6th European Conference - Academic Conferences

Numbers called.
Source and destination IP addresses.
IP geographical localization.
Incoming calls.
Start/end times and duration.
Voice mail access numbers.
Call forwarding numbers.
Incoming/outgoing messages.
Access codes for voice mail systems.
Contact lists.
Jose Mas y Rubi et al.
b) VoIP data:
Protocol type.
Configuration data.
Raw packets.
Inter-arrival times.
Variance of inter-arrival times.
Payload size.
Port numbers.
Codecs.
The Session Initiation Protocol (SIP) is an important part of the VoIP network communication. SIP is
an IETF standard for IP multimedia conferences. SIP is an application layer control protocol use to
create, modify and terminate session with one or more participants. These sessions include internet
multimedia conferences, internet phone calls and multimedia distribution. The signaling allows the
transportation of call information across the network boundaries. The session management provides
the ability to control the attributes of an end-to-end call (Fernandez 2007).
3. Related works
In our preliminary investigation, we searched different models that could adapt to the DFRWS general
model, and among the most outstanding models we found REN-JIN and CALEA, which will be
describes in the following subsections.
3.1 CALEA model
Government Surveillance is a network forensic special case. Communications Assistance for Law
Enforcement Act (CALEA) is another term use for this electronic surveillance. This means that is
legally valid to introduce an agent inside a communication channel to intercept information, without
altering it (Scoggins 2004).
The wiretapping installation is based on the wire modem’s MAC address, so it can be use for the data
or digital voice connections. This characteristic is controlled by the command interface, intercepted
cable, which requires a MAC address, an IP address and an UDP port number as their parameters
(Scoggins 2004).
When it is active, the router examines each packet with the desirable MAC addresses and when finds
a match to one of those addresses (either from the origin or destination terminal device), a copy is
send to the server, specifying the IP address and port number (Scoggins 2004).
Figure 2 shows how the components of CALEA model (Delivery Function, Collection Function and
Law Enforcement Agency) integrate with a VoIP system providing a transparent lawful interception.
Calls are routed through an access gateway that hides any intercepts in place (Pelaez 2007).
162