Network analyzing with span

[Horacio Gutierrez]

hello,

I need to determine through sniffing my network traffic where and why in my network are packets from our cisco phones been dropped.  My environment is a follow the phones plugin to 3750 switches in different floors, where the 3750 plug to our 6509 core switches thru ethrnetr channel which the core switches WAN traffic go out our mpls traffic to another site setup the same way as far as switches. My question is how do i accomplish this using a laptop with wireshark to analyze the packets can I use span or rspan or espan, and where do i configure this and how, please help.

Thanks

[blau grana]

Hello Horacio,

Here are links for documentation with examples:

http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml

http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html#wp1036704

Best Regards

Please rate all helpful posts and close solved questions

estions

[Steve Fuller]

Hi Horacio,

Is there a specific reason you need to look for this packet loss by sniffing the network?

Typically you'll see packet loss at points of over-subscription in the network, for example on the uplinks from the Catalyst 3750 to the Catalyst 6500. You can see if and how much packet loss there is on an interface by checking the Total output drops count in the output of the show interface command and seeing if this is a non-zero value.

Do you have packet loss between IP phones in the same site or only for calls between the two sites? If it's only between the sites then it's likely the loss is at the MPLS WAN edge, and again you should be able to determine the level of packet loss from the drop counters.

Also do you have any Quality of Service (QoS) policy applied to the switches? If you don't then it's probably worth considering this such that voice traffic is placed into a higher priority queue than other traffic types.

Regards