The Challenges of Promiscuous Packet Capture Methods for Recording Hosted VoIP Conversations

The need to record and monitor phone conversations has been a key requirement of telephony, whether for law enforcement or monitoring the effectiveness of a call center agent. In the days of traditional TDM telephony, this process was quite easy: to perform surveillance or recording, the physical wire was actually spliced and joined. The conversation could then be intercepted and recorded, hence the terminology “wiretap.” In the year 2000 alone, over 2.1 million conversations were tapped in the United States. Over 50% of call centers intend on recording phone conversations for quality assurance purposes. As society becomes increasingly litigious, the demand for keeping an active record of phone conversations has risen.

When H.323 became a de-facto standard for enterprise VoIP communications, a niche market arose for recording VoIP conversations within the enterprise space. In a VoIP environment, unlike a TDM environment, the voice traffic shares the same modicum of transport as traditional computer data. This makes recording the phone conversation more sophisticated than simply splicing a cable. This sophistication was inherently linked to value, and as a result, organizations paid significant monies to record voice conversations across an IP network.

The technology premise behind intercepting enterprise VoIP conversations is simple. The voice, when it gets transformed into digital data, will pass through a single gateway or network “choke-point.” When it passes through this central point, it can be detected by an always monitoring interception device that will detect the presence of voice data, copy the data, and make it available for future retrieval, monitoring, or playback. This technology is simple and usually quite effective under normal PBX type load conditions, although not compliant with many surveillance standards.

As VoIP conversations become increasingly distributed, with softphones on PCs or PDAs and peer-to-peer within an enterprise, the voice data does not pass through a single chokepoint, making it virtually impossible or totally uneconomic to record extension-to-extension phone conversations.

As an added twist to the complexity of recording conversations, organizations have started to embrace the concept of outsourcing their communications platform and infrastructure to third parties for management and maintenance, including the ability to record phone conversations. The primary driver for an organization to embrace the service is to limit and reduce capital and operational expenditures. This traction has launched the IP Centrex market which is projected to grow ten-fold within the next 3 years, by being offered by providers as varied as traditional bell operating companies to Best Buy, a large North American consumer electronics retailer.

This economic trend has a new implication for recording VoIP conversations: the network has become infinitely more complex. This could ultimately have the same effect on the PBX market that peer to peer PC networks had on the mini-computer.

IP Centrex providers have several key business requirements that make recording phone conversations through legacy packet capturing mechanisms either very difficult or inordinately expensive:
(a) Distributed Architectures: IP Centrex providers completely differentiate the technology of controlling and routing calls from the actual path the digital voice data will take. For example, in the United States, many IP Centrex providers never even see the audio for telephone calls – the audio is directly routed to backbone carriers for origination and termination, making it impossible to record. Extension to extension calls occur within an organization’s intranet – giving the provider no access to the audio. As a result, organizations who leverage legacy recording technologies cannot record internal helpdesk conversations. Resolving this requires significant and costly changes to the service provider’s network architecture.
(b) Redundancy: IP Centrex providers are required to provide enterprise services at carrier-grade reliability and service levels. As a result, they are often geographically distributed to deliver five-nines redundancy and failover facilities. This means that voice data traffic can be routed to multiple nodes in multiple locations, making it extremely difficult to correlate and combine for recording and surveillance purposes using packet sniffing technology.
(c) Scalability and Privacy: IP Centrex providers leverage a single capital hosting asset to provide services to many organizations. This is what makes it profitable to deliver low-cost, capital-light service to end-customers. This means that the same platform is shared by tens of thousands of end-users in a multi-tenanted environment, who may or may not want to have their phone conversations recorded. By leveraging legacy methods, all packets must be inspected, regardless of whether the conversation is to be recorded or not. This introduces numerous privacy and legal considerations. Finally, the scalability of legacy technologies fail due to the sheer volume of traffic.
Consider the following: most IP Centrex providers have backbone connectivity approaching 50 megabits. In order to maintain profitability, over 40% of that pipe has to be full of voice traffic, while typically only 10% of voice traffic may need to be recorded. For legacy technologies this means that 90% of traffic has to be inspected and discarded, creating significant waste and inefficiencies.
The next generation of recording technology cannot rely upon promiscuous packet capturing as legacy technologies did. Instead, it relies on being a value adding component of the IP Centrex provider’s distributed network architecture.

How does this next generation technology architecture achieve this?
• Become a Routing Endpoint for Recorded Calls:
Rather than capture all traffic, text generation IP call recording acts as a standards interoperable endpoint within the network architecture. Selective calls are routed to this endpoint for interception and recording – not all calls. In the world of SIP, the recording endpoint is nothing more than a back-to-back user agent (B2BUA). By doing this, calls, including their voice data, are routed to a highly redundant and secure endpoint that captures the call (voice or video) in its entirety, whether they are internal, to an end-customer or not. Further, the provider can rest easy knowing that only the conversations that need to be recorded are being recorded.
• Make it Easy to Turn on the Features:
Using next generation routing technology standards such as CPL (call processing language), selectively route calls to this endpoint – without making a single modification to the end-customer or provider’s environments.
• Central Recording Platform:
Providers can create a central recording environment that accepts incoming conversations that can originate from any of the provider’s redundant network facilities, eliminating the need to have separate devices in multiple-locations and attempting to correlate the entire conversation. This offers a huge cost saving when providing facilities for large distributed campus networks.

When searching for recording, monitoring, and surveillance technologies, legacy packet capture methods are proven solutions in the traditional PBX and IPBX installations, where all calls and calling information pass through a single node. However, they are a poor choice for a distributed IP or IP Centrex environment. As with all applications the technology must be weighed against the key business requirements. With the next generation of IP call recording, customers are no longer required to choose the next best thing, they can now choose the very best call recording application for their needs.