Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 178

Information About Lawful Intercept Implementation
Call Interception
VoIP calls are intercepted as follows:
•
•
•
•
•
Provisioning for Data Sessions
Provisioning for data sessions occurs in a similar way to the way it does for lawful intercept for VoIP
calls. (See
Data Interception
Data are intercepted as follows:
•
•
•
•
Information About the Mediation Device
The mediation device performs the following tasks:
•
•
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
SC-172
The mediation device uses configuration commands to configure the intercept on the call control
entity.
The call control entity sends intercept-related information about the target to the mediation device.
The mediation device initiates call content intercept requests to the edge router or trunk gateway
through SNMPv3.
The edge router or trunk gateway intercepts the call content, replicates it, and sends it to the
mediation device in Packet Cable Electronic Surveillance UDP format. Specifically, the original
packet starting at the first byte of the IP header is prepended with a four-byte CCCID supplied by
the mediation device in TAP2-MIB. It is then put into a UDP frame with the destination address and
port of the mediation device.
After replicated VoIP packets are sent to the mediation device, the mediation device then forwards
a copy to a law-enforcement-agency-owned collection function, using a recognized standard.
Provisioning for VoIP Calls, page
If a lawful intercept-enabled authentication or accounting server is not available, a sniffer device can
be used to detect the presence of the target in the network.
– The mediation device uses configuration commands to configure the intercept on the sniffer.
– The sniffer device sends intercept-related information about the target to the mediation device.
The mediation device initiates communication content intercept requests to the edge router using
SNMPv3.
The edge router intercepts the communication content, replicates it, and sends it to the mediation
device in UDP format.
Intercepted data sessions are sent from the mediation device to the collection function of the law
enforcement agency, using a supported delivery standard for lawful intercept.
Activates the intercept at the authorized time and removes it when the authorized time period has
elapsed.
Periodically audits the elements in the network to ensure that all authorized intercepts are in place
and that only authorized intercepts are in place.
Implementing Lawful Intercept on Cisco IOS XR Software
SC-171.)
OL-20382-01