Всем привет!
Трабл:
VoIP оператор, занимаемся оригинацией и терминацией голосового трафика
(ну и Dialup немного), оборудование - Cisco 5350 & Cisco 1720
периодически возникает ситуация когда исходящий трафик превышает входящий в 1,5-2 раза - при этом ни факсов ни диалапщиков на канале нет
голос и диал приходят на Cisco 5350 по Е1 и далее на Cisco 1720 - с нее выделенка до М9 - 256квот пример - статистика снимается линуксовой тачкой скриптом по rsh
---------------------------------------------
-------------- kanal ------------------------
30 second input rate 96000 bits/sec, 343 packets/sec <<<<<<<это с 1720
30 second output rate 204000 bits/sec, 430 packets/sec-------------- voice ------------------------<<<<<<<<<<<<<<<<<<это с 5350
Total call-legs: 20
1509 : 1492391hs.1 +1691 pid:735321 Answer 73832339922 active
dur 00:43:55 tx:66225/2648922 rx:64781/2591201
IP 213.248.5.178:18566 rtt:126ms pl:1093000/55780ms lost:1434/58/1434 delay:60/50/180ms g729r81509 : 1492394hs.1 +1688 pid:73532 Originate 73532626503 active
dur 00:43:55 tx:64781/1796585 rx:66225/3443538
Tele 3/0:D (1804): tx:2649210/1080000/0ms g729r8 noise:-120 acom:17 i/0:-20/-14 dBm1638 : 1663427hs.1 +1444 pid:735321 Answer 73832339922 active
dur 00:15:27 tx:47029/940580 rx:46935/938700
IP 213.248.5.178:19140 rtt:155ms pl:354000/40ms lost:495/49/7 delay:70/30/320ms g729r81638 : 1663430hs.1 +1441 pid:73532 Originate 73532522442 active
dur 00:15:27 tx:46936/374396 rx:47030/1504924
Tele 3/0:D (1974): tx:940630/500000/0ms g729r8 noise:-120 acom:6 i/0:-63/-49 dBm1696 : 1679156hs.1 +705 pid:735321 Answer 73912595555 active
dur 00:12:57 tx:39058/781103 rx:14378/287560
IP 62.80.1.162:29846 rtt:190ms pl:136000/40ms lost:28/1/2 delay:230/30/240ms g729r81696 : 1679160hs.1 +701 pid:73532 Originate 73532630142 active
dur 00:12:57 tx:14378/4294786256 rx:39058/1249703
Tele 3/0:D (2006): tx:781530/470000/0ms g729r8 noise:-120 acom:6 i/0:-21/-52 dBm3110 : 1689291hs.1 +621 pid:735321 Answer 70959261326 active
dur 00:11:16 tx:34118/682360 rx:34074/681480
IP 195.161.102.220:2346 rtt:160ms pl:358000/10ms lost:0/1/1 delay:70/50/100ms g729r83110 : 1689294hs.1 +618 pid:73532 Originate 73532777470 active
dur 00:11:16 tx:34075/272108 rx:34119/1091772
Tele 3/0:D (2012): tx:682380/631000/0ms g729r8 noise:-120 acom:22 i/0:-21/-12 dBm181A : 1711125hs.1 +1292 pid:735321 Answer 73912595555 active
dur 00:07:31 tx:23076/461482 rx:11027/220540
IP 62.80.1.162:30796 rtt:176ms pl:211000/0ms lost:27/5/0 delay:180/30/190ms g729r8181A : 1711127hs.1 +1290 pid:73532 Originate 73532659521 active
dur 00:07:31 tx:11027/4294910984 rx:23077/738354
Tele 3/0:D (2028): tx:461770/310000/0ms g729r8 noise:-120 acom:24 i/0:-32/-37 dBm38AD : 1729955hs.1 +501 pid:735321 Answer 73832339922 active
dur 00:04:31 tx:6833/273320 rx:6648/265920
IP 213.248.5.178:19372 rtt:132ms pl:98000/6870ms lost:177/20/177 delay:110/50/160ms g729r838AD : 1729958hs.1 +498 pid:73532 Originate 73532763790 active
dur 00:04:31 tx:6648/183936 rx:6834/355344
Tele 3/0:D (2050): tx:273400/178000/0ms g729r8 noise:-120 acom:15 i/0:-37/-22 dBm1A02 : 1745976hs.1 +1908 pid:735321 Answer 73912595555 active
dur 00:01:37 tx:5684/113680 rx:1727/34540
IP 62.80.1.162:31860 rtt:176ms pl:11000/0ms lost:3/2/0 delay:100/40/150ms g729r81A02 : 1745979hs.1 +1905 pid:73532 Originate 73532411049 active
dur 00:01:37 tx:1727/4294933640 rx:5685/181896
Tele 3/0:D (2072): tx:113740/63000/0ms g729r8 noise:-120 acom:22 i/0:-20/-51 dBm2CA7 : 1746431hs.1 +1698 pid:735321 Answer 73912595555 active
dur 00:01:34 tx:5399/107980 rx:5380/107600
IP 62.80.1.162:31866 rtt:192ms pl:49000/0ms lost:5/81/0 delay:110/60/120ms g729r82CA7 : 1746433hs.1 +1696 pid:73532 Originate 73532236784 active
dur 00:01:34 tx:5381/42868 rx:5399/172732
Tele 3/0:D (2074): tx:108020/35000/0ms g729r8 noise:-120 acom:29 i/0:-52/-32 dBm2420 : 1751115hs.1 +1489 pid:735321 Answer 73912595555 active
dur 00:00:50 tx:2977/59540 rx:2967/59340
IP 62.80.1.162:32016 rtt:187ms pl:22000/0ms lost:9/1/0 delay:40/40/90ms g729r82420 : 1751118hs.1 +1486 pid:73532 Originate 73532571252 active
dur 00:00:50 tx:2968/23660 rx:2978/95260
Tele 3/0:D (2078): tx:59590/27000/0ms g729r8 noise:-120 acom:29 i/0:-11/-7 dBm3BB9 : 1753000hs.1 +2080 pid:735321 Answer 73832339922 active
dur 00:00:25 tx:984/39360 rx:940/37600
IP 213.248.5.178:19448 rtt:129ms pl:9000/1150ms lost:31/1/31 delay:120/60/130ms g729r83BB9 : 1753003hs.1 +2077 pid:73532 Originate 73532558591 active
dur 00:00:25 tx:940/25804 rx:985/51196
Tele 3/0:D (2080): tx:39430/14000/0ms g729r8 noise:-120 acom:23 i/0:-46/-48 dBm--------------- fax -----------------------
Total call-legs: 0HELP!!!!!!!!!!!!!!!!!!!!!!!!!
А траффик на 17-ой проанализировать не судьба? Netflow в руки и sh ip cache flow даже на самом роутре. Три-четыре таких ситуации, и найдещь откуда и куда убегают байты.
>А траффик на 17-ой проанализировать не судьба? Netflow в руки и
>sh ip cache flow даже на самом роутре. Три-четыре таких ситуации,
>и найдещь откуда и куда убегают байты.
Да вот у меня на линуксе стоит MRTG - забирает статистику по SNMP и с
1720 и с 5350 - по картинкам вроде все неплохо т.е. средние значения
трафика как исходящего так и входящего почти одинаковы, но все-таки видно что частенько бывает исходящий поболее(могу прислать
если что)- но видимо недостаточно информации
То есть ставлю какой-нить NetFlow коллектор под линукс - кстати
посоветуй плиз какой лучше проинсталлить - и на него лью с 1720 статистику
- насколько я понимаю задача - выяснить что за злобная железяка
генерит такой трафик - все верно? Кстати на 1720 стоит еще на внешнем
интерфейсе(к прову выделенка)ip accounting output-packets - это
провайдер забирает статистику по исходящему трафику
а NetFlow насколько я знаю наоборот - считает входящий трафик - но с
ним вроде все нормально, вот исходящий какой злодей генерит - вот чего
неясноИ еще момент - в предыдущей мессаге обрати внимание на строки
1A02 : 1745979hs.1 +1905 pid:73532 Originate 73532411049 active
dur 00:01:37 tx:1727/4294933640<<<<<<<<<<<<<<<<<<<<<<вот енто что за
миллиарды кошмарные, не пойму откуда это rx:5685/181896
Tele 3/0:D (2072): tx:113740/63000/0ms g729r8 noise:-120 acom:22 i/0:-20/-51 dBmкстати - исходящий трафик если больше на 5350 - то и на 1720, и наоборот
т.е вроде как получается либо 5350 генерит либо что за ней - но что за ней вроде проверил(хосты) - все ок, так что наверное дело в VoIP-DialUp
>То есть ставлю какой-нить NetFlow коллектор под линукс - кстати
>посоветуй плиз какой лучше проинсталлить - и на него лью с 1720
>статистику
У меня самописный скрипт либо flow-tools в таких случаях работают
>- насколько я понимаю задача - выяснить что за злобная железякаС какого ip-адреса ...
>генерит такой трафик - все верно? Кстати на 1720 стоит еще на
>внешнем
>интерфейсе(к прову выделенка)ip accounting output-packets - это
>провайдер забирает статистику по исходящему трафику>а NetFlow насколько я знаю наоборот - считает входящий трафик - но
NetFlow считает входящий траффик на определенный интерфейс. Но если он для какого-то интерфейса является входящим, значит для остальных он будет исходящим.
Необходимо лишь правильно выбрать интерфейс. В твоем случае это тот, на которой зацеплена 5350.
ok, thanx за совет по выбору коллектораэто ясно
Customers->ATC->E1->Cisco5350->eth->Cisco1720->Serial->M9
снимаю статистику с eth на 1720-это ясноно - как писал ранее:
1A02 : 1745979hs.1 +1905 pid:73532 Originate 73532411049 active
dur 00:01:37 tx:1727/4294933640<<<<<<<<<<<<<<<<<<<<<<вот енто что за
миллиарды кошмарные, не пойму откуда это rx:5685/181896
Tele 3/0:D (2072): tx:113740/63000/0ms g729r8 noise:-120 acom:22 i/0:-20/-51 dBmкстати - исходящий трафик если больше на 5350 - то и на 1720, и наоборот
т.е вроде как получается либо 5350 генерит либо что за ней - но что за ней вроде проверил(хосты) - все ок, так что наверное дело в VoIP-DialUpт.е. ситуация такая что на 1720 уже приходит больший исходящий трафик с 5350 - имхо тогда нет смысла париться с 1720 - дело в 5350
на 5350 2 eth интерфейса - один на 1720, другой на мою служебную сетку, которая - проверил - не генерит сей левый трафик
остается E1?
да вроде ниче тама не меняли особо - ранее такой ситаации не было???????????????
IOS 12.2(2)XB6вот voice-class:
voice class codec 1
codec preference 1 g729r8 bytes 40
codec preference 2 g723r63
codec preference 3 g723r53
codec preference 4 g729br8
codec preference 5 g711alaw
!
!
!
voice class h323 100
call start slow
!
!
!
voice class dualtone-detect-params 100
freq-max-deviation 50
freq-max-delay 20
!ну а диал-пиров много
вот пир на который звонят клиенты:
VoiceEncapPeer100
information type = voice,
description = `',
tag = 100, destination-pattern = `',
answer-address = `', preference=0,
numbering Type = `unknown'
group = 100, Admin state is up, Operation state is up,
incoming called-number = `797766', connections/maximum = 6/unlimited,
DTMF Relay = disabled,
huntstop = disabled,
in bound application associated: 'newoss'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = pots, prefix = `',
forward-digits default
session-target = `', voice-port = `',
direct-inward-dial = disabled,
digit_strip = enabled,
register E.164 number with GK = TRUEConnect Time = 67914233, Charged Units = 0,
Successful Calls = 0, Failed Calls = 0, Incomplete Calls = 0
Accepted Calls = 6084, Refused Calls = 201,
Last Disconnect Cause is "10 ",
Last Disconnect Text is "normal call clearing.",
Last Setup Time = 41387465.вот парочка пиров на оригинацию трафика на Москву:
VoiceOverIpPeer70951
information type = voice,
description = `',
tag = 70951, destination-pattern = `7095T',
answer-address = `', preference=0,
numbering Type = `unknown'
group = 70951, Admin state is up, Operation state is up,
incoming called-number = `', connections/maximum = 0/unlimited,
DTMF Relay = disabled,
modem passthrough = system,
huntstop = disabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = voip, session-target = `ipv4:195.28.35.11',
technology prefix:
settle-call = disabled
ip media DSCP = default, ip signaling DSCP = default, UDP checksum = disabled,
session-protocol = cisco, session-transport = system, req-qos = best-effort,
acc-qos = best-effort,
RTP dynamic payload type values: NTE = 101
Cisco: NSE=100, fax=96, fax-ack=97, dtmf=121, fax-relay=122
CAS=123, ClearChan=125, PCM switch over u-law=126,A-law=127
fax rate = 9600, payload size = 40 bytes
fax protocol = t38 ls-redundancy = 5 hs-redundancy = 2
fax NSF = 0xAD0051 (default)
codec = g723r63, payload size = 48 bytes,
Expect factor = 0, Icpif = 20,
Playout Mode is set to default,
Initial 60 ms, Max 300 ms
Playout-delay Minimum mode is set to default, value 40 ms
Expect factor = 0,
Max Redirects = 1, Icpif = 20,signaling-type = ext-signal,
CLID Restrict = disabled
VAD = enabled, Poor QOV Trap = disabled,
voice class sip url = system,
voice class sip rel1xx = system,
voice class perm tag = `'
Connect Time = 17758221, Charged Units = 0,
Successful Calls = 1280, Failed Calls = 553, Incomplete Calls = 232
Accepted Calls = 0, Refused Calls = 0,
Last Disconnect Cause is "3 ",
Last Disconnect Text is "no route to destination.",
Last Setup Time = 41397876.
VoiceOverIpPeer70952
information type = voice,
description = `',
tag = 70952, destination-pattern = `7095T',
answer-address = `', preference=2,
numbering Type = `unknown'
group = 70952, Admin state is up, Operation state is up,
incoming called-number = `', connections/maximum = 0/unlimited,
DTMF Relay = disabled,
modem passthrough = system,
huntstop = disabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = voip, session-target = `ipv4:195.128.80.9',
technology prefix:
settle-call = disabled
ip media DSCP = default, ip signaling DSCP = default, UDP checksum = disabled,
session-protocol = cisco, session-transport = system, req-qos = best-effort,
acc-qos = best-effort,
RTP dynamic payload type values: NTE = 101
Cisco: NSE=100, fax=96, fax-ack=97, dtmf=121, fax-relay=122
CAS=123, ClearChan=125, PCM switch over u-law=126,A-law=127
fax rate = voice, payload size = 20 bytes
fax protocol = system
fax NSF = 0xAD0051 (default)
codec = g729r8, payload size = 20 bytes,
Expect factor = 0, Icpif = 20,
Playout Mode is set to default,
Initial 60 ms, Max 300 ms
Playout-delay Minimum mode is set to default, value 40 ms
Expect factor = 0,
Max Redirects = 1, Icpif = 20,signaling-type = ext-signal,
CLID Restrict = disabled
VAD = disabled, Poor QOV Trap = disabled,
voice class sip url = system,
voice class sip rel1xx = system,
voice class perm tag = `'
Connect Time = 0, Charged Units = 0,
Successful Calls = 298, Failed Calls = 0, Incomplete Calls = 0
Accepted Calls = 0, Refused Calls = 0,
Last Disconnect Cause is "10 ",
Last Disconnect Text is "normal call clearing.",
Last Setup Time = 41468232.
вот на терминацию:
VoiceEncapPeer73532
information type = voice,
description = `',
tag = 73532, destination-pattern = `73532T',
answer-address = `', preference=0,
numbering Type = `unknown'
group = 73532, Admin state is up, Operation state is up,
incoming called-number = `', connections/maximum = 7/10,
DTMF Relay = disabled,
huntstop = enabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = pots, prefix = `',
forward-digits default
session-target = `', voice-port = `3/0:D',
direct-inward-dial = enabled,
digit_strip = enabled,
register E.164 number with GK = TRUEConnect Time = 80892427, Charged Units = 0,
Successful Calls = 6770, Failed Calls = 4286, Incomplete Calls = 2877
Accepted Calls = 0, Refused Calls = 0,
Last Disconnect Cause is "11 ",
Last Disconnect Text is "user busy.",
Last Setup Time = 41510778.VoiceOverIpPeer735321
information type = voice,
description = `',
tag = 735321, destination-pattern = `',
answer-address = `', preference=0,
numbering Type = `unknown'
group = 735321, Admin state is up, Operation state is up,
incoming called-number = `73532T', connections/maximum = 9/10,
DTMF Relay = enabled,
modem passthrough = system,
huntstop = disabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = voip, session-target = `',
technology prefix:
settle-call = disabled
ip media DSCP = default, ip signaling DSCP = default, UDP checksum = disabled,
session-protocol = cisco, session-transport = system, req-qos = best-effort,
acc-qos = best-effort,
dtmf-relay = h245-signal,
RTP dynamic payload type values: NTE = 101
Cisco: NSE=100, fax=96, fax-ack=97, dtmf=121, fax-relay=122
CAS=123, ClearChan=125, PCM switch over u-law=126,A-law=127
fax rate = voice, payload size = 20 bytes
fax protocol = system
fax-relay ecm disable
fax NSF = 0xAD0051 (default)
codec = g729r8, payload size = 20 bytes,
Expect factor = 0, Icpif = 20,
Playout Mode is set to default,
Initial 60 ms, Max 300 ms
Playout-delay Minimum mode is set to default, value 40 ms
Expect factor = 0,
Max Redirects = 1, Icpif = 20,signaling-type = ext-signal,
CLID Restrict = disabled
VAD = disabled, Poor QOV Trap = disabled,
voice class sip url = system,
voice class sip rel1xx = system,
voice class perm tag = `'
Connect Time = 80840705, Charged Units = 0,
Successful Calls = 0, Failed Calls = 0, Incomplete Calls = 0
Accepted Calls = 6764, Refused Calls = 7560,
Last Disconnect Cause is "10 ",
Last Disconnect Text is "normal call clearing.",
Last Setup Time = 41519536.оригинация на Питер:
VoiceOverIpPeer78123
information type = voice,
description = `',
tag = 78123, destination-pattern = `7812T',
answer-address = `', preference=2,
numbering Type = `unknown'
group = 78123, Admin state is up, Operation state is up,
incoming called-number = `', connections/maximum = 0/unlimited,
DTMF Relay = disabled,
modem passthrough = system,
huntstop = enabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = voip, session-target = `ipv4:195.128.80.9',
technology prefix:
settle-call = disabled
ip media DSCP = default, ip signaling DSCP = default, UDP checksum = disabled,
session-protocol = cisco, session-transport = system, req-qos = best-effort,
acc-qos = best-effort,
RTP dynamic payload type values: NTE = 101
Cisco: NSE=100, fax=96, fax-ack=97, dtmf=121, fax-relay=122
CAS=123, ClearChan=125, PCM switch over u-law=126,A-law=127
fax rate = 9600, payload size = 20 bytes
fax protocol = system
fax NSF = 0xAD0051 (default)
codec = g729r8, payload size = 20 bytes,
Expect factor = 0, Icpif = 20,
Playout Mode is set to default,
Initial 60 ms, Max 300 ms
Playout-delay Minimum mode is set to default, value 40 ms
Expect factor = 0,
Max Redirects = 1, Icpif = 20,signaling-type = ext-signal,
CLID Restrict = disabled
VAD = disabled, Poor QOV Trap = disabled,
voice class sip url = system,
voice class sip rel1xx = system,
voice class perm tag = `'
Connect Time = 0, Charged Units = 0,
Successful Calls = 21, Failed Calls = 0, Incomplete Calls = 0
Accepted Calls = 0, Refused Calls = 0,
Last Disconnect Cause is "10 ",
Last Disconnect Text is "normal call clearing.",
Last Setup Time = 41435344.ну и вот еще:
VoiceOverIpPeer1001
information type = voice,
description = `',
tag = 1001, destination-pattern = `[1,2,3,4,5,6,7,8,9]T',
answer-address = `', preference=1,
numbering Type = `unknown'
group = 1001, Admin state is up, Operation state is up,
incoming called-number = `', connections/maximum = 0/unlimited,
DTMF Relay = disabled,
modem passthrough = system,
huntstop = disabled,
in bound application associated: 'DEFAULT'
out bound application associated: ''
dnis-map =
permission :both
incoming COR list:maximum capability
outgoing COR list:minimum requirement
type = voip, session-target = `ipv4:195.28.35.11',
technology prefix:
settle-call = disabled
ip media DSCP = default, ip signaling DSCP = default, UDP checksum = disabled,
session-protocol = cisco, session-transport = system, req-qos = best-effort,
acc-qos = best-effort,
RTP dynamic payload type values: NTE = 101
Cisco: NSE=100, fax=96, fax-ack=97, dtmf=121, fax-relay=122
CAS=123, ClearChan=125, PCM switch over u-law=126,A-law=127
fax rate = 9600, payload size = 20 bytes
fax protocol = system
fax NSF = 0xAD0051 (default)
codec = g729r8, payload size = 20 bytes,
Expect factor = 0, Icpif = 20,
Playout Mode is set to default,
Initial 60 ms, Max 300 ms
Playout-delay Minimum mode is set to default, value 40 ms
Expect factor = 0,
Max Redirects = 1, Icpif = 20,signaling-type = ext-signal,
CLID Restrict = disabled
VAD = disabled, Poor QOV Trap = disabled,
voice class sip url = system,
voice class sip rel1xx = system,
voice class perm tag = `'
Connect Time = 8527494, Charged Units = 0,
Successful Calls = 763, Failed Calls = 1267, Incomplete Calls = 307
Accepted Calls = 0, Refused Calls = 0,
Last Disconnect Cause is "10 ",
Last Disconnect Text is "normal call clearing.",
Last Setup Time = 41721171.
конфиг далпиров покажите, и voice class если есть...