# US 10,375,126 B2 · Methods, devices and computer readable storage devices for intercepting VoIP traffic for analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,126 B2 - Document ID: US10375126B2 - Status: Granted - Kind: B2 - Application number: 14/087,251 - Filed: 2013-11-22 - Published: 2015-05-28 - Granted: 2019-08-06 - Earliest claimed: 2013-11-22 - Assignees: AT&T Mobility II LLC - Applicants: AT&T Mobility II LLC - Inventors: Arturo Maria; Thomas J. Routt - Web page: https://patentgrep.com/patent/US10375126B2 ## CPC - H04L 65/1076: Screening of IP real time communications, e.g. spam over Internet telephony [SPIT] - H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications} - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04M 7/0078: {Security; Fraud detection; Fraud prevention} - H04L 51/10: Multimedia information - H04M 7/006: {Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer (H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract VoIP traffic is intercepted for analysis. Packets transmitted from a mobile communication device over a radio access network to a core mobile communications network are intercepted. VoIP packets are detected within the intercepted packets. The detected VoIP packets are stored for analysis, and the intercepted packets are forwarded to a gateway in communication with a packet data network. ## Claims ### Claim 1 A method, comprising: intercepting, by executing an instruction with a processor outside a core mobile communications network and not included in a packet data network, packets transmitted from a mobile communication device over a radio access network towards the core mobile communications network and the packet data network, the packets intercepted at an output of the radio access network; detecting, by executing an instruction with the processor outside the core mobile communications network, voice over internet protocol packets within the intercepted packets; storing the detected voice over internet protocol packets for analysis; comparing, by executing an instruction with the processor outside the core mobile communications network, the detected voice over internet protocol packets with a pattern; determining, by executing an instruction with the processor outside the core mobile communications network, whether the detected voice over internet protocol packets match the pattern based on the comparing; in response to determining that the detected voice over internet protocol packets match the pattern: converting, by executing an instruction with the processor outside the core mobile communications network, the detected voice over internet protocol packets into a multimedia message service message as a first alert indicating that the detected voice over internet protocol packets match the pattern; sending, by executing an instruction with the processor outside the core mobile communications network, the multimedia service message to a multimedia service message gateway; and converting the detected voice over internet protocol packets into a short message service message as a second alert, the second alert to be transmitted to a short message service gateway; and forwarding, by executing an instruction with the processor outside the core mobile communications network, the intercepted packets to the gateway of the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets. ### Claim 2 (depends on 1) The method of claim 1, further including sending the detected voice over internet protocol packets to another entity for comparison with a pattern, wherein the other entity determines whether the detected voice over internet protocol packets match the pattern. ### Claim 3 (depends on 1) The method of claim 1, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets. ### Claim 4 (depends on 1) The method of claim 1, further including inspecting the intercepted packets for context. ### Claim 5 (depends on 1) The method of claim 1, further including: inspecting data fields of the intercepted packets; and preventing the intercepted packets from being forwarded to the gateway of the packet data network based on results of the inspection. ### Claim 6 A device, comprising: a processor outside a core mobile communications network and not included in a packet data network; and memory including instructions which, when executed by the processor, cause the processor to perform operations including: intercepting packets transmitted from a mobile communication device over a radio access network towards the core mobile communication network, the packets intercepted at an output of the radio access network; detecting voice over internet protocol packets within the intercepted packets; storing the detected voice over internet protocol packets for analysis; comparing the detected voice over internet protocol packets with a pattern; determining whether the detected voice over internet protocol packets match the pattern based on the comparing; in response to determining that the detected voice over internet protocol packets match the pattern: converting the detected voice over internet protocol packets into a multimedia message service message to be sent as a first alert indicating that the detected voice over internet protocol packets match the pattern; and sending the multimedia service message to a multimedia service message gateway; and converting the detected voice over internet protocol packets into a short message service message to be sent as a second alert; and forwarding the intercepted packets to the gateway of the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets. ### Claim 7 (depends on 6) The device of claim 6, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets. ### Claim 8 (depends on 6) The device of claim 6, wherein the instructions, when executed by the processor, further cause the processor to inspect the intercepted packets for context. ### Claim 9 A computer readable storage device comprising instructions that, when executed, cause a processor outside a core mobile communications network and not included in a packet data network to perform operations including: intercepting packets transmitted from a mobile communication device over a radio access network towards the core mobile communication network, the packets intercepted at an output of the radio access network; detecting voice over internet protocol packets within the intercepted packets; storing the detected voice over internet protocol packets for analysis; comparing the detected voice over internet protocol packets with a pattern; determining whether the detected voice over internet protocol packets match the pattern based on the comparing; in response to the determining that the detected voice over internet protocol packets match the pattern: converting the detected voice over internet protocol packets into a multimedia message service message to be sent as a first alert indicating that the detected voice over internet protocol packets match the pattern; and sending the multimedia service message to a multimedia service message gateway; and converting the detected voice over internet protocol packets into a short message service message to be sent as a second alert; and forwarding the intercepted packets of the gateway to the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets. ### Claim 10 (depends on 9) The computer readable storage device of claim 9, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets. ### Claim 11 (depends on 9) The computer readable storage device of claim 9, wherein the instructions, when executed by the processor, further cause the processor to inspect the intercepted packets for context.