How Swisscom Analyses 12 Million VoIP Data Packets per Second

The No.1 in Switzerland relies on the Allegro Network Multimeter 5500

Swisscom - market leader in Switzerland

Swisscom provides extremely reliable communications services throughout Switzerland. The mainly state-owned company can look back on a rich history dating back to 1852. Swisscom is the leading telecommunications company in Switzerland, offering its customers fixed and mobile telephony, Internet access, mobile Internet and digital television. This requires leadingedge infrastructure and high-performance network equipment. Swisscom is also very successful in the market as an IT company.

Switching, connection and security in the IP network

The conversion of switched telephone services to Voice over IP (VoIP) was completed in the late 2010s: All Swisscom customers now make and receive calls via the Internet. Swisscom operates a state-of-the-art network with a high level of security and availability for around 6 million mobile customers. In the core network, as with many providers, telephone call switching takes place over the IP network. For this, Swisscom relies on multiple Session Border Controllers (SBCs) utilizing Session Initiation Protocol (SIP) for internal network call switching and to other national and international providers. The SBCs are also responsible for VoIP security.

Technology that must work together

Systems from multiple vendors with diverse hardware and software are used as end devices and SBCs. Various SIP versions and extensions and SIP end devices with different codecs must be supported. In addition, problems can arise with software extensions or security updates on end devices, a Session Border Controller or a network router. Network administrators must decide within minutes whether an individual case or a generic problem exists. Depending on the nature of the problem, a software rollback may be required. The use of differing network components and their software status can lead to faulty connections in your own network or with another provider.

What does this mean in the case of an emergency, for example, an error, the search for it and the solution to the problem? Ideally, raw data from a call is required, i.e. the packets, before and after the SBC. Only then is it possible to identify what caused the error. For example, was it an excessive jitter or a rare option in the SIP header? Errors must be detected as quickly as possible, rollbacks swiftly examined, and connections and packet data must be examined accurately.

Millions of data packets examined, per second

With the appropriate network analysis tools, such troubleshooting is possible. But there are issues which must be taken into consideration on a network as large as that of Swisscom. The total VoIP network traffic at peak times amounts to over 12 million packets per second at the rate of 12 GBit/s. It must be possible to record the traffic completely without violating legal requirements.

Allegro Packets und Swisscom — Allegro Network Multimeter 5500

To be prepared for this scenario, Swisscom relies on appliances from Allegro Packets. The company has already gained extensive experience with Allegro Packets' mobile analysis devices and appreciates the advantages they provide. The Leipzig-based company's product portfolio includes analyzers for almost all network sizes, bandwidths and connections.

The "big" Allegro Network Multimeter are designed for fixed locations at, for example, a large enterprise, ISP or system house, enabling several million packets per second to be viewed and stored at a maximum throughput of 100 GBit/s. Both packets and the connection data for the investigation of past events are stored on a ring buffer for historical analysis. For live analysis, connection data is stored in the In-memory database. Both live measurement and historical analysis can be performed simultaneously on a single appliance using the Allegro Network Multimeter's user-friendly web interface.

Analyzer installation and commissioning

Swisscom opted to deploy an Allegro 5500 with a 512 GB In-memory database and a 360 TB ring buffer memory for core network analysis. In addition to the high performance of the analyzer, their experience with the easy integration and use of Allegro Packets' measurement appliances played a decisive role in their decision process. A Packet Broker now forwards all uplinks before and after the SBCs to the Allegro Multimeter. All Allegro products can be configured to meet customer requirements. Stephan Bieri, Senior System Engineer, Voice and Messaging Infrastructure Services at Swisscom and his team decided to use clusters to create multiple pre-filtered pcaps.

Three cluster ring buffers with a capacity of 120 TB each are used for recording. The traffic is recorded three times, i.e. 36 million packets per second at a data rate of 40 GBit/s. Stephan Bieri is convinced of the importance of the Allegro Network Multimeter: "By integrating the Allegro Network Multimeter, we can be incredibly flexible and can act quickly. Learning how to use the software was easy, since it was identical to the portable Allegro 200 (End of Life since 2023) and 1000 Series which are already in use at Swisscom. The Allegro 5500 has been recording the link without a single packet loss for several weeks."

Ring Buffer in use in the Swisscom network — Screenshot of the Allegro 5500 ring buffer (image source: Swisscom)

network activity in the IP net of Swisscom — Screenshot of the Allegro 5500 network activity (image source: Swisscom)

Network quality through efficient troubleshooting

VoIP troubleshooting on the network during an incident is significantly accelerated by using the Allegro 5500. In the event of an incident, a ring buffer is stopped and the corresponding period of time is analyzed in detail. Parallel offline analysis is used for this purpose, which allows a part of the recording to be examined in more detail. This makes it possible to continue recording the link and to simultaneously investigate one or more errors over weeks or even months. This is achieved with only one 4U appliance, the Allegro 5500. Swisscom can provide in-depth error descriptions to other providers and session border controllers vendors based on this raw data.