time. Label Packet Loss Description Packet loss occurs when one or more packets of RTP data travelling across a VoIP network fail to reach their destination. RTP Average Packet Loss This histogram represents the packet loss distribution (for each interval indicating a packets loss level on the horizontal axis, the bar height indicates the percentage of calls affected by this packet loss level). The statistics are measured based on the RTP flows observed by the SBC. RTP Average Packet Loss Over Time RTCP Average Packet Loss This chart represents the measured packet loss over time. The statistics are measured based on the RTP flows observed by the SBC. This histogram represents the packet loss distribution (for each interval indicating a packets loss level on the horizontal axis, the bar height indicates the percentage of calls affected by this packet loss level). The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. Page 15 of 18

19 NEMO Stats Reference List Label Description RTCP Average Packet Loss Over Time Packet loss occurs when one or more packets of RTP data travelling across a VoIP network fail to reach their destination. This chart represents the measured packet loss over time. The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. Packet Jitter Jitter is the variability over time of the packet latency across a network. RTP Average Jitter RTP Average Jitter Over Time RTCP Average Jitter RTCP Average Jitter Over Time Packet Latency This histogram represents the jitter distribution (for each interval indicating a jitter level in ms, the bar height indicates the percentage of calls affected by this jitter level). The statistics are measured based on the RTP flows observed by the SBC. This chart represents the measured jitter over time. The statistics are measured based on the RTP flows observed by the SBC. This chart represents the measured jitter over time. The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. This chart represents the measured jitter over time. The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. One-way packet latency is the time between the moment a voice packet is transmitted and the moment it reaches its destination. It leads to delay and may lead to echo. RTCP Max Latency This histogram represents the maximum latency distribution (for each interval indicating a maximum delay on the horizontal axis, the bar height indicates the percentage of calls affected by this delay). The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. RTCP Avg Latency This histogram represents the average latency distribution (for each interval indicating an average delay on the horizontal axis, the bar height indicates the percentage of calls affected by this delay). The statistics are measured based on the RTCP reports sent by both call endpoints. The accuracy of the RTCP reports can vary depending on the endpoint type. Page 16 of 18

20 NEMO Stats Reference List Label MOS Description (Mean Observation Score formerly known as Mean Opinion Score for PSTN voice) Ingress MOS Overview Egress MOS Overview RTP MOS RTP MOS Over Time R-Factor Mean Observation Score (MOS) is a measure (score) of the audio quality based on different factors. The scale goes from 1 to 5, 1 being the worst quality and 5 being the best quality. This chart illustrates the percentage of calls with various score levels. Mean Observation Score (MOS) is a measure (score) of the audio quality based on different factors. The scale goes from 1 to 5, 1 being the worst quality and 5 being the best quality. This histogram represents the MOS distribution (for each interval indicating a score on the horizontal axis, the bar height indicates the percentage of calls with this score). This chart represents the MOS over time. R-Factor is a measure (score) of the audio quality based on different factors. The scale goes from 0 to 100, 0 being the worst quality and 100 being the best quality. R-Factor R-Factor Over Time Codecs Ingress Calls Codecs Egress Calls Codecs Ingress Packetization Time Ingress Packetization Time Media Bandwidth Media Bandwidth Over Time This histogram represents the R-Factor distribution (for each interval indicating a score on the horizontal axis, the bar height indicates the percentage of calls with this score). This chart represents the R-Factor over time. This chart illustrates the distribution of codecs among ingress calls. This chart illustrates the distribution of codecs among egress calls. This chart illustrates the distribution of packetization times among ingress calls. The packetization time is the amount (in milliseconds) of audio data that is sent in a single RTP packet. This chart illustrates the distribution of packetization times among egress calls. The packetization time is the amount (in milliseconds) of audio data that is sent in a single RTP packet. The media bandwidth is the bandwidth (in kbit/s) used to transport the media inside RTP packets. Page 17 of 18

21 NEMO Stats Reference List 3. Fraud Detection Statistics Label Average call duration(acd) Call volume Average Ringing Duration (ARD) Session Establishment Ratio (SER)/ Answer Seizure Ration (ASR) Disconnect Initiator Ratio (DIR) Description Average duration (in secs) of the connected phase. Connected phase is the period between the moment the call has been answered and the moment the call gets released. Describes the total duration of calls in minutes, hourly or daily, depending on the window of time selected Average duration (in secs) of the ringing phase. The ringing phase is the period of time between the moment the call is initiated (setup) and the moment the call is answered (connected). Percentage of calls answered with respect to the total number of call attempts. The scale goes from 0% (no calls answered) to 100% (all calls answered). Ratio between calling disconnection and called disconnection. Page 18 of 18