The issue described below is present on Total Recall VR recorders with firmware (application) release 11.7.0 or earlier. Full support for segmented UDP and TCP packets is available as of release 11.8.0.
Total Recall VR does not support capture of segmented UDP packets. As a result, Total Recall VR will not be able to detect SIP calls on a network where SIP packets are segmented.
If SIP calls are not being recorded, then you can use the following steps to detect segmented UDP packets on your network:
- Capture all packets (SIP and RTP) of a full SIP call with Wireshark on the SPAN port of the switch that is connected to the recorder for the purpose of recoding IP calls.
- Open the capture in Wireshark.
- Apply the following packet display filter:
sip or rtp or ((ip.flags.mf == 1 or ip.frag_offset > 0) and ip.proto == 17) - If Wireshark displays packets that say “Fragmented IP protocol …” in the Info column, then segmented UDP packets are present on your network.
Segmented SIP packets were observed in a number of cases where Cisco IP phones are in use. To stop Cisco phones segmenting packets change the “DF bit” configuration on the phones. To do this:
- CM Administration > System > Enterprise Phone Configuration > search for “DF bit” > change from “0” to “1” > Save > Apply Configuration > Reset
- CM Administration > Device > Device Settings > Common Phone Profile > search for “DF bit” > change from “0” to “1” > Save > Apply Configuration > Reset
In both cases this will cause phones to reset in order to apply the configuration change. So please apply the change in a maintenance window.
Another option, or in addition to the DF bit setting, is to reduce the size of the SIP messages sent by the Cisco phones. This can be done by excluding (disabling) the audio codecs that are not in use but advertised in the SDP part of SIP messages by the phones. Total Recall VR supports G.711 codecs so you can safely disable all other codecs that are advertised by the Cisco phones. The end result is much ‘smaller’ SIP messages that are unlikely to be segmented.