cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1001
Views
0
Helpful
2
Replies

SPAN, SIP and Wireshark

glmonarch
Level 1
Level 1

Hello, all!

I have cisco 2651 with one L3 interface ip 172.26.18.200. This Cisco is gateway from E1 PRI (PBX Aastra MX-ONE TSW) to SIP (Asterisk). This cisco 2651 connected to cisco 2950 in port Fa 0/12. Fa 0/12 is in VLAN 518 (dot1q).

On cisco 2950 i made next commands:

# monitor session 1 source interface Fa 0/12 both encap dot1q

# monitor session 1 destination interface Fa 0/9

#sho monitor session 1

Session 1

---------

Type              : Local Session

Source Ports      :

    Both          : Fa0/12

Destination Ports : Fa0/9

    Encapsulation : DOT1Q

          Ingress: Disabled

I connected my notebook with Wireshark to cisco 2950 in Fa 0/9. Next, I made call from my PBX to Asterisk via cisco 2651. Call was

successful, but i didn't see any SIP call in wireshark. And I didn't see any frames with IP addresses Cisco 2651 (172.26.18.200) or Asterisk. Why wireshark doesn't capture this traffic?

2 Replies 2

Jeff Van Houten
Level 5
Level 5

Take encap dot1q off the source statement and try again.

Sent from Cisco Technical Support iPad App

I found the problem. Cisco 2651 send voice-traffic back to the voice serial port via E1 PRi to PBX. Therefore I can't to see any voip traffic in wireshark. Topic is closed. Thx.

Review Cisco Networking for a $25 gift card