Number of packets sent vs number of packets received.

[Simon Edwards]

I'm looking at our Cisco CUCM (Call Manager) CMR records, and most of the calls show either the same or very similar numbers of packets sent vs received.  However a large number of calls show far fewer packets received than sent (can be >50% less).  However, I'm not seeing any lost packets, or Jitter/Latency.

For example I have one call that sent 57650 packets, and only received 15458 packets. But lost packets = 1, jitter = 2, and latency = 0.

Is this usual/normal?  Why the difference in sent/received packets in this call, whereas other calls the sent packets = received packets?

Thanks

[Maren Mahoney]

Off the top of my head? A call with a relatively even number of sent and received packets might be a two-way conversation where both parties spoke roughly the same amount. A call with a much larger number of sent than received might be someone who placed a call and it rolled to voicemail.

The system does silence suppression, called "Voice Activity Detection" (or VAD) by default. The prevents a phone from sending voice packets of 'blank' (no sound) while a person is listening rather than speaking. As soon as the person starts speaking the phone will start sending packets again. This is normal behavior.

Does this address the question you are asking or did I miss the point of your question?

Maren

[Simon Edwards]

Ah!. Thanks - you got the point of the question perfectly, and have provided very good answer.  This now makes perfect sense.  I'll do a quick test with a call to confirm the hypothesis, but I'd be surprised if what you have explained isn't exactly what I'm seeing.

Thanks very much!

[Simon Edwards]

Well, that was unexpected.  I made a few test calls, where I muted my mobile phone, and then talked incessantly on the cisco handset......... and when the CDR/CMRs were produced, I see that the number of packets sent/received is almost the same! (5,100 vs 5,064)  So, this doesn't seem to explain why I'm seeing some calls with less than 50% of the packets being received vs the number being sent.  (And interestingly, our deployment of CUCM does not have VAD enabled)

My curiosity has really been provoked with this one.  Any ideas anyone?

[Maren Mahoney]

First let me say that I applaud the tenacity with which you are investigating this problem. You are an engineer, my friend.

Try the same test call but this time use two internal phones rather than one phone internal and one phone on the PSTN. I don't know your environment, but it may be that your service provider requires two-way RTP streams in order to maintain a call. If this is the case, you may find the command "no vad" on your PSTN dial peers. That specifically defeats the silence-suppression I described earlier and would explain your findings.

Generally speaking unless specifically told otherwise Cisco IP phones will automatically do silence suppression. Two internal phones, therefore, should show the difference in packet sent and received.

Another way to investigate the question would be to use Wireshark to capture the RTP traffic and reassemble the packets into audio files. Then you can investigate the actual sound captured and transmitted in the call.

Let us know what you find!

Maren

[Simon Edwards]

Hum.... the plot thickens!  (And thank you for your kind words btw).

We have 2 separate PSTN providers, each providing 2 geographically separate connections, and so 2 geographically separate gateways into each provider, so 4 gateways in total. (Plus 2 ribbons into Teams, but let's not confuse matters even more!)  The dial peer into PSTN provider 1 has no vad set, whereas this is absent in the dial peer for PSTN provider 2.  Encouraging. (Or so I thought).

I'm seeing some extn-extn calls with the same number of packets, and some with vastly differing numbers. I'm seeing extn to PSTN calls (and PSTN to extn), both with similar numbers of packets, and some with vastly differing numbers of packets.  But my last test shows this is the case for *both* PSTN providers!  Which is annoying to say the least.  I was hoping the PSTN provider with the dial peer with no vad set would give me close to equality on sent/received packets on all calls.  Not so, sadly.

All very puzzling - unless there are some circumstances where VAD is forced, and conversely where it is forced not to be used. But I'm struggling to see where/how that might be. (We have a large HA system, with geographically separate parts, and an even wider spread of phones, so wiresharking things is a bit of a military exercise, with a huge amount of planning needed. Indeed it's not always possible. But that's what makes working here fun!)

[Maren Mahoney]

Sorry for the delayed response. I attended Cisco Live and was VERY busy with sessions.

Your next step for investigation would be to capture the RTP packets using Wireshark for a call where you'd expect the RTP to be unequal, but are equal instead - and/or any other combination you can think of - and listen to the two streams to see what you hear. If you have Jabber clients, using Wirehsark on the PC makes things easy. There is also a "Span to PC Port" setting on a phone which will copy all packets to a daisy-chained PC.

I'd love to hear what you find out!

Maren