Configure network cards and filters

You can apply filters to IP traffic to increase performance when recording in Interception mode; do not apply filters in Delivery mode.

Only Interception mode is supported when recording IP video.

Filters can:

Prevent the Recorder from receiving excessive, unneeded packets.
Repress packets that the Recorder cannot process.
Remove specific IP address ranges and traffic.

You can also configure the (Network Interface Cards (NICs) in some TDM Recorders to create settings needed by the IP emulation of pseudo wire emulation protocols (PWE3).

Choosing the starting and ending ports for delivery recording

Before making configuration changes, note the following:When using delivery recording, the UDP port range assigned to the Recorder Analytics Framework Comprises the Recorder-based set of components shared by all the Real-Time Analytics (RTA) Framework solutions, part of Real-Time Speech Analytics as well as Identity Authentication and Fraud Detection (IAFD, also known as voice biometrics). server role Entity that contains a logical, predefined set of components (system software or certified third-party software) deployed in the Data Center and Site Zones that provide specific functionality for the system. to receive audio from the IP Capture Engine must be separate from the port range configured in Recorder Manager on the same recorder by IP Capture to receive RTP from the telephony system being captured.

The port ranges, by default, are empty and must always be configured on a new Recorder Server using delivery recording. The entire range of ports must be opened in any firewalls that would otherwise block the RTP traffic to the recorder. To learn about the default port ranges by server role, see the Firewall Ports Configuration Guide.

Since a single RTP stream uses an even port number, the next (odd) port number is reserved for any associated RTCP stream. Stereo recording uses two streams per recording. Therefore, four UDP ports are required for each concurrent channel. You can calculate the minimum size of the port range required based on the number of concurrent channels used with a 25% buffer added:

((Number of concurrent channels) * 4) * 1.25

Before you begin

Before making configuration changes, note the following:

Obtain filter expressions from your system architect or by visiting http://www.winpcap.org for filter expressions.
IP Analyzer is only used in interception environments; it has no role in delivery environments.

Procedure

In an IP Recorder, choose General Setup > Capture Settings > Cards and Filters.

Complete any editable settings:

Item	Description
Name	Shows a read-only description of the Network Interface Card. Card names must use the Latin alphabet. Non-Latin characters are not supported.
Device Name	Shows the read-only network connection name associated with the NIC.
Recording Type	Choose one of the following (the default is None) Delivery—The Starting Port, Ending Port, and Filter Expression fields are enabled, allowing selective recording based on the ports specified, and the filter expression. You cannot use this option with more than one NIC card. You cannot use this option to record IP video calls. Interception—Recording is based on the Filter Expression field (all other fields are unavailable). Select this option when recording IP video calls. RFC 2003 Interception—Recording is based on the Filter Expression field (all other fields are unavailable). Acme Packet SBC Session Replication allows a copy of specific calls to be delivered to a recording device on the network. Use the RFC 2003 Interception recording type if you are recording Acme Packet SBC-replicated traffic. You cannot use this option to record IP video calls. See the Avaya or Genesys Integration Guide for more information. RTP Proxy—Select RTP Proxy for V15.2 HFR3 and lower Lync environments where the Recorder acts as an RTP proxy to record calls. In this mode, the Recorder is placed in the RTP (audio) path between the endpoints in the call, and forwards audio between those two devices. You cannot use this option to record IP video calls. None—Starting Port, Ending Port and Filter Expression are unavailable and no recording takes place. Also note: If you expect the need for more channels in the future, start with a higher end NIC card. You cannot change the on-board NIC later. For all Recording Types, after disabling/enabling the NIC card you must return to this screen, save the configuration, then restart the IP Capture Service. For Skype environments, you do not need to configure a Recording type. IP Capture directly connects to the Verba Proxy/Media Collector to receive both signaling and audio on the connection.
Starting Port	Starting port specific to the Protocol. Only numerals separated by a comma are acceptable. The Starting Port number must be less than the Ending Port number. This field is enabled only if the Delivery recording type is selected.
Ending Port	Ending port specific to the Protocol. Only numerals separated by a comma are acceptable. The Ending Port number must be greater than the Starting Port number. This field is enabled only if the Delivery recording type is selected.
Filter Expression	Shows the name of the protocol or just the protocols that are specific to the card. This value is an expression such as TCP (transmission control protocol). The value is also the filter expression being used for this NIC. The actual filter expression is the logical sum (that is, the operator AND) of the filter on each card and the filter specified at the system level. See also Configure network protocols.
Subnet Mask	Type the subnet mask. The subnet mask is used to determine what subnet an IP address belongs to. An IP address has two components: the network address, and the host (workstation) address. For example, consider the IP address 150.215.017.009. The first two numbers (150.215) represent the Class B network address, and the second two numbers (017.009) identify a particular host (workstation) on this network.
Destination Subnet	Type the IP address of the host (workstation) address, as described in the Subnet Mask field.
Next Hop Router	Type the IP address of the next logical router device in the network.

Click Save.

Example: Filter Expression for RTP-based IP Recorders

You can reduce the amount of traffic that IP Recorders and Analyzers need to monitor by creating and applying network filters. A filter screens network traffic, allowing through only traffic that meets the conditions specified in the filter. Since a well-constructed filter can reduce or eliminate unnecessary traffic, it can improve your system performance.

Filters are applied at the Network Interface Card (NIC) level. If a Recorder has more than one NIC, a system-level filter applies to all of them. If you also apply NIC-level filters, the system appends these filters to the system-level filter. (Make certain that your system-level and NIC-level filters do not contradict or otherwise interfere with each other.) The Recorder uses WinPcap for network filtering. You can find information on their standardized filter syntax at http://www.winpcap.org.

The most typical filters would be:

(tcp port 2000) or (udp and not udp port 0) Use this filter in a standard Cisco SCCP environment. It tells the driver to let packets of port 2000 through; these are the SCCP packets, and also to let UDP packets through, which contain the RTP and therefore the audio.

(tcp port 5060) or (udp and not udp port 0) Use this filter in standard SIP environments. This filter lets the SIP control protocol through on port 5060 and the UDP, which contains the RTP and therefore the audio.

At a minimum, use the following standard pcap filters:

For Recorders that use SIP: (tcp port 5060) or (udp and not udp port 0). This filter lets the SIP control protocol through on ports 2000 and 5060 and the UDP, which contains the RTP and therefore the audio.
For Recorders that use SCCP: (tcp port 2000) or (udp and not udp port 0).

Because port numbers change according to customer environment, check with your system architect that the port numbers configured correctly reflect your environment.