2 Replies Latest reply on Dec 19, 2017 12:59 PM by markfreeman

    Packet Capture

    kycleveland New Member

      I have setup packet-capture on a TA924e (Gen3) but the only data that I receive within the PCAP is SIP, not RTP?

       

      I am using the following command:

       

      packet-capture CAPTURE sip

        export tftp 10.97.126.100 (TFTP server)

        max-memory-usage 10M

        shutdown

       

      interface eth 0/1.127

        description ERA Voice VLAN

        vlan-id 127

        ip address  10.97.127.191  255.255.255.0

        ip packet-capture CAPTURE

        media-gateway ip primary

        no shutdown

       

      What am I missing? Thanks in advance for your time.

        • Re: Packet Capture
          markfreeman Employee

          Change the type from sip to standard. So it would look like this.

           

           

          packet-capture CAPTURE standard

           

            export tftp 10.97.126.100 (TFTP server)

           

            max-memory-usage 10M

           

            shutdown

           

           

           

          -Mark

          1 of 1 people found this helpful
          • Re: Packet Capture
            markfreeman Employee

            Here is a capture we use in class to make captures. If you have a ton of traffic going through the interface, it is helpful to make an access list to filter only on UDP traffic if that is what your using for SIP. The deny statements are to remove cross talk traffic to the TFTP server

             

            ip access-list extended SIP_PCAP

                 deny udp any host <<tftp ip addess here>>

                 deny udp host <<tftp ip addess here>> any

                 permit udp any any

             

            packet-capture PODX standard

                 export tftp <<tftp ip addess here>>

                 limit time 1800

                 limit size 10M

                 match list SIP_PCAP