Here we will be utilising the trafiic export feature which has been in use from IOS 12.3(4)T
The IP Traffic Export feature allows users to configure their router to export IP packets that are received on multiple, simultaneous WAN or LAN interfaces. The unaltered IP packets are exported on a single LAN or VLAN interface, thereby, easing deployment of protocol analyzers and monitoring devices.
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gt_rawip.html
Here's the configuration we need
========================
conf t
access-list 101 permit ip any any
! Make sure you do not change an existing ACL, if required - create a
new one with different number.
ip traffic-export profile pcap_1 mode capture bidirectional incoming
access-list 101 outgoing access-list 101 exit
interface <Ethernet interface - or any other interface pointing to SIP
SP> ip traffic-export apply pcap_1 size 9000000
!This captures 9 MB of data.
Clear buffer (before test start):
---------------------------------
traffic-export interface <Ethernet interface> clear
Making the captures:
---------------------
traffic-export interface <Ethernet interface> start
3. start a call
4. once the call ends , execute the below cli to stop the capture
traffic-export interface <Ethernet interface> stop
5. copy the traces to TFTP or FTP server as:
traffic-export interface <Ethernet interface> copy ftp:
###############
The export feature will get us capture on SP side.
