FaxTap NG Overview
The deployment of FoIP in service-provider and carrier networks is rapidly growing. But the readiness of the equipment or the network operators to handle FoIP in SIP networks is not growing as fast, creating the need for test tools to support monitoring, testing, troubleshooting, and analysis. Moreover, there is a pressing need for support for FoIP sessions in SIP networks for lawful intercept. FaxTap NG meets the need for an affordable tool to perform these functions, and it’s developed and supported by Commetrex, the industry’s leading developer of fax and fax-related technologies.
FaxTap NG picks up where Wireshark leaves off. Wireshark does have SIP and a degree of T.38 analysis, but does not support any analysis for G.711 modem pass-through calls. Further, the analysis it does provide is not always accurate. Its identification of packets following a T.38 re-Invite as T.38, even if they are RTP, can lead to misinterpretation (flags them as “Malformed T.38 packets”). It interprets HDLC image frames during ECM transmissions as if they were T.30 negotiation frames. Of course, Wireshark performs only limited T.30 protocol analysis, and doesn’t render the image for you. Finally, the user must switch between the versions of T.38 manually.
FaxTap NG Features
- T.38 version 0, 1, 2, and 3 with V.34
- UDPTL, TPKT, and TCP sessions.
- G.711 pass-through RTP with V.34
- Modem equalizer measurements
- Windows and Linux 32- and 64-bit support
- V.21, V.27ter, V.29, V.17, V.8 and V.34 modems included
- ECM frame, block, and page analysis
- Faster than real time
- Comprehensive conversion report
- T.38 and G.711 images
- Post real-time decoding
- DLL/SO (OEM) or end-user versions
- Comprehensive page analysis
- Bad-line repair
- SIP ladder diagram output
- T.30 ladder diagram output
- Analysis component available for OEMs
- Supports µ-law, A-law, 13- and 16-bit linear
- Automatic NSF/NSS support
- Polling
- Graphical user interface
Summary
FaxTap NG will extract SIP FoIP sessions, both G.711 RTP and T.38 version 0, 1, 2, or 3, from a PCAP, render the image (even if the transaction uses NSF/NSS) producing a TIFF-F file, and provide supporting SIP and T.30 session analysis. It performs image analysis to report bad lines and provides ECM frame analysis. FaxTap NG includes V.21, V.27er, V.29, V.17, and V.34 modems.
FaxTap NG is available in stand-alone end-user and library-based OEM versions for both Windows and Linux. The functional capabilities of both versions is the same, but the SDK for the OEM version includes separate libraries for:
- SIP call extraction
- Fax-session analysis
- Ladder diagram printing of session analysis.
The OEM can combine these libraries for use in his product. For example, an OEM could replace the SIP call extraction with a custom module that extracts a T.38 or G.711 session from other network protocols or replaces the ladder diagram package with a graphical output. These libraries are the same as used in Commetrex’ FaxTap NG product.
PCAP Analysis
The FaxTap NG executable will accept as input a TCP/IP or UDP packet capture in PCAP format and produce a textual summary of all FoIP SIP calls present in the recording, a SIP ladder diagram, and the fax image if able to do so. FaxTap NG will accomplish this via a GUI or command-line utility that uses a C/C++ callable library that contains the conversion routines.
Modem Analysis Library
In addition to its accepting a PCAP as an input for the complete package, the analysis portion of FaxTap NG can be separated to accept the following inputs:
- Single PCM file (µ-law, A-law, 13- or 16-bit linear) with transmitter, receiver, or both. (image only rendered if transmitter output present)
- Dual files: one with transmitter and one with receiver.
- Single-sided T.38 session (image rendered only if transmitter output is present.)
- Double-sided T.38 session
The libraries will produce the following:
- Extracted images (if present) in a TIFF file,
- 30 session trace as a linked list of events,
- Cumulative statistics for the session,
- Analysis of each T.38 frame (optional output)
Design Overview
FaxTap NG is built around a T.30 protocol engine repurposed to monitor, rather than participate in, a fax session. In G.711 mode, the modems decode signals in the recordings into modem events and data that are used to drive the protocol engine. The engine builds a list of session events that include the T.30 frames recovered from the session and outputs the image data to a multi-page TIFF-F file. For V.34 recordings a special monitor-only version of the V.8 and V.34 modems are used to decode the recordings.
In T.38 mode, a T.38 frame decoder converts the T.38 frames into “modem” signals and data that mimic those produced by G.711 modems. These events and data drive the protocol engine as described above. In T.38 mode, optional T.38 frame-decoding structures can be generated for each frame. The structure allows the OEM to display the T.38 packets in readable format without processing the ASN.1 encoding.
FaxTap NG automatically configures the analysis package for the negotiated T.38 version.
NSF/NSS Support
For most faxes, T.30, the international fax protocol, guides the two endpoint terminals through the fax procedure from beginning to end. But there is an escape procedure in the T.30 protocol that allows the two terminals, if from the same manufacturer, to depart from the T.30 standard and communicate via a protocol proprietary to the terminal manufacturer. This is often used to implement secure polling, for example. So software designed to analyze a third-party recording of a fax session, for example a Wireshark capture, is left in the dark since it has no idea what modems are used and the size and encoding of the image data since the pre-image-transfer signaling is all non-standard. The primary commands used to set this up are NSF (Non-Standard Facilities) and NSS (Non-Standard Setup).
This non-standard signaling means that to render the image, the analysis software must determine which modem is used and at what bit rate for the image data. And then there’s the encoding and image size to somehow determine. FaxTap NG is the only fax-analysis product that can automatically handle NSF/NSS sessions, correctly rendering the image.
Specifications
| Inputs: | PCAP-formatted captures, direct PCM recordings, sessions using NSF/NSS |
| Signaling Protocol: | SIP |
| Media Protocols: | T.38, UDPTL, TPKT, TCP |
| Media Formats: | RTP, µ-law, A-law, 13-bit linear, 16-bit linear |
| Modems: | V.8, V.21, V.27ter, V.29, V.17, V.34 |
| Outputs: | TIFF-F, SIP ladder diagram, T.30 ladder diagram, synopsis |