cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
968
Views
0
Helpful
1
Replies
Highlighted
Beginner

Empty pcap file with Embedded Packet Capture

Hello,

I have configured the EPC in my CISCO 2901 CUBE for monitoring VOIP traffic.

#First I configure the type of traffic I want to filter
access-list 110 permit tcp any any eq 5060
access-list 110 permit tcp any any eq 5061
access-list 110 permit udp any any eq 5060
access-list 110 permit udp any any eq 5061

#Then my buffer (too big, I know..)

monitor capture buffer buff-SIP5 size 2048 max-size 9500

# I apply the access-list to the buffer
monitor capture buffer buff-SIP5 filter access-list 110
# Define the capture point, both interfaces, IN and OUT..
monitor capture point ip cef SIP5 all both 
#Associate capture point with buffer
monitor capture point associate SIP5 buff-SIP5

#Start the capture
monitor capture point start SIP5
#Stop it..
monitor capture point stop SIP5

#Check if you have what you need
show monitor cap buffer buff-SIP5 dump


#Export it using scp
monitor capture buffer buff-SIP5 export scp://root@10.0.2.8:/SIP5.pcap

 

I would like some help with these two issues:

1) When I export it, my pcap file is empty...yet when I do a dump, I can see everything I need

2) If I don't apply the access-list filter, I can see the SIP messages in the pcap file. However, I cannot see the messages that sends the SBC, only the ones that it receives.

 

Thanks in advance,

Gabriel

 

Everyone's tags (4)
1 REPLY 1
Beginner

you can use following command

you can use following command .

***************************************************************************

CUBE01(config)#ip traffic-export profile trace mode capture
CUBE01(conf-rite)#bidirectional

CUBE01(config)#interface dialer 0
CUBE01(config-if)#ip traffic-export apply trace size 100000000

CUBE01#traffic-export interface dialer 0 start
CUBE01#traffic-export interface dialer 0 stop
CUBE01#traffic-export interface dialer 0 copy tftp://192.168.100.232/CAP.pcap

************************************************************************************

i captured on int dialer 0 which is assign to vdsl port you can change what interface you want capture

as usual following 

CUBE01(config)#interface ?

CUBE01(config-if)#ip traffic-export apply trace size

**************************************************************************

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards