Configure network cards and filters

You can apply filters to IP traffic to increase performance when recording in Interception mode; you may not apply filters in Delivery mode.

Only Interception mode is supported when recording IP video.

Filters can:

Prevent the Recorder from receiving excessive, unneeded packets.
Repress packets that the Recorder may not be able to process.
Remove specific IP address ranges and traffic.

You can also configure the NICs in some TDM Recorders to create settings needed by the IP emulation of pseudo wire emulation protocols (PWE3).

IP Analyzer is only used in interception environments; it has no role in delivery environments.

Before completing this area, you must obtain filter expressions from your system architect or by visiting http://www.winpcap.org for filter expressions.

Procedure

In an IP Recorder, choose General Setup > Capture Settings > Cards and Filters.

Complete any editable settings:

Item	Description
Name	Shows a read-only description of the Network Interface Card. Card names must use the Latin alphabet. Non-Latin characters are not supported.
Device Name	Shows the read-only network connection name associated with the NIC.
Recording Type	Choose one of the following (the default is None) Delivery—The Starting Port, Ending Port, and Filter Expression fields are enabled, allowing selective recording based on the ports specified, and the filter expression. You cannot use this option with more than one NIC card. You cannot use this option to record IP video calls. Interception—Recording is based on the Filter Expression field (all other fields are disabled). You must select this option to record IP video calls. RFC 2003 Interception—Recording is based on the Filter Expression field (all other fields are disabled). Acme Packet SBC Session Replication allows a copy of specific calls to be delivered to a recording device on the network. Use the RFC 2003 Interception recording type if you are recording Acme Packet SBC-replicated traffic. You cannot use this option to record IP video calls. See the Avaya or Genesys Integration Guide for more information. RTP Proxy—Select RTP Proxy for V15.2 HFR3 and lower Lync environments where the Recorder will act as an RTP proxy to record calls. In this mode, the Recorder will be placed in the RTP (audio) path between the endpoints in the call, and will forward audio between those two devices. You cannot use this option to record IP video calls. None—Starting Port, Ending Port and Filter Expression are disabled and no recording takes place. Please also note: It is recommended that if you expect at any time in the future that you will require more channels, that you start with a higher end NIC card, as it will not possible to change the on-board NIC at a later date. For all Recording Types, after disabling/enabling the NIC card you must return to this screen, save the configuration, then restart the IP Capture Service. For Skype environments, you do not need to configure a Recording type. IP Capture directly connects to the Verba Proxy/Media Collector to receive both signaling and audio on the connection.
Starting Port	Starting port specific to the Protocol. Only numerals separated by a comma are acceptable and the number should be a lower number than the Ending Port. This field is enabled only if the Delivery recording type is selected.
Ending Port	Ending port specific to the Protocol. Only numerals separated by a comma are acceptable, and the number should be greater than the Ending Port. This field is enabled only if the Delivery recording type is selected.
Filter Expression	Shows the name of the protocol or just protocols that are specific to the card. This is an expression such as TCP (transmission control protocol). The value is also the filter expression being used for this NIC. The actual filter expression is the logical sum (that is, the operator AND) of the filter on each card and the filter specified at the system level. See also Configure network protocols.
Subnet Mask	Type the subnet mask. The subnet mask is used to determine what subnet an IP address belongs to. An IP address has two components: the network address, and the host (workstation) address. For example, consider the IP address 150.215.017.009. The first two numbers (150.215) represent the Class B network address, and the second two numbers (017.009) identify a particular host (workstation) on this network.
Destination Subnet	Type the IP address of the host (workstation) address, as described in Subnet Mask above.
Next Hop Router	Type the IP address of the next logical router device in the network.

Click Save.

Example: Filter Expression for RTP-based IP Recorders

You can reduce the amount of traffic that IP Recorders and Analyzers need to monitor by creating and applying network filters. A filter screens network traffic, allowing through only traffic that meets the conditions specified in the filter. Since a well-constructed filter can reduce or eliminate unnecessary traffic, it can improve your system performance.

Filters are applied at the Network Interface Card (NIC) level. If a Recorder has more than one NIC, a system-level filter will apply to all of them. If you also apply NIC-level filters, the system appends these to the system-level filter. (Make certain that your system-level and NIC-level filters do not contradict or otherwise interfere with each other.) The Recorder uses WinPcap for network filtering. You can find information on their standardized filter syntax at http://www.winpcap.org.

The most typical filters would be:

(tcp port 2000) or (udp and not udp port 0) This filter should be used in a standard Cisco SCCP environment. It tells the driver to let packets of port 2000 through; these are the SCCP packets, and also to let UDP packets through, which contain the RTP and therefore the audio.

(tcp port 5060) or (udp and not udp port 0) This filter should be used in standard SIP environments. This filter lets the SIP control protocol through on port 5060 and the UDP, which contains the RTP and therefore the audio.

At a minimum, you should use the following standard pcap filters:

For Recorders that use SIP: (tcp port 5060) or (udp and not udp port 0). This filter lets the SIP control protocol through on ports 2000 and 5060 and the UDP, which contains the RTP and therefore the audio.
For Recorders that use SCCP: (tcp port 2000) or (udp and not udp port 0).

Because port numbers change according to customer environment, you should check with your system architect that the above port numbers correctly reflect your environment.