Cisco Content Hub – Troubleshooting VoWLAN using OmniPeek

Capturing Data for Wireless Analysis

To troubleshoot VoWLAN, we must first capture
the wireless data carrying the VoWLAN information. Capturing data
for wireless analysis can be broken down into two main categories:
portable and distributed. The type of data captured and retained
varies depending on the intended use of the data. OmniPeek is
designed for troubleshooting and root cause analysis, therefore it
captures and stores every 802.11 packet.

Portable Analysis

Portable analysis requires that the analyst
be present at the source of data collection with the appropriate
hardware and software to perform the analysis. Portable analysis
using OmniPeek is typically done with a laptop computer running
OmniPeek Professional or OmniPeek Enterprise, using one or more
supported wireless adapters.

Distributed Analysis

Distributed analysis allows the analyst to
collect data from remote locations and analyze the data locally.
This eliminates costly visits to remote locations for portable
analysis. WildPackets supports two primary methods for distributed
analysis.

AP Remote Adapters

The AP Remote Adapter provides connectivity
between OmniPeek and Cisco LWAPP/CAPWAPs over a wired network.
Using the control software for the managed wireless switch, first
choose which access point(s) to use as packet capture devices. Once
selected, set the channel to be used and then specify the IP
address where OmniPeek is running. This is the IP address that the
AP(s) will send the packets to. Now configure OmniPeek to receive
the packet stream by starting a new capture and setting the Cisco
Remote Adapter properties in the Capture Options dialog box as shown below.

Figure 6-1 Capture Options

Name: Provide a unique
name for the remote adapter.

IP Address: Providing an
IP address means OmniPeek will accept only packets from that IP
address. If this field is left blank, OmniPeek will accept packets
from any AP that sends packets to the IP address of the computer
running OmniPeek.

Set any other capture parameters and click
OK. Then click Start once
the OmniPeek capture screen is shown.

For a video guide of this procedure, see
http://www.wildpackets.com/ciscoapgrabber_video.

OmniEngines

OmniEngines provide data capture and analysis
24 hours a day without requiring ongoing monitoring by the analyst.
OmniEngines are Windows software or Linux appliances (Omnipliances)
that are designed for continuous, remote operation. For wireless
analysis, supported wireless adapters need to be added to enable
wireless capture. OmniEngines are remotely controlled using
OmniPeek as a console. Use the OmniPeek UI to configure and start
the capture on the OmniEngine. All data is then captured, analyzed
and stored by the OmniEngine, with no data sent over the wired
network. All results from the OmniEngine analysis can be viewed
using the OmniPeek console.

Optimizing Analysis for Wireless

OmniPeek is designed for a wide range of
analysis tasks, but very often only a limited set of analysis
options are pertinent to the task at hand. Following are guidelines
for configuring various analysis options to optimize performance
for wireless analysis.

Analysis Options

The analysis capabilities of OmniPeek are
broken down into functional options. It is often the case that not
all functional analysis options will be needed for the work being
done. Turning off unnecessary analysis options will improve
OmniPeek performance. To view and turn off unneeded analysis
options when starting a new capture, choose Analysis Options from the left-hand navigation in the
Capture Options window. You will see the
following dialog box which you can use to turn off all unneeded
analysis options. Remember to keep Voice & Video Analysis enabled for VoWLAN analysis.

Figure 6-2 Analysis Options

Note If you later find that you need a certain analysis
option that you disabled, and you saved the packet capture files,
just enable the analysis option and open the packet file to see the
newly enabled analysis results.

Expert Event Analysis

In addition to functional analysis options,
OmniPeek continually monitors the network for Expert events,
network anomalies, and suboptimal performance at all layers of the
network, from application to physical. It also shows network events
associated with wireless-specific anomalies and VoIP calls. Each
individual Expert event can be enabled or disabled separately. It
is important to review the Expert events to ensure that events you
want to analyze are enabled. Once a capture is started, choose any
one of the Expert Views from the left-hand navigation of the main
Capture Window, and then click on the
Expert EventFinder Settings icon. The
Expert EventFinder Settings dialog box will
appear, allowing each individual Expert event to be configured and
enabled or disabled. Pay special attention to the VoIP and Wireless
Expert Events, as these can be extremely useful in identifying
VoWLAN issues before they become serious problems.

Figure 6-3 Expert Event Analysis

Multichannel Analysis

Multichannel analysis allows multiple,
simultaneous captures on unique wireless channels with all captured
packets analyzed as if it is a single capture. This is extremely
useful for analyzing situations where users are roaming from
channel to channel, or when it is known where a problem is but not
what channel the wireless client is using. Multichannel analysis
requires the download and installation of the Wireless Channel
Aggregator plug-in from the MyPeek Community Portal (https://mypeek.wildpackets.com/view_submission.php?id=81)
as well as one supported wireless adapter for each channel that
will be analyzed. To configure OmniPeek for multichannel analysis,
start a new capture and choose Adapter from
the left-hand navigation in the Capture Options dialog box. Expand Module: Wireless Channel Aggregator and choose
New Adapter by double-clicking. Choose the
wireless adapters you wish to use for channel aggregation and set
the channel for each. Click Save, set any
other desired capture options, click OK and
then click Start Capture when the main
Capture Window appears.

Figure 6-4 Multichannel Analysis

Roaming

Roaming analysis provides detailed
information every time a wireless client moves from one AP to
another. Roaming analysis requires multichannel analysis since
roaming typically involves a change in channel, as well as the
download and installation of the Roaming Latency Plug-in from the
MyPeek Community Portal (https://mypeek.wildpackets.com/view_submission.php?id=75).
Once the Roaming Latency Plug-in is installed, it can be used with
all wireless captures. To see the results of any wireless roaming,
go to Roaming in the left-hand navigation of
the main Capture Window and choose the desired
view: Log, by Node or by AP. An example of the by AP view is as follows.

Figure 6-5 Log By AP View

Note The Roaming Latency Plug-in assumes wireless clients
are moving from one channel to another. If the capture is for a
single channel, no roaming will be detected or reported. If the
capture is scanning, roaming will be detected and reported but the
latency measurements will not be accurate. For best results the
Roaming Latency Plug-in should be used along with the Wireless
Channel Aggregator.

The VoIP Dashboard

The Voice & Video
dashboard provides a visual summary of voice and video calls,
including VoWLAN calls, as well as useful graphs and statistics to
troubleshoot and analyze voice and video traffic. An example of the
Voice and Video dashboard is as follows.

Figure 6-6 VoIP Dashboard

The parts of the Voice & Video dashboard are described below.

•Call Summary: This display shows “Call Counter”
information and “Closed Call Statistics” on voice and video packet
loss.

•Call Quality Distribution: This display shows open and
closed calls by quality based on MOS scores. You can right-click
inside the display to select a bar or pie display. Because MOS
scores are based on media flows, and not calls, each call’s quality
is the lowest MOS score of any of its associated media flows. Voice
media is scored with MOS-CQ, video media with MOS-V, and audio
media with MOS-A. The quality thresholds are as follows:

–<2.0 = Bad (displayed in Red)

–>=2.0 to <3.0 = Poor (displayed in Orange)

–=3.0 to <4.0 = Fair (displayed in Yellow)

–>4.0 = Good (displayed in Green)

•Call Quality: This display shows a line graph of the
quality for each codec in use over time. You can right-click inside
the display to select a line or line/points graph. MOS scores are
used for the quality measurement. Voice media is scored with
MOS-CQ, video media with MOS-V, and audio media with MOS-A. The
quality for a time period is the average of the MOS scores for all
open media flows for that time period

•Call Volume: This display shows a graph of open calls
(per codec) over time for voice and video calls. This graph
reflects all calls from the Calls and
Media view. You can right-click inside the
display to select an area, line, or line/points graph.

•Call Utilization: This display shows a graph of
overall network utilization compared to network utilization by VoIP
protocols. You can right-click inside the display to select an
area, line, or line/points graph. This graph displays two legends:
Network Utilization and Call Utilization. Utilization values are
displayed in Mbps. The VoIP utilization is the total utilization
for all VoIP packets (i.e., signaling, media RTP/RTCP and
unsupported codecs).

Detailed VoIP Analysis

Voice and video over IP signaling and media
analysis are included with OmniPeek Enterprise. In OmniPeek, the
unit of communication is the call, and an individual call may be
carried in multiple channels, some dedicated to signaling and
others to carrying the encoded voice data. The encoded data is
referred to as media, and a call containing such data has media
channels. Media channels contain RTP (Real-time Transport Protocol)
or RTCP (RTP Control Protocol) data. The conversion of voice data
into digital form and back again is accomplished using a particular
codec (coder/decoder), specified in the RTP header.

The Voice & Video
views in Capture Windows provide simultaneous
analysis of voice and video traffic with subjective and objective
quality metrics. The Calls view displays one
row for each call in a capture and the Media
view displays one row for each RTP media flow in a call.

The Voice & Video
views have two data areas. The upper pane contains voice and video
data arranged by call or by the media streams within a call. The
lower pane contains three tabs which present additional information
for a row or rows selected in the upper pane, allowing you to view
call details, a summary count of the Expert events found in the
capture, or a capture log of the individual VoIP Expert events.

The Calls View

The Calls view displays
one row for each call. Each call is displayed in the order in which
it was captured, with call number, call name, and end cause
information. You can click any column header to sort by that column
data. Right-click the column header to display additional view
columns. An example of the Calls view is as
follows.

Figure 6-7 Calls View

The Media View

The Media view displays one row for each RTP
media flow in a call. A voice call will usually have two media
flows, one for each direction. Video calls will usually have four
media flows: two voice and two video. You can click any column
header to sort by that column data. Right-click the column header
to display additional view columns. An example of the Media view is as follows.

Figure 6-8 Media View

Voice and Video Visual Expert

The Voice & Video Visual Expert displays each
individual packet of an entire call within a single window, as well
as the RTP packet timing, jitter, and quality score over time. If
there are gaps of missing or late RTP packets, these gaps are also
displayed, along with their effect on call quality.

The Voice & Video Visual Expert window displays a
signal bounce diagram with columns corresponding to each node
participating in the call. Signaling and media stream packets are
represented by horizontal lines, giving you an immediate overview
of the contents of a call. The bounce diagram also includes linear
representations as well as numerical measurements of R-Factor and
jitter values. Right-click the column header to display additional
view columns. An example of the Voice & Video Visual Expert is as follows.

Figure 6-9 Voice and Video Visual Expert

The key for interpreting the various lines
and symbols is as follows.

Signaling Packets:

•Each signaling packet appears as a black horizontal
arrow, with a summary above the arrow.

•Packets that start a call (such as SIP INVITE packets)
start with a small diamond.

•Packets that usually mean the end of call setup (such
as SIP ACK packets) start with a small bar. The time between these
two packets is the call setup time.

Media (RTP/RTCP) Packets

The media or voice streams (RTP/RTCP packets)
within a call display in the Signaling tab as
rows progressing through time, with the first packet in the row at
the left to the last packet at the right. Since most calls are
bidirectional, a pair of rows often appears with one row for each
direction.

•Gray arrows and numbers: Gray horizontal arrows
represent the RTP/RTCP media packets. The last packet in the row
displays a small gray number showing the entire duration for the
row.

•Green lines and numbers: Green horizontal lines show
R-Factor conversational values, with the row’s final value and
minimum-maximum range in green to the right of the last packet in
the row.

•Blue lines and numbers: Blue lines show jitter values,
with the row’s final value and minimum-maximum range in blue to the
right of the last packet in the row.

•Blue tick marks: Blue tick marks represent RTCP
packets.

•Gray tick marks: Gray tick marks represent
out-of-sequence RTP packets.

•Red tick marks: Red tick marks show gaps of one or
more missing packets.

Voice Playback

To play the audio, right-click the call or
media flow in the Calls or Media views, and choose Play Audio. (You can also select the call or media flow
and click the Play Audio button in the upper
pane header.) The default media player starts and begins playing
the audio of the selected call.

You can click the Playback Options button to open the Media Playback Options dialog where you can adjust the
jitter buffer settings. A jitter buffer temporarily stores arriving
packets in order to minimize delay variations. If packets arrive
too late, then they are discarded. To make fine adjustments to the
slider bar, click the slider bar and move to an approximate
position, then use the arrow keys to get the exact value you want.

For playback with “best quality,” clear the
Use jitter buffer check box. OmniPeek will
then play back the media as if there was an infinite jitter buffer.
All RTP packets will be played back at a regular interval, and
packets that arrive out of sequence will be re-ordered. To hear
what the media sounds like with a specific buffer size, select the
Use jitter buffer check box.