CANDELA: SIP forensic server - Nippon Control System

Nippon Control System offers systems including EDA, image processing and communication control.

PRODUCTS > Systems for service providers

CANDELA can validate message syntax and values of its elements in real time. CANDELA uses customizable BNF for validation of message syntax. You can select either basic information(*1) or customized elements(*2) for value check with various ways(*3). This function enables to detect problems flexibly and precisely.

* 1: address, port, VLAN-ID, method etc.
* 2: Specified as BNF element path: Contact header/userinfo is specified as "/SIP-message/Contact/contact-param/userinfo".
* 3: Full/front/rear match, Regular expression, String length, Upper/lower limit, Duplication count, Random rate, etc.

CANDELA can report alarms based on captured message statistics(*). This function makes you possible to catch changes of the traffic trend in real time. And applying user knowledge, DoS attack and Silent failure of devices can be also detected.

* Sample Case:
INVITE retry counts of calls from 050-ZZZZ-0000 to 9999.

New SIP vulnerabilities are continuously detected. Security Update(*) applies security incident patch configuration to CANDELA to upgrade the service network security.

* Optional function.

You can generate statistic graph on demand and modify its items and period as you need. And you can also export the data as a csv file to arrange outside.

Captured messages can be stored for 90 days(*1). CANDELA can remove particular messages with screening rules(*2). With unexpected big traffic or system congestion, CANDELA can also throw unnecessary messages away with selecting rules(*3). These functions enhance efficiency of investment and reduce redundant network assets.

* 1: Basic configuration. The term relates directly to the storage size.
* 2: e.g. Remove messages sent to NOT 5060 port.
* 3: e.g. Remove 50 % REGISTER messages.

Based on human engineering, search I/F is designed focusing on shortening its turn around time(*1) and easily canceling. Various search keys are available(*2) and customizable depending on your needs(*3).

* 1: TAT. 1 or 5 seconds with searching 600M records with 300 calls/sec.
* 2: Time range, Send/receive address, VLAN-ID, Method, Response code, Call-ID, Caller/ee number, etc.
* 3: e.g. Remote-Party-ID header/userinfo

You can preserve searched results with a particular condition and re-search within the preserved result. It’s useful to repeat searching and share the result in operators.

Selecting one message from a search result list, call sequence is assembled grouped with Call-ID. CANDELA shows call sequence as a radar chart and also messages by plane text, that you can report contents of messages easily by copy and paste. You can also check one message or around messages of it (without call sequence).

CANDELA can load pcap files created by Wireshark(TM) to make them a new search target, and also export one of call flows as a pcap file. That makes it easy to exchange the data with the outside concerned.

CANDELA has much less influence to service networks, because it acts offline (Just tap/packet mirror). It’s easy to cooperate to an existing Network Management System (NMS) by use of SNMP-Trap.

CANDELA has a management GUI (Web browser) with various helpful functions to utilize itself.

- Login user authority management
- System dashboard
- System setting change/apply/revert
- SNMP-Trap MIB file auto-generation
- SNMP-Trap test delivery
- Simple alarm manager
- Maintenance log/configuration file batch download
- Operator customizable help page
- Remote system reboot