SIP/RTP session analysis and tracking for VoIP logging

Deployment of VoIP service brings in security challenges that necessitate additional protection measures for corporate networks. Logging of VoIP sessions between a corporate LAN and the Internet becomes an essential requirement, to prevent misuse, to enforce security policies and to respond to security incidents. Identifying valid VoIP sessions and call tracking from the signaling to media session is important in this context. However, compulsions of existing IP networks make it difficult for the practice of VoIP to be compliant to RFC standards, posing problems in tracking the VoIP call flow. In this paper we investigate the issues involved in tracking widely used SIP/RTP based VoIP sessions in scenarios involving network address translation (NAT). We show that it is possible to track a session completely based on mapping of protocol parameters in NAT scenarios. We propose the implementation of mechanisms for analyzing SIP/RTP sessions and extracting their identifiers for effective tracking of VoIP sessions. We present the details of the algorithmic flow in the logging of VoIP session that was generated with asterisk server configured in NAT domains.