高通平台IMS 日志分析

Ims注册

1、DS 通知IMS，LTE的服务是可用的，主要搜索关键字pref_rat_value = 3 and RAT = 10 ，等于3代表为LTE

Sipconnection.cpp包括一些请求消息的查询

2、IMS 获得APN列表，属性等消息，比如apntype = 1 ，apnname = ims 等。

 

3、DS 触发PDN CONNREQ，然后触发IMS 注册，搜索关键字IMS_REG_STATUS_IND

 

4、发送sip注册消息。  EVENT_SIP_REG_REQ_SENT

 

5、通知CM IMS注册状态变化，set ims voice reg_status 2 on mode9

 

 

二、IMS MO CALL 针对SIP信令的分析

       1、首先会发送一条IMS_SIP_INVITE/INFORMAL_RESPONSE，主要消息内容：

Subscription ID = 2

Version = 1

Direction = UE_TO_NETWORK   //代表手机发送到网络

SDP Presence = 1

SIP Call ID Length = 59

SIP Message Length = 2243

SIP Message Logged Bytes = 2244

Message ID = IMS_SIP_INVITE  //这条信令的名称

Response Code = INFORMAL_RESPONSE (0)

CM Call ID = 10

SIP Call ID = 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0   //代表此次回话的表示ID，整个流程中不会改变

Sip Message = INVITE tel:13167010170;phone-context=ims.mnc001.mcc460.3gppnetwork.org SIP/2.0

From: <sip:[email protected]>;tag=4135808209  //主叫方

To: <tel:13167010170;phone-context=ims.mnc001.mcc460.3gppnetwork.org>    //被叫方

CSeq: 914582730 INVITE

Call-ID: 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0 //通话标识

Via: SIP/2.0/TCP [2408:850c:ff:498b:43c7:c24e:99e3:b6d0]:40981;branch=z9hG4bK4125701538

Max-Forwards: 70

Contact: <sip:234e81d2-2a21-4c20-a27c-36cb5a77110b@[2408:850c:ff:498b:43c7:c24e:99e3:b6d0]:40981>;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";audio;video;+g.3gpp.mid-call;+g.3gpp.srvcc-alerting //支持SRVCC响铃

Route: <sip:[2408:8140:4001:6100::2]:9900;lr>,<sip:[email protected];lr;ca=38cb;TYPE=V6;IP=2408:850C:FF:498B:43C7:C24E:99E3:B6D0;PORT=40981;Dpt=76a6-2>  //路由转发，PCSCF

P-Access-Network-Info: 3GPP-E-UTRAN-FDD; utran-cell-id-3gpp=46001184BB1A2E51   //网络的类型和小区的地址

Security-Verify: ipsec-3gpp;alg=hmac-md5-96;prot=esp;mod=trans;ealg=null;spi-c=2216797661;spi-s=4213286365;port-c=9950;port-s=9900

Proxy-Require: sec-agree

Require: sec-agree

P-Preferred-Identity: <sip:[email protected]>   //主叫的用户标识

Allow: INVITE,ACK,CANCEL,BYE,UPDATE,PRACK,MESSAGE,REFER,NOTIFY,INFO,OPTIONS   //SIP的消息类型

Content-Type: application/sdp

Accept: application/sdp,application/3gpp-ims+xml

P-Preferred-Service: urn:urn-7:3gpp-service.ims.icsi.mmtel

Accept-Contact: *;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";audio

Supported: 100rel,replaces,precondition,histinfo,tdialog

P-Early-Media: supported

User-Agent: xiaomi_Redmi Note 7_PKQ1.180904.001

Content-Length: 633

v=0

o=- 3 1000 IN IP6 2408:850c:ff:498b:43c7:c24e:99e3:b6d0

s=QC VOIP

c=IN IP6 2408:850c:ff:498b:43c7:c24e:99e3:b6d0

b=AS:49

b=RS:600

b=RR:2000

t=0 0

m=audio 50020 RTP/AVP 104 102 96 97   //m行 代表是audio，本机支持的解码方式 104 102 96 97

b=AS:49

b=RS:600

b=RR:2000

a=rtpmap:104 AMR-WB/16000/1    

a=fmtp:104 mode-change-capability=2;max-red=0

a=rtpmap:102 AMR/8000/1

a=fmtp:102 mode-change-capability=2;max-red=0

a=rtpmap:96 telephone-event/16000

a=fmtp:96 0-15

a=rtpmap:97 telephone-event/8000

a=fmtp:97 0-15

a=curr:qos local none

a=curr:qos remote none

a=des:qos mandatory local sendrecv //协商会本机会变成sendrecv的状态

a=des:qos optional remote sendrecv //对端可以不是senderecv,因为可能是cs电话

a=sendrecv     //如果这里为send only，表明只发送不接收对方语音数据。进行呼叫保持的时候，会设置成send only

a=maxptime:240

a=ptime:20

 

2、IMS_SIP_INVITE/TRYING

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE

SDP Presence = 0

SIP Call ID Length = 59

SIP Message Length = 376

SIP Message Logged Bytes = 377

Message ID = IMS_SIP_INVITE

Response Code = TRYING (100) //网络会下发一个100 trying,一旦网络将invite message转发给MT后。MT端会收到paging，然后会发起RACH进入rrc连接态

CM Call ID = 10

SIP Call ID = 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0

Sip Message = SIP/2.0 100 Trying

Via: SIP/2.0/TCP [2408:850C:00FF:498B:43C7:C24E:99E3:B6D0]:40981;branch=z9hG4bK4125701538

Call-ID: 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0

From: <sip:[email protected]>;tag=4135808209

To: <tel:13167010170;phone-context=ims.mnc001.mcc460.3gppnetwork.org>

CSeq: 914582730 INVITE

Content-Length: 0

3、IMS_SIP_INVITE/SESSION_PROGRESS

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE   //从网络发送过来，由被叫方发起

SDP Presence = 1

SIP Call ID Length = 59

SIP Message Length = 1600

SIP Message Logged Bytes = 1601

Message ID = IMS_SIP_INVITE

Response Code = SESSION_PROGRESS (183) //发送183的消息，表明被叫方 的audio codec的选择

CM Call ID = 10

SIP Call ID = 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0

Sip Message = SIP/2.0 183 Session Progress

Via: SIP/2.0/TCP [2408:850C:00FF:498B:43C7:C24E:99E3:B6D0]:40981;branch=z9hG4bK4125701538

Record-Route: <sip:[2408:8140:4001:6100:0000:0000:0000:0002]:9900;transport=tcp;lr;Hpt=8f22_116;CxtId=3;TRC=ffffffff-ffffffff;X-HwB2bUaCookie=8569>

Call-ID: 4135808202_467862876@2408:850c:ff:498b:43c7:c24e:99e3:b6d0

From: <sip:[email protected]>;tag=4135808209

To: <tel:13167010170;phone-context=ims.mnc001.mcc460.3gppnetwork.org>;tag=3wfghd0d //第一次的invite是没有tag，如果tag代表会话已经建立

CSeq: 914582730 INVITE

Allow: INVITE,ACK,CANCEL,BYE,UPDATE,PRACK,MESSAGE,REFER,NOTIFY,INFO,OPTIONS

Contact: <sip:[2408:8140:4001:6100:0000:0000:0000:0002]:9900;Hpt=8f22_16;CxtId=3;TRC=ffffffff-ffffffff>;+g.3gpp.icsi-ref="urn%3Aurn-7%3A3gpp-service.ims.icsi.mmtel";audio;video

Require: precondition,100rel

User-Agent: xiaomi_GINKGO_PKQ1.190616.001

RSeq: 1

P-Early-Media: gated

Feature-Caps: *;+g.3gpp.srvcc;+g.3gpp.mid-call;+g.3gpp.srvcc-alerting //支持的一些会话类型

Recv-Info: g.3gpp.state-and-event-info

Content-Length: 549

Content-Type: application/sdp

 

v=0

o=- 15383048 15383048 IN IP6 2408:8140:4001:6100:0000:0000:0000:0003s=SBC call

c=IN IP6 2408:8140:4001:6100:0000:0000:0000:0003 //MT的PCSCF地址

b=AS:49

b=RS:600

b=RR:2000

t=0 0

m=audio 33740 RTP/AVP 104 96 //audio 端口

b=AS:49

b=RS:600

b=RR:2000

a=rtpmap:104 AMR-WB/16000/1  //选择编解码方式

a=fmtp:104 mode-change-capability=2;max-red=0

a=curr:qos local none

a=curr:qos remote none

a=des:qos mandatory local sendrecv

a=des:qos mandatory remote sendrecv

a=conf:qos remote sendrecv

a=sendrecv

a=maxptime:240

a=ptime:20

a=rtpmap:96 telephone-event/16000

a=fmtp:96 0-15

4、IMS_SIP_PRACK/INFORMAL_RESPONSE

       发送PRACK消息，代表收到被叫方183的消息

 

5、IMS_SIP_PRACK/OK

    由网络端发过来，被叫端发送 200 ok消息，表明183请求已经处理成功

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE

SDP Presence = 0

SIP Call ID Length = 59

SIP Message Length = 531

SIP Message Logged Bytes = 532

Message ID = IMS_SIP_PRACK

Response Code = OK (200)

CM Call ID = 10

6、IMS_SIP_UPDATE/INFORMAL_RESPONSE

        主叫方发送update消息，包含Qos状况和编解码状况。

m=audio 50020 RTP/AVP 104 96 //编解码

b=AS:49

b=RS:600

b=RR:2000

a=rtpmap:104 AMR-WB/16000/1  //

a=fmtp:104 mode-change-capability=2;max-red=0

a=rtpmap:96 telephone-event/16000

a=fmtp:96 0-15

a=curr:qos local sendrecv

a=curr:qos remote none

a=des:qos mandatory local sendrecv   //主叫方的qos情况为sendrecv

a=des:qos mandatory remote sendrecv  //被叫方的qos情况为sendrecv

a=sendrecv

a=maxptime:240

a=ptime:20

7、IMS_SIP_UPDATE/OK

        收到由被叫端发过来的200 Response Code，说明被叫收到了update消息

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE

SDP Presence = 1

SIP Call ID Length = 59

SIP Message Length = 1317

SIP Message Logged Bytes = 1318

Message ID = IMS_SIP_UPDATE

Response Code = OK (200)

 

8、IMS_SIP_INVITE/RINGING

       由网络发送，告诉主叫方被叫方正在响铃，被叫方也会收到180的消息

Message ID = IMS_SIP_INVITE

Response Code = RINGING (180)

 

9、IMS_SIP_INVITE/OK

        network to ue,由被叫方发送200 OK表明invite消息已经处理成功。

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE

SDP Presence = 0

SIP Call ID Length = 59

SIP Message Length = 1103

SIP Message Logged Bytes = 1104

Message ID = IMS_SIP_INVITE

Response Code = OK (200)

10、IMS_SIP_ACK/INFORMAL_RESPONSE

         Ue to newtwork, 主叫方发送ACK表明自己已经知道MT端invite请求处理成功。发完后，通话已经建立。相应的audio RTP包开始收发。

Subscription ID = 2

Version = 1

Direction = UE_TO_NETWORK

SDP Presence = 0

SIP Call ID Length = 59

SIP Message Length = 725

SIP Message Logged Bytes = 726

Message ID = IMS_SIP_ACK

Response Code = INFORMAL_RESPONSE (0)

CM Call ID = 10

11、IMS_SIP_BYE/INFORMAL_RESPONSE

         Network to UE,表明由被叫方发起挂断请求。也可能是主叫方挂断，所以也可能是主叫方主动发起挂断请求。

Subscription ID = 2

Version = 1

Direction = NETWORK_TO_UE

SDP Presence = 0

SIP Call ID Length = 59

SIP Message Length = 783

SIP Message Logged Bytes = 784

Message ID = IMS_SIP_BYE

Response Code = INFORMAL_RESPONSE (0)

CM Call ID = 10

12、IMS_SIP_BYE/OK

         Ue to network，由主叫方发送200的成功响应，表明我已经接收到挂断的请求。之后将EPS的承载释放掉。

Message ID = IMS_SIP_BYE

Response Code = OK (200)

至此，IMS MO Call SIP信令就完成了

 

三、IMS MT CALL 针对SIP信令的分析

MT call的信令流和MO的差不多是，稍微有点不一样

1. IMS_SIP_INVITE/INFORMAL_RESPONSE

和主叫一样的消息，但是主叫是UE to network，被叫是network to UE。Sip消息的内容差别不大，

1. IMS_SIP_INVITE/TRYING

UE to network，收到INVITE消息，然后主动发起一个TRYING(100)的消息，发起RACH进入rrc连接状态。

1. IMS_SIP_INVITE/SESSION_PROGRESS

UE to network，发送183的Response Code，告诉主叫方被叫这边的qos状况（sendrecv）和支持的编解码方式。

1. IMS_SIP_PRACK/INFORMAL_RESPONSE

network to UE，收到主叫方发过来的PRACK,表明主叫方收到步骤3中发送的183消息。

1. IMS_SIP_PRACK/OK

UE to netwrok，被叫方发送，告诉主叫方 我收到发送过来的PRACK消息。

1. IMS_SIP_UPDATE/INFORMAL_RESPONSE

network to UE，收到主叫方发过来的update消息，其中包括协商之后的消息，比如用什么编解码和qos等。

1. IMS_SIP_UPDATE/OK

UE to network，发送200的成功响应码给主叫方，告诉我已经收到update的消息。

1. IMS_SIP_INVITE/RINGING

UE to netwrok，发送180的ringing消息给主叫我这边正在响铃。

1. IMS_SIP_INVITE/OK

UE to netwrok，表明invite消息已经处理成功

       10、IMS_SIP_ACK/INFORMAL_RESPONSE

        network to UE，表明通话已经建立。

       11、IMS_SIP_BYE/INFORMAL_RESPONSE

UE to Network ,表明由被叫方主动发起挂断请求。

       12、IMS_SIP_BYE/OK

              Network to ue,收到主叫方响应成功的200响应码。