Port Mirroring for Recording SIP Calls by TekTape

In this article, I will let you know that how you record SIP calls on your network by TekTape tool which is produced by kaplansoft.  For some cases, requirements of your costumers can be met with a solution that you must get as outsource. I have encountered like this occasion just two days ago. Let me share my experience on this case;

Requirements: 

TekTape Tool

Switch or Router (to mirror real time sip traffic)

Windows Server (you can use your laptop)

win10pcap

After the completing these requirements we will be able to start with on span (port mirroring) configuration on switch/router. Because I have Cisco 3560 switch on test path, I will try to explain how you can set scan configuration on it. In first, you need to check wheter there is any span config on your device or not;

test_switch#show monitor session ?

  <1-66>              SPAN session number

  all                 Show all SPAN sessions

  erspan-destination  Show only Destination ERSPAN sessions

  erspan-source       Show only Source ERSPAN sessions

  local               Show only Local SPAN sessions

  range               Show a range of SPAN sessions in the box

  remote              Show only Remote SPAN sessions

test_switch#show monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Gi0/17

Destination Ports      : Gi0/23

    Encapsulation      : Native

          Ingress      : Disabled

test_switch#

Secondly, you should decide which port or vlan will be your source and which will be destination. In my case, my selection was port for both source and destination. Also, you may make a decision for direction of traffic to be mirrored.

Configuration on Cisco switch for source vlan x;

test_switch(config)#monitor session 1 source vlan 50 ?

  ,     Specify another range of VLANs

  -     Specify a range of VLANs

  both  Monitor received and transmitted traffic

  rx    Monitor received traffic only

  tx    Monitor transmitted traffic only

  <cr>

test_switch(config)#monitor session 1 source vlan 50 both

Configuration on Cisco switch for source port x;

test_switch(config)#monitor session 1 source interface gigabitEthernet 0/17 ?

  ,     Specify another range of interfaces

  -     Specify a range of interfaces

  both  Monitor received and transmitted traffic

  rx    Monitor received traffic only

  tx    Monitor transmitted traffic only

  <cr>

test_switch(config)#monitor session 1 source interface gigabitEthernet 0/17 both

After this config, you can make a sip call with ip phone that connected on the source port in order to check that there is UDP traffic on the destination port by whireshark.

There should be a physical connection between destination port and your laptop through ethernet cable. You can download TekTape demoversion from below link, when you are sure for existing sip traffic on the destination port,

In addition, you should download win10pcap from here;

After downloading, TekTape service must be started, then the web page connection can be established with your localhost:8080 on browser which is suggested as Chrome. 

username: your computer account

password: your password of computer's account

In this step, There is a trick point. You should disable your all firewall on your computer.

After the all connections, before your sample sip call to record sound, run the Tektape service and start on the Session section of the webpage. Please check the application logs on the App.Log section if there is any fail. 

 

When you started the sip call, it will appear on the Session section and can interrupt current call with delete option and also, it offers all records in anytime on Records section.

In order to change setting, you can visit Setting section on the webpage. In here, you have option to change recording directory, safe shutdown, operation mode, non-admin record deletion etc. Also, when you got any fail on process you can run TekTape by debug mode.

Recording Directory: choose your directory location where you archive it.

Non-Admin Record Deletion: it offers permission to delete records that subscribers owned.

Safe Shutdown: to safe all current calls when you shutdown your service.

Generate CDR: to enable create CDR for sip calls.

Record Audio: to enable record for all sip calls.

Operation Mode: decision for local or remote call record.

Through this method, you can record and archive your all sip calls on your network and TekTape tool that pruduced from kaplansoft is the best solution for this case.

Please do not hesitate to ask any question about this case with using my e-mail...