I have setup packet-capture on a TA924e (Gen3) but the only data that I receive within the PCAP is SIP, not RTP?
I am using the following command:
packet-capture CAPTURE sip
export tftp 10.97.126.100 (TFTP server)
max-memory-usage 10M
shutdown
interface eth 0/1.127
description ERA Voice VLAN
vlan-id 127
ip address 10.97.127.191 255.255.255.0
ip packet-capture CAPTURE
media-gateway ip primary
no shutdown
What am I missing? Thanks in advance for your time.
Change the type from sip to standard. So it would look like this.
packet-capture CAPTURE standard
export tftp 10.97.126.100 (TFTP server)
max-memory-usage 10M
shutdown
-Mark
Here is a capture we use in class to make captures. If you have a ton of traffic going through the interface, it is helpful to make an access list to filter only on UDP traffic if that is what your using for SIP. The deny statements are to remove cross talk traffic to the TFTP server
ip access-list extended SIP_PCAP
deny udp any host <<tftp ip addess here>>
deny udp host <<tftp ip addess here>> any
permit udp any any
packet-capture PODX standard
export tftp <<tftp ip addess here>>
limit time 1800
limit size 10M
match list SIP_PCAP