CISCO-VOIP-TAP-MIB

All MIBs › CISCO-VOIP-TAP-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2009-10-01

Category: Telephony and VoIP, VPN and Security, Vendor: Cisco Devices

Description: Manages Cisco VoIP lawful intercept (CALEA) tapping, enabling authorized monitoring of VoIP calls.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-VOIP-TAP-MIB?

CISCO-VOIP-TAP-MIB implements Cisco's lawful-intercept (CALEA) capability for Voice over IP, allowing authorized law-enforcement or compliance tapping of VoIP control and media streams on Cisco voice gateways and call-control platforms. It exposes a stream table describing each intercept stream's identifier, type, match criteria, match type, and the mediation device to which intercepted content is forwarded, alongside notification and conformance groups. From a monitoring standpoint this MIB is used less for general hardware/software health and more for operational status tracking of the intercept feature itself: whether a tap stream is correctly provisioned via row status, which media streams are actively being captured, and whether traffic is being successfully encoded and sent to the mediation device. It explicitly depends on CISCO-TAP2-MIB, working alongside it to intercept VoIP control and data traffic. It is deployed in service-provider or enterprise Cisco VoIP infrastructure that must support regulatory lawful-intercept requirements. Engineers can download the CISCO-VOIP-TAP-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-VOIP-TAP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco VoIP gateway/call-control platform (lawful intercept capable)

Monitoring Examples

A compliance system would provision an intercept by creating an entry in cvoiptapStreamTable via cvoiptapStreamRowStatus, then poll cvoiptapStreamMatch/cvoiptapStreamMatchType to confirm the correct call is being matched for interception. cvoiptapStreamCCMediationDevice identifies the destination mediation device receiving intercepted packets, and cvoiptapStreamEncodePacket confirms captured packets are being properly encoded/forwarded. Failure of a stream to report an active state, or errors surfaced on ciscoVoIpTapMIBNotifs, would indicate that lawful intercept is not functioning for that stream.

What Can Be Monitored

intercept stream identifiers and type
stream match criteria
mediation device association
intercept stream provisioning/row status
intercept notifications

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TAP2-MIB

cTap2MediationContentId	OBJECT-TYPE
cTap2StreamIndex	OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

RowStatus
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoVoIpTapMIB	1.3.6.1.4.1.9.9.716			This module manages Cisco's intercept feature for Voice over IP (VoIP). This MIB is used along with CISCO-TAP2-MIB to intercept VoIP Control and Data traffic.
ciscoVoIpTapMIBNotifs	1.3.6.1.4.1.9.9.716.0
ciscoVoIpTapMIBObjects	1.3.6.1.4.1.9.9.716.1
cvoiptapStreamEncodePacket	1.3.6.1.4.1.9.9.716.1.1
BIT cvoiptapStreamCapabilities	1.3.6.1.4.1.9.9.716.1.1.1	Bits	read-only	This object identifies what types of intercept streams can be configured on this type of device. This may be dependent on hardware capabilities, software capabilities. The following fields may be supported: tapEnable: set if table entries with cTap2StreamInterceptEnable set to 'false' are used to pre-screen packets for intercept otherwise these entries are ignored. usernameOrNumber: SNMP ifIndex value may be used to select interception of calls to or from a user or phone number may be used to select traffic to be intercepted. uri: Session Initiation Protocol (SIP) Uniform Resource Identifier (URI) may be used to select traffic to be intercepted.
cvoiptapStreamTable	1.3.6.1.4.1.9.9.716.1.1.2		not-accessible	The Intercept Stream VoIP Table lists the streams to be intercepted. To create a VoIP intercept, an entry cvoiptapStreamEntry is created which contains the filter details. An entry cTap2StreamEntry of CISCO-TAP2-MIB is created, which is the common stream information for all kinds of intercepts and type of the specific stream is set to IP in this entry. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. This essentially provides options for call selection. For example, if all traffic to or from a given user is to be intercepted, one would configure an entry which lists the user with approprite tap type. The first index indicates which Mediation Device the intercepted traffic will be diverted to. The second index permits multiple classifiers to be used together, such as having an IP address as source or destination. The value of the second index is that of the stream's counter entry in the cTap2StreamTable. Entries are added to this table via citapStreamStatus in accordance with the RowStatus convention.
cvoiptapStreamEntry	1.3.6.1.4.1.9.9.716.1.1.2.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
CVO cvoiptapStreamId	1.3.6.1.4.1.9.9.716.1.1.2.1.1	CvoipWarrantId	read-create	This object uniquely identifies this warrant. It has to be unique among all the rows.
INT cvoiptapStreamType	1.3.6.1.4.1.9.9.716.1.1.2.1.2	INTEGER	read-create	pen : Pen Register - provides trace of all outgoing calls. Only Call Data is sent. trace : Trace - provides trace of all incoming calls. Only Call Data is sent. penAndTrace : Provides trace of both incoming and outgoing calls. Only Call Data is sent. intercept : Provides both Call Data and Call Content to Commission on Accreditation for Law Enforcement Agencies (CALEA). Intercept is applicable to both originating and terminating calls.
CVO cvoiptapStreamMatch	1.3.6.1.4.1.9.9.716.1.1.2.1.3	CvoipSubscriberId	read-create	This field describes the candidate which needs to be tapped.
INT cvoiptapStreamMatchType	1.3.6.1.4.1.9.9.716.1.1.2.1.4	INTEGER	read-create	This field specifies the type of information in cvoiptapStreamMatch. A subscriber or intercept candidate can be defined either as username, phone number or Session Initiation Protocol (SIP) Uniform Resource Identifier (URI). 'username' is defined as per RFC-3261. Same value is being used for either username or phone number.
I32 cvoiptapStreamCCMediationDevice	1.3.6.1.4.1.9.9.716.1.1.2.1.5	Integer32	read-create	This object points to a row in Mediation Table which contains the IP address and port number for sending the Call Content intercept information.
ROW cvoiptapStreamRowStatus	1.3.6.1.4.1.9.9.716.1.1.2.1.6	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. When any rows must be changed, cvoiptapStreamRowStatus must be first set to 'notInService'. Row will be created when the service provider has to provision a tap for a VoIP endpoint. Row will be deleted when the warrant has expired. Row will be changed when the warrant type has been changed. cTap2StreamTable defined in CISCO-TAP2-MIB goes in conjunction with this row, using the same index.
ciscoVoIpTapMIBConform	1.3.6.1.4.1.9.9.716.2
ciscoVoIpTapMIBCompliances	1.3.6.1.4.1.9.9.716.2.1
ciscoVoIpTapMIBCompliance	1.3.6.1.4.1.9.9.716.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB for VoIP.
ciscoVoIpTapMIBGroups	1.3.6.1.4.1.9.9.716.2.2
ciscoVoIpTapStreamGroup	1.3.6.1.4.1.9.9.716.2.2.1			These objects are necessary for a description of VoIP Signaling and Data packets to select for interception.

RFC description

Manages intercept functionality for Voice over IP (VoIP) control and data traffic on Cisco devices.

Start monitoring Cisco VoIP gateway/call-control platform (lawful intercept) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-VOIP-TAP-MIB

What Is CISCO-VOIP-TAP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description