SIPRECORD performance settings

The Following Settings should be used on SIPRECORD sites where there may be some of the following issues:

  • Dropped packets: This may be as a result of to much mirror traffic being sent to a server the can’t handle the load.
  • Buffers not large enough: There is a burst of data that fills the buffers or the server can’t process packets away fast enough.
  • Non voice traffic in mirror date: Data from the normal LAN is sent through the mirror ports and unusable data has to be checked for voice data. This can be slow.

The FILTER settings
This sets the capture filter to limit the traffic that will be passed to the Siprecorder.

FILTER=((tcp) or (udp)) and (!(port 443 or port 80 or port 445 or port 139 or port 20 or port 21 or port 22 or port 3389))

In this example the “tp” and “udp” means that all the traffic for the protocol UDP and the TCP will be sent through, but since ICMP is not listed here, That traffic will be discarded before the siprecorder gets it.

The Second section that has a “!” means “NOT”. This means any of the entries in that section will also be discarded.
The ports listed here:
20 = FTP Data port
21 = FTP port
22 = SSH port
80 = HTTP
139 = = Windows Share / Network lookups
443 = HTTPS
445 = Windows Share / Network lookups
3389 = Windows Remote Desktop port.

With the Filter section added, you will have to restart the SIPRecording software or it will not take affect. This setting can not be changed with a RELOAD.

MAXCAPTURESIZE
This setting allows the configuration of the amount of memory used to buffer captured data.

MAXCAPTURESIZE=8096

The default value is about 1 Meg and this setting is about 8 meg.

If there is to much traffic being received on the Mirror interface, packets can be dropped by Linux or the network card.
To determine if there are dropped packets run the following command using hte network card interface name (e.g. eth1):

grep ‘’ /sys/class/net/eth1/statistics/* | grep dropped

The result will look like this

root@siprecorder:~# grep '' /sys/class/net/eth1/statistics/* | grep dropped
/sys/class/net/eth1/statistics/rx_dropped:19108297
/sys/class/net/eth1/statistics/tx_dropped:0

This command will show all the results:

root@siprecorder:~# grep '' /sys/class/net/eth1/statistics/* 
/sys/class/net/eth1/statistics/collisions:0
/sys/class/net/eth1/statistics/multicast:45456465
/sys/class/net/eth1/statistics/rx_bytes:875092919216
/sys/class/net/eth1/statistics/rx_compressed:0
/sys/class/net/eth1/statistics/rx_crc_errors:0
/sys/class/net/eth1/statistics/rx_dropped:19108297**
/sys/class/net/eth1/statistics/rx_errors:0
/sys/class/net/eth1/statistics/rx_fifo_errors:0
/sys/class/net/eth1/statistics/rx_frame_errors:0
/sys/class/net/eth1/statistics/rx_length_errors:0
/sys/class/net/eth1/statistics/rx_missed_errors:0
/sys/class/net/eth1/statistics/rx_over_errors:0
/sys/class/net/eth1/statistics/rx_packets:3773780361
/sys/class/net/eth1/statistics/tx_aborted_errors:0
/sys/class/net/eth1/statistics/tx_bytes:680
/sys/class/net/eth1/statistics/tx_carrier_errors:0
/sys/class/net/eth1/statistics/tx_compressed:0
/sys/class/net/eth1/statistics/tx_dropped:0**
/sys/class/net/eth1/statistics/tx_errors:0
/sys/class/net/eth1/statistics/tx_fifo_errors:0
/sys/class/net/eth1/statistics/tx_heartbeat_errors:0
/sys/class/net/eth1/statistics/tx_packets:8
/sys/class/net/eth1/statistics/tx_window_errors:0

Sip recorder can handle about 100000 packets per second on decent hardware

Check in the siprecord log, at about 00:00:00 what the Maximum packets are

grep “Maximum packets” /opt/datatex/siprecord/logs/logdate/siprecord.log

Example
2021-09-29 00:00:01.049 [1.7.6.29g] Maximum packets per second for packet handler: 5698