03-26-2013 08:13 AM - edited 03-16-2019 04:27 PM
Hi All,
Looking for advice on the best way to use wireshark to analyse a call flow.
For example, an end user with an IP phone calling out over PSTN or a SIP trunk.
Is there a way for me to analyze the end to end call flow? Is this done by configuring a span port and use the IP phone port as the source? Or should some sort of analysing be done on the gateway?
My end result is to investigate poor call quality which is not something I've had to look into before.
Thanks
Solved! Go to Solution.
03-28-2013 04:21 AM
Take a look at this website. I think this is what you are after.
http://docwiki.cisco.com/wiki/Cisco_IOS_Voice_Troubleshooting_and_Monitoring_--_Voice_Call_Debug_Filtering_on_Cisco_Voice_Gateways
Sent from Cisco Technical Support iPhone App
03-26-2013 01:13 PM
The answer to this question is different depending on whether you are using a pstn line or a sip trunk. In both scenarios you could capture the information at the gateway, however capturing the pstn side of the call requires help from cisco TAC as far as I'm aware (because the file produced can only be decoded by an internal cisco tool). To capture the ip telephony side of the call you can use the following feature to capture packets on the gateway.
https://supportforums.cisco.com/docs/DOC-5799
When performed on a call that uses a sip trunk you will be able to see both legs of the call.
Sent from Cisco Technical Support iPad App
03-27-2013 04:20 AM
Thanks for the info.
If a SIP trunk is used, what's the process for tracing the call?
Also If I wanted to focus on for example extension 2222 and the outgoing calls made from that extension, what's the best process for filtering / analysing that extension only?
Thanks
03-27-2013 12:10 PM
Are you referring to how to filter that call within a packet capture or how to create debugs on the router that are filtered to just that extension?
Sent from Cisco Technical Support iPad App
03-28-2013 03:50 AM
Hi, thanks for the replies, appreciated.
Regarding the filter I was talking about "
"how to create debugs on the router that are filtered to just that extension"
My concern is turning on debug for calls and it overloads the router as it is busy with a lot of calls, so ideally i'd like to focus on certain extension/s.
Thanks
03-28-2013 04:21 AM
Take a look at this website. I think this is what you are after.
http://docwiki.cisco.com/wiki/Cisco_IOS_Voice_Troubleshooting_and_Monitoring_--_Voice_Call_Debug_Filtering_on_Cisco_Voice_Gateways
Sent from Cisco Technical Support iPhone App
03-28-2013 06:24 AM
That document looks good Daniel, thanks.
It's a remote site so not sure If I can use the SPAN to PORT feature.
If I create a filter as per the document, which debug command is used? Calls are going from CUCM - Gateway - SIP Provider. Is there a way for me to export data / listen to the filtered calls?
03-28-2013 06:15 AM
HI
If you will need to check the endusers using wireshak please find the below
Getting the packet capture:
~~~~~~~~~~~~~~~~~~~~~
On cisco call manager
you can get it from the back of your phone. In CUCM, on the phone page, enable Span to PC Port and reset. In CME, use this command under telephony-service and reset
"service phone spanToPCPort 0". On the phone you can confirm: Model Information -> Ethernet Information -> Span to PC Port should be "Yes".
connect your cisco IP phone to your PC which have wireshark.
Thank you
Please rate if this wil help
03-28-2013 06:43 AM
Hi,
If I were to use this feature using Wireshark, can I set Wireshark to capture only Voice Traffic? Just that if this was something we could do, I may have to leave the capture running for a few hours until a call quality issue occurs. If I do this, I don't want to capture hours of ALL data also.
Thanks
03-28-2013 06:51 AM
what kind of call quality issues are you having?
03-28-2013 07:15 AM
Almost Underwater sounding / distortion...Seems to be one way also, only the local side can hear it, e.g calling party at the call manager site.
03-28-2013 07:14 AM
Hi
of course yes , this based on your configuration , kindly find the below example
in my configuraion on the switch , i need to monitor only traffic from the port of Cisco ip phone .
Thank you
please rate if this will help
03-28-2013 08:18 AM
Yep got you now thanks. My query was because the phone and PC are connected to the same switch port, so I'm guessing wireshark would record both data and voice in this case?
03-28-2013 01:59 PM
Yes, wireshark would capture both voice and data but this is easily filtered using tools within wireshark.
Sent from Cisco Technical Support iPhone App
03-27-2013 08:22 PM
To debug SIP msgs on GW u can use "debug ccsip message"
Sent from Cisco Technical Support Android App
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide