SIP Trunk Packet Loss, how to dignose?

[graeme]

Hi There,

One of our sites is suffering sever call quality issues on thier SIP trunk, teh SIP provider has aknowledged its a outage affecting most of their users.

My question is, how do I on a UC540/560 diagnose this for next time it happens.

thanks

graeme

[danplacek · Accepted solution]

Usually taking a packet capture of a call and analysing it with Wireshark is the best place to start when troubleshooting SIP issues.

Cisco also has a product that we use called On-Plus -- It is a monitoring tool that can track things like packet loss and jitter, which are very relevant to SIP performance. It can even do automated email alerts when certain thresholds are hit.

[Darren DeCroock · Accepted solution]

Hello Graeme,

What you need is a packet capture on the WAN interface.  This can be done in a few ways.

1. Use a hub, placed between the WAN and your internet connection.  Then put a PC on the hub and capture the packets.

2. Use a smart switch with supports port mirroring, and place it between the WAN and you internet connection.  Then put a PC on the switch port with the mirroring and capture the packets.

3. If you don't have a switch available:

****Create an acl to capture traffic between the UC560 and the SIP server*******
****Please verify access-list 150 isn't already being used*******

conf t

access-list 150 permit ip host x.x.x.x host y.y.y.y
access-list 150 permit ip host y.y.y.y host x.x.x.x

**** x.x.x.x is WAN ip of UC560 and y.y.y.y is SIP server ********

ip traffic-export profile testcap mode capture
bidirectional
incoming access-list 150
outgoing access-list 150
length 512
exit
interface gig0/0
ip traffic-export apply testcap size 10000000
end

traffic-export interface gig0/0 clear
traffic-export interface gig0/0 start

****Make test call*****

traffic-export interface gig0/0 stop

*****To copy capture to file on flash*****
traffic-export interface gig0/0 copy flash:
Capture buffer filename []? CallCap.pcap
Capture buffer copy operation to flash may take a while.  Continue? [confirm]
Copying capture buffer to flash:CallCap.pcap

*****To copy capture to ftp server*****
traffic-export int fa0/0 copy ftp:
Address or name of remote host []? 172.16.200.13              <----- Put ip address of your ftp server
Capture buffer filename []? CallCap.pcap
Copying capture buffer to ftp://172.16.200.13/CallCap.pcap
Writing CallCap.pcap !
73560 bytes copied.

Thank you,

Darren

[David Trad · Accepted solution]

Hi Graeme,

You have been given some interesting responses which all work, I'll throw another one into the mix

You can download "FAN" which is "Fully Automated Nagios" and install it on any really old system (At least a P4 and above) and get it to start monitoring not just the link and the latency on it, but also any SNMP enabled hardware in the organization... For a free product you cannot get any better then it

WARNING!! Can take about a whole day if not more to set it up, it is a long process, but when complete worth every minute.

Cheers,

David.

[graeme]

Brilliant thanks to you all.

forutnately on this one once I posted the questions the SIP provider contacted the client and explained it was their problem.

Basically on this issue the client was dismissive of our response that it was Packet Loss coming at their SIP rpovider end, as their second site on a different internet provider was working ok, and our site which is in the same building and uses the same internet connection but different SIP provider was wokring.

So was wnating something to show that it was deffinately the SIP.

I will look at all thes eoptions over hte next week or so and work out which one works best for us for trying in futer events.

Thanks to all I will give good ratings to you all

graeme