This document describes the specific commands required to collect the output from either CallManager servers or Cisco IOS® gateways and phones. Many documents are referenced in the collection of Pulse Code Modulation (PCM) and packet captures from different platforms.
Packet Capture on CallManager, Unity Connection, or CUPS
In order to run the packet capture, complete these steps:
Secure Shell (SSH) to the CallManager, Unity Connection, or Cisco Unified Presence Server (CUPS) for which you would like to run the capture.
Once you are logged in with the platform administrative rights, enter this command:
utils network capture size all count 1000000 file ciscotacpub
Note: Press Ctrl-C to stop the trace.
After the packet capture is collected from the Servers Console/SSH Terminal, collect it with the Real-Time Monitoring Tool (RTMT). Log in to the RTMT and choose these options:
System > Tools > Trace > Trace & Log Central > Collect Files > Check the Packet Capture Logs check box
This does not work well with the first generation Integrated Services Routers (ISRs) (2800 and 3800 Series routers). The first generation ISRs truncate large packets that cause the Real-Time Protocol (RTP) headers to lose details when troubleshooting Audio RTP related issues.
Works very well in ISR G2 (2900 and 3900 Series routers).
Optional - access list to filter out any un-wanted captures:
! access-list 100 permit ip any any access-list 100 permit udp any any access-list 100 permit tcp any any ! ! ! ip traffic-export profile TACCAPTURE mode capture bidirectional incoming access-list 100 outgoing access-list 100 no length ! interface GigabitEthernet0/0 ip traffic-export apply TACCAPTURE size 100000000 ! ! enable: traffic-export interface <type-number> clear traffic-export interface <type-number> start traffic-export interface <type-number> stop traffic-export interface <type-number> copy !
The traffic export is collected directly from the buffer into the flash/tftp/ftp. For example:
This command reference captures the interface GigabitEthernet 0/1 bidirectional.
The capture buffer name in this scenario is capture-buff and the interface reference is capture-pt.
! MS-2901#monitor capture buffer capture-buff size 4000 max-size 1500 linear MS-2901#monitor capture point ip cef capture-pt gigabitEthernet 0/1 both MS-2901#monitor capture point associate capture-pt capture-buff MS-2901#monitor capture point start all MS-2901#monitor capture point stop all MS-2901#monitor capture buffer capture-buff export tftp://10.137.8.185/capture.pcap !
For further details on the Embedded IOS packet capture, refer to these documents:
The capture collects the calls that traverse the specified dial-peer.
With regards to the collection of Cisco IOS PCM captures on a Cisco IOS Release 15.2(2)T1 and later, the command reference has changed when compared to earlier Cisco IOS versions.
The commands are very similar to the SIP and H.323 gateway PCM captures. However, since Media Gateway Control Protocol (MGCP) gateways do not have specified dial-peer (back-haul), enter the test voice port command in order to apply the trigger that specifies the voice port in question.
test voice port x/x/x pcm-dump caplog fff duration xxx !
You can also review the output from the show voice call status command in order to verify which port the call traverses.
Triggered PCM Capture on Cisco IOS Gateway
The triggered Cisco IOS PCM capture is a feature only available in Cisco IOS Release 15.2(2)T1 and later.
This feature, when enabled on a voice gateway, starts a PCM capture when the DTMF key *** (star, star, star) on a Cisco registered phone is pressed. Ensure the phone call from this phone traverses the gateway in question.
The PCM capture stops after the digits ### are entered on the captured phone.
There is an optional duration parameter that can be used to specify a specific capture duration after the triggered PCM capture is started. If this parameter is set to 0, the capture is infinite until stopped.