How to capture sniffers from CUBE

[ciscovoipsupport]

Hi All,

In continuation to discussion @ https://supportforums.cisco.com/discussion/12368251/rtp-delay-cube

I would like to know how i can capture RTP Packets (PCAP) to analyze delay using wire shark..

CUCM = SIP = G0/0 = CUBE = G0/1 = SIP = Service Provider

Router Version 15.1(4)M4

I went through: https://supportforums.cisco.com/document/29616/utilizing-new-packet-capture-feature

But not sure how to do it for all packets or RTP Pakcets..

1. Please help me to understand how to capture from G0/0 and G0/1 and how to download a copy of the .pcap file...

2. Also What debugs will help me for RTP Delay issues if i have to open a TAC Case?

Thanks.

[Suresh Subramanian · Accepted solution]

Here is the link

https://supportforums.cisco.com/document/11935676/ip-traffic-export-packet-capture.

I think the packet capture is sufficient to analyze the rtp stream issues

[ciscovoipsupport]

Thank you Suresh,

1. How will i negate this configuration?
2. What will be the CPU consumption of router if i do this?
3. Can all version of Wire shark decode the audio from RTP packets? My calls are using G729 Codes.
4. Will this have any impact on production?

[Anas Abueideh]

Hi,

1- To remove the configuration, you need to remove the recording profile

2- for sure it has CPU and Memory consumption, the recording dump by default is saved in the memory. you need to enable that for troubleshooting only. kindly find the below link

http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/ht_rawip.html#wp1054159

3- PCAP files can be decoded with any wireshark version

4- for production, it is better to apply it in non peak hours

HTH

Anas

don't forget to rate the helpful posts

[ciscovoipsupport]

Resolved: https://supportforums.cisco.com/discussion/12390111/sip-calls-over-mpls-packet-sniffer-issue