IMG call trace viewer

NOTE: This tool has been superseded by the IMGtools application. The CallTraceViewer described below is no longer recommended, but remains available for reference.

Introduction

The CallTraceViewer application is intended to help with the diagnosis of issues with the Dialogic IMG Integrated Media Gateway and can be used to format, analyse and extract individual call traces from an IMG call trace. It incorporates both the "trace2pcap" tool which can be used to export SS7 raw data from an IMG trace to a pcap trace which can be opened in Wireshark, and an SS7 decoding module which can be used to show decoded SS7 messages from the call flow graph page.

Installation

The CallTraceViewer application requires the .NET 4.0 or above framework to be installed. This can be obtained directly from Microsoft. This MUST be installed before attempting to run the CallTraceViewer.exe program.

CallTraceViewer will run in 32bit or 64bit mode depending on the operating system of the machine it's run on. CallTraceViewer is completely self-contained. That is, all the files required to run it are in the same directory/zip file. Simply extract the zip file to a place where you have read/write permissions and run "CallTraceViewer.exe" to start.

The user interface

The following image shows the main features of the user interface:

The call reference list - contains a list of all calls detected in the trace lfile
The main menu.
Tabs used to switch between different views of the call trace.
Name of the log file which is currently open.
Information about the currently selected call.
Total number of calls in the trace file.
The current loading status of the trace file.

Note that most views of the call trace have context-sensitive menus which are accessed with the right mouse button. For example, when a call is selected and the call flow graph is visible, the context menu looks like this (see the block highlighted in orange below):

Different tabs will have different context menus available. See the documentation section for a particular tab to see which options are available.

Opening a call trace

Call trace files can be opened in one of three ways:

Using the File->Load Call Trace... option from the main menu.
Dragging and dropping a compatible file* onto the application.
Pressing CTRL-V to paste the text of a call trace drectly into the application.

In all cases, the call reference list will be populated with a list of calls found in the files. This may take a few seconds depending on how many calls are in the trace files. As implied, it is possible to use the first two options in the list to open multiple files simultaneously.

* Note: compatible file extensions for call trace files are .txt and .log.

The call reference list

The call reference list contains a list of all calls detected in the log file. Selecting a call will cause that call's data (either the call flow graph or the text of the call trace depending on which tab is selected) to be displayed.

IMG call references are in the format xx:yyyyy:zz where xx is the node ID (ie. the number displayed on the front panel of the IMG or listed in ClientView), yyyyy is the call identifier and zz is the leg identifier (where 00 is the A-leg and 01 is the B-leg). The call reference list only lists the node ID and call identifier since the call flow graph and single call trace will display data for both call legs.

This list can be sorted either by time, in which case the calls are listed in ascending order according to the date/time stamp of the first message received for that call reference, or by call reference, in which case the calls are listed in ascending order according to the numerical call reference.

If you have a partial call reference then the list can be filtered by entering the partial call reference into the box at the bottom labelled "Filter the list...". The list will turn green and will display a count of matches in the top right corner if there are matches. The list will turn red if there are no matches.

The call flow graph

The default view when a call is selected from the call reference list is the call flow graph. This displays a view similar to Wireshark's call graph showing the protocol messages to and from the IMG. The "A-leg" is the inbound call to the IMG and the "B-leg" is the outbound call from the IMG.

Each arrow represents a (in this case) SIP or SS7 message. The arrow direction indicates if the message was inbound or outbound to/from the IMG. The arrow colour indicates the protocol. Each line is time-stamped to show the time (from the IMG) when the message was sent or received.

If the trace file contained sufficient debug information then each protocol message (for example, "INVITE" or "100 Trying") will be a clickable link which will load a pop-up window showing the decoded contents of the message. There is an example of this below for the "100 Trying" message:

The pop-up window can be closed by clicking the red X in the corner or by clicking on another protocol message. Note that this feature obviously requires that the raw message data be present in the trace file. This should always be the case for SIP but is not necessarily the case for SS7 / ISDN etc.

Note also that this version will attempt to decode SS7 messages in the call flow graph view. The following is an example:

The full decoded trace looks like this:

SENT: STK: 0 PRI: 00
DPC: 6-6-7 OPC: 6-6-6
SLS: 0x65 CIC: 00101 (0x0065)
IAM [0048000a03020a0803100977111350850a0883101026681487000b07839422323344041302032100]

IAM (InitialAddress)

NatureOfConnectionIndicators (MandatoryFixed)
=> 000- ---- | 0x00 | => (spare) (0)
=> ---0 ---- | .... | => Echo control device indicator = NoInformation (0)
=> ---- 00-- | .... | => Continuity check indicator = ContinuityCheckNotRequired (0)
=> ---- --00 | .... | => Satellite indicator = NoSatelliteCircuitInTheConnection (0)

ForwardCallIndicators (MandatoryFixed)
=> 01-- ---- | 0x48 | => ISDN user part preference indicator = ISDNUserPartNotRequiredAllTheWay (1)
=> --0- ---- | .... | => ISDN user part indicator = ISDNUserPartNotUserAllTheWay (0)
=> ---0 ---- | .... | => End-to-end information indicator = NoEndToEndInformationAvailable (0)
=> ---- 1--- | .... | => Interworking indicator = InterworkingEncountered (1)
=> ---- -00- | .... | => End-to-end method indicator = NoEndToEndMethodAvailable (0)
=> ---- ---0 | .... | => National/international call indicator = CallToBeTreatedAsNational (0)
=> 0000 ---- | 0x00 | => Reserved for national use (0)
=> ---- 0--- | .... | => (spare) (0)
=> ---- -00- | .... | => SCCP method indicator = NoIndication (0)
=> ---- ---0 | .... | => ISDN access indicator = OriginatingAccessNonISDN (0)

CallingPartyCategory (MandatoryFixed)
=> 0000 1010 | 0x0A | => Category = OrdinaryCallingSubscriber (10)

TransmissionMediumRequirement (MandatoryFixed)
=> 0000 0011 | 0x03 | => TMR = 3_1kHzAudio (3)

None (PointerToMandatoryVariable)
=> 0000 0010 | 0x02 |

None (PointerToOptional)
=> 0000 1010 | 0x0A |

CalledPartyNumber (MandatoryVariable) // Digits="907711310558"
=> 0000 1000 | 0x08 | Length = 8
=> 0--- ---- | 0x03 | => Odd/even indicator = EvenNumberOfAddressSignals (0)
=> -000 0011 | .... | => Nature of address indicator = NationalNumber (3)
=> 0--- ---- | 0x10 | => Internal network number indicator = RoutingToInternalNetworkNumberAllowed (0)
=> -001 ---- | .... | => Numbering plan indicator = ISDNNumberingPlan (1)
=> ---- 0000 | .... | => (spare) (0)
=> 0000 ---- | 0x09 | => Address signal = Digit0 (0)
=> ---- 1001 | .... | => Address signal = Digit9 (9)
=> 0111 ---- | 0x77 | => Address signal = Digit7 (7)
=> ---- 0111 | .... | => Address signal = Digit7 (7)
=> 0001 ---- | 0x11 | => Address signal = Digit1 (1)
=> ---- 0001 | .... | => Address signal = Digit1 (1)
=> 0001 ---- | 0x13 | => Address signal = Digit1 (1)
=> ---- 0011 | .... | => Address signal = Digit3 (3)
=> 0101 ---- | 0x50 | => Address signal = Digit5 (5)
=> ---- 0000 | .... | => Address signal = Digit0 (0)
=> 1000 ---- | 0x85 | => Address signal = Digit8 (8)
=> ---- 0101 | .... | => Address signal = Digit5 (5)

CallingPartyNumber (Optional) // Digits="01628641780"
=> 0000 1010 | 0x0A | Message type = CallingPartyNumber (10)
=> 0000 1000 | 0x08 | Length = 8
=> 1--- ---- | 0x83 | => Odd/even indicator = OddNumberOfAddressSignals (1)
=> -000 0011 | .... | => Nature of address indicator = NationalNumber (3)
=> 0--- ---- | 0x10 | => Number incomplete indicator (NI) = Complete (0)
=> -001 ---- | .... | => Numbering plan indicator = ISDNNumberingPlan (1)
=> ---- 00-- | .... | => Address presentation restricted indicator (APRI) = PresentationAllowed (0)
=> ---- --00 | .... | => Screening indicator (SI) = UserProvidedNotVerified (0)
=> 0001 ---- | 0x10 | => Address signal = Digit1 (1)
=> ---- 0000 | .... | => Address signal = Digit0 (0)
=> 0010 ---- | 0x26 | => Address signal = Digit2 (2)
=> ---- 0110 | .... | => Address signal = Digit6 (6)
=> 0110 ---- | 0x68 | => Address signal = Digit6 (6)
=> ---- 1000 | .... | => Address signal = Digit8 (8)
=> 0001 ---- | 0x14 | => Address signal = Digit1 (1)
=> ---- 0100 | .... | => Address signal = Digit4 (4)
=> 1000 ---- | 0x87 | => Address signal = Digit8 (8)
=> ---- 0111 | .... | => Address signal = Digit7 (7)
=> 0000 ---- | 0x00 | => Address signal = Digit0 (0)
=> ---- 0000 | .... | => Address signal = Digit0 (0)

RedirectingNumber (Optional)
=> 0000 1011 | 0x0B | Message type = RedirectingNumber (11)
=> 0000 0111 | 0x07 | Length = 7
=> 1000 0011 | 0x83 | ...
=> 1001 0100 | 0x94 | ...
=> 0010 0010 | 0x22 | ...
=> 0011 0010 | 0x32 | ...
=> 0011 0011 | 0x33 | ...
=> 0100 0100 | 0x44 | ...
=> 0000 0100 | 0x04 | ...

RedirectionInformation (Optional)
=> 0001 0011 | 0x13 | Message type = RedirectionInformation (19)
=> 0000 0010 | 0x02 | Length = 2
=> 0000 ---- | 0x03 | => Original redirection reason = Unknown (0)
=> ---- 0--- | .... | => (spare) (0)
=> ---- -011 | .... | => Redirecting indicator = CallDiverted (3)
=> 0010 ---- | 0x21 | => Redirecting reason = NoReply (2)
=> ---- 0--- | .... | => Reserved for national use (0)
=> ---- -001 | .... | => Redirection counter (1)

EndOfOptionalParameters (None)
Right-clicking on the call flow graph brings up the context menu (see image below). This has three options:

Copy - places a text representation of the call flow graph in the clipboard.
Screenshot - saves a screenshot of the call flow graph to disk.
Export Message Data - exports the decoded content of all protocol messages to disk.
Callflow Context Menu

The exported message data for the above trace looks like this:

--------------------------------------------------------------------------------
[Packet 1] 01:34:27.8100000 : SIP : RCVD on ALEG
--------------------------------------------------------------------------------

---> [192.168.185.61, 5060]
INVITE sip:907711310558@192.168.185.242:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.185.61:5060;branch=z9hG4bK-952-1-0
From: "01628641780" <sip:01628641780@192.168.185.61>;tag=1
To: <sip:907711310558@192.168.185.242:5060>
Call-ID: 1-952@192.168.185.61
CSeq: 1 INVITE
Contact: sip:sipp@192.168.185.61:5060
Max-Forwards: 70
Remote-Party-ID: "01628641788" <sip:01628641788@192.168.185.61>;party=calling;id-type=subscriber;privacy=full;screen=yes
Diversion: <sip:222333444@192.168.185.33>;reason=no-answer;screen="yes";privacy=full
Subject: Privacy Test
Content-Type: application/sdp
Content-Length: 231

v=0
o=user1 53655765 2353687637 IN IP4 192.168.185.61
s=-
c=IN IP4 192.168.185.61
t=0 0
m=audio 6000 RTP/AVP 0 8 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=sendrecv

--------------------------------------------------------------------------------
[Packet 2] 01:34:27.8100000 : SIP : SENT on ALEG
--------------------------------------------------------------------------------

<--- [192.168.185.61, 5060 <- 192.168.185.242, 5060]
SIP/2.0 100 Trying
Via: SIP/2.0/UDP 192.168.185.61:5060;branch=z9hG4bK-952-1-0;received=192.168.185.61
Call-ID: 1-952@192.168.185.61
From: "01628641780" <sip:01628641780@192.168.185.61>;tag=1
To: <sip:907711310558@192.168.185.242:5060>
CSeq: 1 INVITE
Server: Dialogic-SIP/1.0.0.222 UKLAB-2020 0
Content-Length: 0

--------------------------------------------------------------------------------
[Packet 3] 01:34:27.8200000 : SS7 : SENT on BLEG
--------------------------------------------------------------------------------

SENT: STK: 0 PRI: 00
DPC: 6-6-7 OPC: 6-6-6
SLS: 0x65 CIC: 00101 (0x0065)
IAM [0048000a03020a0803100977111350850a0883101026681487000b07839422323344041302032100]

IAM (InitialAddress)

NatureOfConnectionIndicators (MandatoryFixed)
=> 000- ---- | 0x00 | => (spare) (0)
=> ---0 ---- | .... | => Echo control device indicator = NoInformation (0)
=> ---- 00-- | .... | => Continuity check indicator = ContinuityCheckNotRequired (0)
=> ---- --00 | .... | => Satellite indicator = NoSatelliteCircuitInTheConnection (0)

ForwardCallIndicators (MandatoryFixed)
=> 01-- ---- | 0x48 | => ISDN user part preference indicator = ISDNUserPartNotRequiredAllTheWay (1)
=> --0- ---- | .... | => ISDN user part indicator = ISDNUserPartNotUserAllTheWay (0)
=> ---0 ---- | .... | => End-to-end information indicator = NoEndToEndInformationAvailable (0)
=> ---- 1--- | .... | => Interworking indicator = InterworkingEncountered (1)
=> ---- -00- | .... | => End-to-end method indicator = NoEndToEndMethodAvailable (0)
=> ---- ---0 | .... | => National/international call indicator = CallToBeTreatedAsNational (0)
=> 0000 ---- | 0x00 | => Reserved for national use (0)
=> ---- 0--- | .... | => (spare) (0)
=> ---- -00- | .... | => SCCP method indicator = NoIndication (0)
=> ---- ---0 | .... | => ISDN access indicator = OriginatingAccessNonISDN (0)

CallingPartyCategory (MandatoryFixed)
=> 0000 1010 | 0x0A | => Category = OrdinaryCallingSubscriber (10)

TransmissionMediumRequirement (MandatoryFixed)
=> 0000 0011 | 0x03 | => TMR = 3_1kHzAudio (3)

None (PointerToMandatoryVariable)
=> 0000 0010 | 0x02 |

None (PointerToOptional)
=> 0000 1010 | 0x0A |

CalledPartyNumber (MandatoryVariable) // Digits="907711310558"
=> 0000 1000 | 0x08 | Length = 8
=> 0--- ---- | 0x03 | => Odd/even indicator = EvenNumberOfAddressSignals (0)
=> -000 0011 | .... | => Nature of address indicator = NationalNumber (3)
=> 0--- ---- | 0x10 | => Internal network number indicator = RoutingToInternalNetworkNumberAllowed (0)
=> -001 ---- | .... | => Numbering plan indicator = ISDNNumberingPlan (1)
=> ---- 0000 | .... | => (spare) (0)
=> 0000 ---- | 0x09 | => Address signal = Digit0 (0)
=> ---- 1001 | .... | => Address signal = Digit9 (9)
=> 0111 ---- | 0x77 | => Address signal = Digit7 (7)
=> ---- 0111 | .... | => Address signal = Digit7 (7)
=> 0001 ---- | 0x11 | => Address signal = Digit1 (1)
=> ---- 0001 | .... | => Address signal = Digit1 (1)
=> 0001 ---- | 0x13 | => Address signal = Digit1 (1)
=> ---- 0011 | .... | => Address signal = Digit3 (3)
=> 0101 ---- | 0x50 | => Address signal = Digit5 (5)
=> ---- 0000 | .... | => Address signal = Digit0 (0)
=> 1000 ---- | 0x85 | => Address signal = Digit8 (8)
=> ---- 0101 | .... | => Address signal = Digit5 (5)

CallingPartyNumber (Optional) // Digits="01628641780"
=> 0000 1010 | 0x0A | Message type = CallingPartyNumber (10)
=> 0000 1000 | 0x08 | Length = 8
=> 1--- ---- | 0x83 | => Odd/even indicator = OddNumberOfAddressSignals (1)
=> -000 0011 | .... | => Nature of address indicator = NationalNumber (3)
=> 0--- ---- | 0x10 | => Number incomplete indicator (NI) = Complete (0)
=> -001 ---- | .... | => Numbering plan indicator = ISDNNumberingPlan (1)
=> ---- 00-- | .... | => Address presentation restricted indicator (APRI) = PresentationAllowed (0)
=> ---- --00 | .... | => Screening indicator (SI) = UserProvidedNotVerified (0)
=> 0001 ---- | 0x10 | => Address signal = Digit1 (1)
=> ---- 0000 | .... | => Address signal = Digit0 (0)
=> 0010 ---- | 0x26 | => Address signal = Digit2 (2)
=> ---- 0110 | .... | => Address signal = Digit6 (6)
=> 0110 ---- | 0x68 | => Address signal = Digit6 (6)
=> ---- 1000 | .... | => Address signal = Digit8 (8)
=> 0001 ---- | 0x14 | => Address signal = Digit1 (1)
=> ---- 0100 | .... | => Address signal = Digit4 (4)
=> 1000 ---- | 0x87 | => Address signal = Digit8 (8)
=> ---- 0111 | .... | => Address signal = Digit7 (7)
=> 0000 ---- | 0x00 | => Address signal = Digit0 (0)
=> ---- 0000 | .... | => Address signal = Digit0 (0)

RedirectingNumber (Optional)
=> 0000 1011 | 0x0B | Message type = RedirectingNumber (11)
=> 0000 0111 | 0x07 | Length = 7
=> 1000 0011 | 0x83 | ...
=> 1001 0100 | 0x94 | ...
=> 0010 0010 | 0x22 | ...
=> 0011 0010 | 0x32 | ...
=> 0011 0011 | 0x33 | ...
=> 0100 0100 | 0x44 | ...
=> 0000 0100 | 0x04 | ...

RedirectionInformation (Optional)
=> 0001 0011 | 0x13 | Message type = RedirectionInformation (19)
=> 0000 0010 | 0x02 | Length = 2
=> 0000 ---- | 0x03 | => Original redirection reason = Unknown (0)
=> ---- 0--- | .... | => (spare) (0)
=> ---- -011 | .... | => Redirecting indicator = CallDiverted (3)
=> 0010 ---- | 0x21 | => Redirecting reason = NoReply (2)
=> ---- 0--- | .... | => Reserved for national use (0)
=> ---- -001 | .... | => Redirection counter (1)

EndOfOptionalParameters (None)

--------------------------------------------------------------------------------
[Packet 4] 01:34:35 : SS7 : RCVD on BLEG
--------------------------------------------------------------------------------

RCVD: STK: 0 PRI: 00
DPC: 6-6-6 OPC: 6-6-7
SLS: 0x05 CIC: 00101 (0x0065)
REL [02000280a9]

REL (Release)

None (PointerToMandatoryVariable)
=> 0000 0010 | 0x02 |

None (PointerToOptional)
=> 0000 0000 | 0x00 |

CauseIndicators (MandatoryVariable)
=> 0000 0010 | 0x02 | Length = 2
=> 1--- ---- | 0x80 | => Extension indicator = LastOctet (1)
=> -00- ---- | .... | => Coding standard = ITUT_StandardizedCoding (0)
=> ---0 ---- | .... | => (spare) (0)
=> ---- 0000 | .... | => Location = User (0)
=> 1--- ---- | 0xA9 | => Extension indicator = LastOctet (1)
=> -010 1001 | .... | => Cause value = TemporaryFailure (41)

--------------------------------------------------------------------------------
[Packet 5] 01:34:35 : SS7 : SENT on BLEG
--------------------------------------------------------------------------------

SENT: STK: 0 PRI: 00
DPC: 6-6-7 OPC: 6-6-6
SLS: 0x65 CIC: 00101 (0x0065)
RLC [00]

--------------------------------------------------------------------------------
[Packet 6] 01:34:35 : SIP : SENT on ALEG
--------------------------------------------------------------------------------

<--- [192.168.185.61, 5060 <- 192.168.185.242, 5060]
SIP/2.0 503 Service Unavailable [Call processing released]
Via: SIP/2.0/UDP 192.168.185.61:5060;branch=z9hG4bK-952-1-0;received=192.168.185.61
Call-ID: 1-952@192.168.185.61
From: "01628641780" <sip:01628641780@192.168.185.61>;tag=1
To: <sip:907711310558@192.168.185.242:5060>;tag=a94c095b773be1dd6e8d668a785a9c849dac5646
Contact: <sip:907711310558@192.168.185.242:5060>
CSeq: 1 INVITE
Server: Dialogic-SIP/1.0.0.222 UKLAB-2020 0
Reason: Q.850 ;cause=41 ;text="Temporary failure"
Content-Length: 0

--------------------------------------------------------------------------------
[Packet 7] 01:34:35.0100000 : SIP : RCVD on ALEG
--------------------------------------------------------------------------------

---> [192.168.185.61, 5060]
ACK sip:907711310558@192.168.185.242:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.185.61:5060;branch=z9hG4bK-952-1-0;received=192.168.185.61
From: "01628641780" <sip:01628641780@192.168.185.61>;tag=1
To: <sip:907711310558@192.168.185.242:5060>;tag=a94c095b773be1dd6e8d668a785a9c849dac5646
Call-ID: 1-952@192.168.185.61
CSeq: 1 ACK
Contact: <sip:sipp@192.168.185.61:5060;transport=UDP>
Max-Forwards: 70
Subject: Performance Test
Content-Length: 0

Single call trace tab

The single call trace tab is used to view the raw trace for an individual call. When a log file is loaded, the application attempts to remove any spurious line breaks so that the call trace is easier to read and parsing is easier.

This trace can be filtered to show just the A-leg trace, just the B-leg trace or a mixture of both (as above) using the radio buttons below the trace text box. When "All" is selected, lines of the trace are coloured orange for the B-leg and white for the A-leg. Note that it is possible for calls to have more than two legs. Additional call legs will be coloured differently and will spawn extra filtering buttons at the bottom of the screen.

Note also that the "Show Errors" button can be used to show any messages that do not have a particular call reference associated with them. This will show any unparsed SIP messages or system errors inline with the call in red (see above). These messages will not necessarily relate to the call being displayed.

Right-clicking the single call trace will bring up the context menu which will have options to Copy, Select All, Save and Export to Wireshark. Note that "Save" will save the text of the currently selected call to it's own file on disk. "Export to Wireshark" will call "trace2pcap.exe" using the text for the currently selected call and will generate a pcap file which can be opened in Wireshark. Only SS7 messages will be exported to the pcap file. There is no facility to export SIP messages to pcap format as this is not supported by the "trace2pcap.exe" tool.

Note that CTRL-C will also copy text from the trace to the clipboard.

All calls trace tab

The "all calls" trace tab looks similar to the single call trace tab except for the fact that it contains trace information for ALL calls in the open log file and doesn't allow filtering by leg. The find functionality and context-menu work in the same way as in section 7.

Raw trace tab

The "raw trace" tab looks similar to the all calls trace tab except for the fact that it contains the raw trace, completely unmodified as it appears in the original file.

Find functionality

In the single call, all calls and raw trace tabs, pressing CTRL+F or selecting "Find" from the Tools menu will bring up the Find dialog box (see below).

There are a number of options for locating text in the trace file. The ones of most interest would be the facility to mark and highlight lines containing matches. These are enabled with the "Mark Line" and "Highlight Matches" checkboxes. The "Mark Line" option will mark any lines containing the search string with a red circle. The "Highlight Matches" option will highlight the actual matched text with a light red background.