دانشنامه جامع، مرجع دستورات و مرکز عیب‌یابی VoIP

! --- Cisco Catalyst Switch (Voice VLAN & Trust) ---
mls qos
interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 priority-queue out
 mls qos trust dscp

! --- Cisco ISR/ASR Router (LLQ Strict Priority) ---
class-map match-any VOICE-RTP
 match ip dscp ef
class-map match-any VOICE-SIGNALING
 match ip dscp cs3 af31
policy-map WAN-EDGE-QOS
 class VOICE-RTP
  priority percent 30
 class VOICE-SIGNALING
  bandwidth percent 5

# --- MikroTik RouterOS (Mangle DSCP + Queue Tree) ---
/ip firewall mangle
add chain=forward protocol=udp port=10000-20000 \
    action=change-dscp new-dscp=46 passthrough=yes
add chain=forward dscp=46 action=mark-packet \
    new-packet-mark=voip_rtp passthrough=no
/queue tree
add name="1-VoIP-RTP-Priority" parent=global \
    packet-mark=voip_rtp priority=1 max-limit=10M

# --- Linux iptables DSCP Marking ---
iptables -t mangle -A OUTPUT -p udp --dport 10000:20000 \
    -j DSCP --set-dscp-class EF
iptables -t mangle -A OUTPUT -p udp --dport 5060 \
    -j DSCP --set-dscp-class CS3

# --- Key Asterisk Log Paths & Live Tail ---
/var/log/asterisk/full              # Complete verbose/debug log
/var/log/asterisk/messages          # Warnings & critical errors
/var/log/asterisk/cdr-csv/Master.csv # Call Detail Records

tail -n 100 -f /var/log/asterisk/full | grep -iE "error|warning|488|403"

# --- Asterisk CLI Live Debugging ---
pjsip set logger on
pjsip set logger host 185.110.20.10
rtp set debug on
core set verbose 5

! --- Cisco IOS / CUBE Gateway Live Debug ---
terminal monitor
debug ccsip messages
debug ccsip error
debug voip rtp session named-event
debug isdn q931
show sip-ua register status
show call active voice brief
undebug all

# --- tcpdump Commands for VoIP Engineers ---
# 1. Full SIP + RTP capture to file (no packet truncation -s 0)
tcpdump -ni eth0 -s 0 'port 5060 or (udp and portrange 10000-20000)' \
    -w /tmp/goyak_trace.pcap

# 2. Live ASCII SIP header inspection in terminal
tcpdump -nnvvA -s 0 -i any port 5060

# 3. Rotating ring-buffer capture (5 files x 50MB max)
tcpdump -ni any -s 0 port 5060 -C 50 -W 5 -w /tmp/sip_ring.pcap

# --- sngrep Commands & Interactive Shortcuts ---
sngrep -d any -r                  # Capture SIP + RTP streams live
sngrep -c -O /tmp/calls.pcap      # Headless capture of INVITE calls
sngrep -I /tmp/goyak_trace.pcap   # Open existing PCAP file offline

# Interactive Keys inside sngrep:
# [Enter]  -> Open visual Call Flow diagram for selected call
# [Space]  -> Select/Mark multiple calls in list
# [F2]     -> Save selected calls to .pcap or .txt file
# [F3]     -> Toggle RTP media stream arrows inside Call Flow
# [F7]     -> Filter by From, To, SIP Method or Payload

=== Scenario A: Healthy SIP Trunk Call Flow ===
Asterisk PBX (UAC)                  Carrier SBC (UAS)
   |--- 1. INVITE (SDP: Public IP, alaw/ulaw) ---->|
   |<-- 2. 100 Trying -----------------------------|
   |<-- 3. 180 Ringing / 183 Early Media (SDP) ----|
   |<-- 4. 200 OK (SDP: Carrier RTP IP:Port) ------|
   |--- 5. ACK ----------------------------------->|
   |<== 6. Bidirectional RTP Stream (UDP 20ms) ===>|
   |--- 7. BYE ----------------------------------->|
   |<-- 8. 200 OK (Q.850 Cause #16 Normal) --------|

=== Scenario B: Broken One-Way Audio (NAT Leak) ===
Asterisk PBX                        Carrier SBC
   |--- INVITE (SDP c=192.168.10.50 Private!) ---->|
   |<-- 200 OK (SDP c=185.110.20.10) --------------|
   |--- ACK -------------------------------------->|
   |--- Outbound RTP Audio Sent ------------------>|
   |    [Carrier sends RTP to 192.168.10.50 -> LOST]
   +--> Fix: external_media_address=Public_IP

=== Scenario C: 488 Not Acceptable & 403 Forbidden ===
   * 488: Offer has only G.729 or SRTP, peer only supports G.711
   * 403: Outbound CallerID not in DID range or IP not in ACL