2 Replies Latest reply on Dec 19, 2017 12:59 PM by markfreeman

    Packet Capture

    kycleveland New Member

      I have setup packet-capture on a TA924e (Gen3) but the only data that I receive within the PCAP is SIP, not RTP?


      I am using the following command:


      packet-capture CAPTURE sip

        export tftp (TFTP server)

        max-memory-usage 10M



      interface eth 0/1.127

        description ERA Voice VLAN

        vlan-id 127

        ip address

        ip packet-capture CAPTURE

        media-gateway ip primary

        no shutdown


      What am I missing? Thanks in advance for your time.

        • Re: Packet Capture
          markfreeman Employee

          Change the type from sip to standard. So it would look like this.



          packet-capture CAPTURE standard


            export tftp (TFTP server)


            max-memory-usage 10M







          1 of 1 people found this helpful
          • Re: Packet Capture
            markfreeman Employee

            Here is a capture we use in class to make captures. If you have a ton of traffic going through the interface, it is helpful to make an access list to filter only on UDP traffic if that is what your using for SIP. The deny statements are to remove cross talk traffic to the TFTP server


            ip access-list extended SIP_PCAP

                 deny udp any host <<tftp ip addess here>>

                 deny udp host <<tftp ip addess here>> any

                 permit udp any any


            packet-capture PODX standard

                 export tftp <<tftp ip addess here>>

                 limit time 1800

                 limit size 10M

                 match list SIP_PCAP