Packet Capture

[kycleveland]

I have setup packet-capture on a TA924e (Gen3) but the only data that I receive within the PCAP is SIP, not RTP?

I am using the following command:

packet-capture CAPTURE sip

  export tftp 10.97.126.100 (TFTP server)

  max-memory-usage 10M

  shutdown

interface eth 0/1.127

  description ERA Voice VLAN

  vlan-id 127

  ip address  10.97.127.191  255.255.255.0

  ip packet-capture CAPTURE

  media-gateway ip primary

  no shutdown

What am I missing? Thanks in advance for your time.

[Anonymous]

Change the type from sip to standard. So it would look like this.

packet-capture CAPTURE standard

export tftp 10.97.126.100 (TFTP server)

max-memory-usage 10M

shutdown

-Mark

[Anonymous]

Here is a capture we use in class to make captures. If you have a ton of traffic going through the interface, it is helpful to make an access list to filter only on UDP traffic if that is what your using for SIP. The deny statements are to remove cross talk traffic to the TFTP server

ip access-list extended SIP_PCAP

     deny udp any host <<tftp ip addess here>>

     deny udp host <<tftp ip addess here>> any

     permit udp any any

packet-capture PODX standard

     export tftp <<tftp ip addess here>>

     limit time 1800

     limit size 10M

     match list SIP_PCAP