Method and apparatus for identifying VoIP traffic

摘要

The present invention discloses a method for identifying Voice over Internet Protocol (VoIP) traffic. Based on a Media Gateway Control Protocol (MGCP), the method includes: identifying a packet related to a control connection by matching keywords according to an identification rule of the MGCP; extracting media connection negotiation information for establishing a media connection from the packet related to the control connection; matching the media connection negotiation information according to a transaction Identification (ID) in the media connection negotiation information; and identifying MGCP based VoIP traffic according to matching results. The present invention further discloses an apparatus for identifying VoIP traffic based on the MGCP. In the condition of using the MGCP and performing a plurality of media connection negotiations on one control connection simultaneously, the present invention can identify the MGCP based VoIP traffic without any particular requirement on the deployed positions of deep packet inspection devices.

主权项

1. A method for identifying Voice over Internet Protocol (VoIP) traffic, characterized in that the method is based on a Media Gateway Control Protocol (MGCP), and the method comprises:
identifying a packet related to a control connection by matching keywords according to an identification rule of the MGCP; extracting media connection negotiation information for establishing a media connection from the packet related to the control connection; matching the media connection negotiation information according to a transaction Identification (ID) in the media connection negotiation information; and identifying MGCP based VoIP traffic according to matching results; wherein, the packet related to the control connection comprises a control connection packet and a media connection negotiation packet, and the identification rule of the MGCP comprises an identification rule of the control connection packet and an identification rule of the media connection negotiation packet; the identification rule of the control connection packet is that first 4 characters in a payload area of the packet being MGCP command characters and “MGCP” keywords being after the MGCP command characters, wherein, the MGCP command characters comprise “EPCF”, “RQNT”, “NTFY”, “CRCX”, “MDCX”, “DLCX”, “AUEP”, “AUCX” and “RSIP”; and the identification rule of the media connection negotiation packet is that a payload area of the packet comprising keywords “v=”, “c=IN” and “m=”.