Troubleshooting random 1 way voice

[afsharki2]

Hello, we recently over the summer upgraded from 8.6 to 11.5 CUCM.  Recently we've had a few user cases that have complained about receiving a call internally, and then not being able to hear the other end for a couple seconds.  Their sometimes seems to be a delay.   How does one recommend troubleshooting this.  I have RTMT, how can I troubleshoot the voice call?

[Slavik Bialik]

I would try to take Wireshark captures from both ends. This will say a lot.
You can share the captures with us, we'll also take a look.

[afsharki2]

port captures or CUCM captures?

Is their a way that I can make my capture be specific just to that stream?

[Slavik Bialik]

I would enable on 2 chosen devices the "Span on PC port". Then, connect a PC to each phone (in it's PC port) and open a Wireshark.
Start capturing on both PCs and make a new call, simulate a call that this issue happens. If it do, stop the Wireshark and gather the captures.
You can filter by this Wireshark filter, in order to see the most relevant packets: sip||rtp
Another thing, you can also use the "utils network capture size ALL count 10000 file port 5060", in order to capture all SIP packets on the CUCM itself also to see if there's nothing wrong in there, too.
Best regards,
Slavik Bialik.

[afsharki2]

Sorry i didn't write enough initially.  The device protocols for all our phones is SCCP

[Slavik Bialik]

Oh, I see. I hate debugging SCCP, heh. I'm not using this protocol for a while now.
Emm, you'll still be able to see the RTP itself in the captures (of the end devices), and we'll be able to see if when it happens if the RTP is coming and going from the start, or if the RTP also affected and starts flowing after those few seconds, it may give us some leads.
Another thing is... after you upgraded your CUCM, the phones were upgraded also? Or their firmware intentionally maintained to be the old ones? If that's the case, I would try to upgrade those devices. And by the way... this issue happens with a specific device type or with a few? If that's the case, please also state what device type the issue happens on.
Thanks, and good night! :)

[afsharki2]

After we upgraded, we also upgraded all the firmware of the phones also. 

[afsharki2]

ok how do I adjust the pcap syntax to do SCCP phone capture?  Also is their a way that I can specify the stream instead of capturing everything on the registered CM?

[Slavik Bialik]

Hi,
I'm only 90% sure, but I think this filter will do the trick on Wireshark: skinny||rtp
And in CUCM itself, you can specify the port, which is 2000, SCCP port. But can't be really sure what we'll see from this specific capture (from CUCM), in this case I would try to gather the SDL of the call (the one with the issue) from RTMT.

[afsharki2]

sorry, how do I gather the SDL of the call?