Application Note: Voice Over IP (VoIP) | NETSCOUT

Application Note: Voice Over IP (VoIP)

Voice over IP, or VoIP, is a fairly common technology that causes endless frustrations with the infrastructure management team, and more typically, network engineers. While using the standard network to transport voice calls as a way to save money seems like an easy decision, there is a penalty in the amount of traffic the infrastructure must support. Not only that, the nature of this traffic is slightly different than that of the typical application transport.

VoIP utilizes the UDP protocol, which is inherently connectionless. What this means is that should a packet be lost, or delivery take too long, the sender of the data has no mechanism to resend or adjust the rate by which data is sent. When an environment adds a significant number of users of VoIP, this can impact the current utilizations of network segments, both reducing call quality, and the speed of which standard TCP applications perform. TCP, when faced with additional delay, can time out and resend data when not appropriately acknowledged (TCP is connection oriented). Therefore applications and VoIP exist in a yen/yang manner, and visibility into the performance of both on a unified platform is critical to ensure appropriate end user experience.

Some of the key factors effecting VoIP performance are:

  • Packet Loss – collisions, errors, UDP
  • Network – burst, bandwidth
  • QOS misconfigurations
  • Audio Codec – most are standardized, watch for the proprietary
  • Latency – distance is tough and the number of hops
  • Jitter & Jitter buffer – different time and different order

While there are mechanisms by which engineering can adjust and tune the interactions of VoIP and the infrastructure, the impact to performance can only be guessed unless proper monitoring is in place. If bandwidth is of concern for example, VoIP can be compressed. The trade off with this example is that any loss will be much more significant to the call quality. This is why we recommend performing analysis of the traffic first, to verify that all traffic is business critical, and perhaps using policies to remove unwanted traffic first, prior to adjusting call settings.

The key to troubleshooting VoIP is time synchronized performance management data across traffic makeup, application performance, and VoIP stream quality, by site. While solutions exist that monitor VoIP, Applications, and Traffic Analysis, none have a single time correlated UI with well-designed workflows to address multiple IT audiences. Since most IT staff is silo'ed and specialized, having a solution that is aware of all three allows for collaboration and reduced finger pointing with happier end users.

Most Networks utilize QoS technologies in order to protect and prioritize their VoIP traffic by tagging that traffic at the device level with a queue marker (Differentiated Service Code Point or DSCP), and then setting parameters for how devices in their network treat such traffic. Usually these include allowing this traffic first priority in being forwarded through the device, as well as some type of rate limit. This rate limit is usually put in place for the very issue brought up earlier in this paper, where UDP can possibly over-run TCP, and then have an ill effect on the performance of mission critical applications. When business' no longer have the ability to utilize point of sale, accounting, or back in database systems with high levels of performance, not only is there a perception of poor performance to the users of those applications, but also the customers the very business serves.

TCP is reliable, ordered, and heavyweight (in setup and tear down above even acknowledgement), while UDP is unreliable, light, non-ordered, and has absolutely no congestion control. These underlying technologies, as well as an understanding of how they contend, are critical to being able to successfully monitor and measure the performance of these disparate services to the business. While they are different, they utilize the same infrastructure. Let's look at the various methods of monitoring that can assist you in effectively managing VoIP.

Visual TruView™ Appliance shows VoIP performance in three different ways. At a high level, the UI reports on the performance at a network level, showing overall stream quality and call signaling, further dividing by Worst Sites. At this point a user can select a site, and go into a site context page. The user can also search on sites and select a site they are specifically troubleshooting. From a site context, a user can drill into a single call (or again, search by phone number and locate directly for troubleshooting a specific user/handset).

The VoIP Network page shows your network performance of VoIP traffic, including Stream Quality, Call Signaling, and Site quality.


Site – View detailed call quality and signaling performance for an individual site. Quickly identify call destinations and Class of Service.


Call – View every call, as they happened on the wire. The green icon indicates the call is in progress.


TruView provides insight into VoIP traffic as well so our customers can visualize in real time how applications and VoIP are contending for network resources:


These views, as well as those into application performance by end user response time, and VoIP performance, allow the network owners to not only see the impact of engineering changes, but also audit those effects in real time. These correlated views, by time and by site, truly set our solutions apart.

TruView provides one of a kind visibility into how well, or not, your VoIP infrastructure is performing! What makes the TruView approach different is that it's not just a monitoring tool alerting you to when call degradation has occurred, but rather allows you to quickly drill into each individual call to understand the underlying degradation factors. We don't stop there though as TruView allows you to retrieve the packet stream for each call in order to re-construct, and even replay the actual call as transpired across the wire!