Cisco TelePresence Advanced Media Gateway Series

Capturing network packets from MCU/TelePresence Server/Gateways/IP VCR

Capturing network packets from Cisco TelePresence Server, MCU, IP VCR and Gateways

The method for capturing network packets varies slightly depending on which product is being used. The <interface> parameter differs according to the list given at the bottom of this document. The general syntax is as follows. Please note that for all products except MCU MSE 8510, TelePresence Server, AM Gateway and Cisco TelePresence MCU 5300 Series, a compact flash card must be inserted in the product's external slot.

  1. Connect a serial terminal to the device's console port.
  2. Check that there are no active calls on the device.
  3. At the command prompt enter:
    • nettap <options> <interface>
  4. Go to the web interface and launch a call to a 'problem' endpoint so that the problem is reproduced.
  5. Wait a few seconds and press Ctrl+C at the console to stop the packet capturing process.
  6. The network capture file can be accessed in two ways:
    • Via the web interface, by clicking the Download network capture file on the Status page to download the file.
    • Via the built in FTP server (if available), by using an FTP client to connect to the device's IP address and downloading the network_trace.cap file.

Nettap options

The nettap command has a few options that may be useful when capturing network traffic. Please use them under the guidance of Cisco Technical Support. These options are:

  • -a captures all packets that are being sent/received on the port. By default, the device uses a capture filter to limit which packets are collected. The default capture filter reduces load on the system while the capture is running and also reduces the file size of the capture.
  • -l removes the limit on the number of packets that are collected in a capture (by default this is 160,000 packets). The limit reduces the file size of the capture, therefore this option must be used with care as it will increase CPU load on the device and fill up the limited storage space.
  • -s removes the limit on the amount of data that is captured in each packet (normally 128 bytes). This option may be useful where the entire packet needs to be captured rather than just the headers. Using this option will increase the size of the capture file.
  • -h <host> limits the capture for packets to or from a specific IP address. This may be useful if there is a lot of network traffic on the interface and only one host is of interest (e.g. an endpoint).


The name of the interface depends on both the product in use and the software version it is running:

  • bge0 (port A) or bge1 (port B):
    • MCU 4200/ MSE 8420 or MCU 4500 running 3.1 or earlier
    • ISDN Gateway Series running 2.0 or earlier
    • IP Gateway Series running 2.0(1.11) or earlier
    • Serial Gateway Series
    • IP VCR Series
  • vfx0 (port A) or vfx1 (port B):
    • MSE 8510 running 3.1 or earlier
    • TelePresence Server running 2.2 or earlier
    • AM Gateway running 1.0(1.13)
  • A (port A) or B (port B):
    • MCU 4200/ MSE 8420 or MCU 4500 running 4.0 or newer
    • MSE 8510 running 4.0 or newer
    • MCU 5300 Series
    • TelePresence Server running 2.3 or newer
    • ISDN Gateway Series running 2.1 or newer
    • IP Gateway Series running 2.0(3.32)
    • AM Gateway running 1.1(1.33) or newer

This article applies to the following products:

  • Cisco TelePresence Server
  • Cisco TelePresence MCU Series
  • Cisco TelePresence Advanced Media Gateway 3600
  • Cisco TelePresence ISDN Gateway Series
  • Cisco TelePresence IP Gateway Series
  • Cisco TelePresence Serial Gateway Series
  • Cisco TelePresence IP VCR Series

Nov 12th, 2013 TAA_KB_202