How do I produce a netwok sniffer trace using Ethereal to show the traffic between my Codian MCU and another piece of equipment?

Introduction

This article relates to the Cisco TelePresence MCU 4203, Cisco TelePresence MCU MSE 8420, Cisco TelePresence MCU 4505, Cisco TelePresence MCU MSE 8510 and Cisco TelePresence Advanced Media Gateway 3610 products.

Q. How do I produce a netwok sniffer trace using Ethereal to show the traffic between my Codian MCU and another piece of equipment?

A. A network sniffer trace is a capture of raw network traffic as it appears 'on the wire'. A sniffer trace showing the traffic between the Codian MCU and an endpoint, gateway or gatekeeper is often an essential part of solving tricky problems. This article explains all the steps required to obtain a sniffer trace, using the freeware 'Ethereal' program, a PC and a network hub.

Hardware required:

• PC running Windows 2000 or XP

• 10/100 Mbps (or better) network hub (not a switch - a hub is required so that every port can 'see' the traffic to and from every other port, allowing the PC to spy on the traffic between the MCU and the endpoint)

• Sufficient patch cables to connect the PC and MCU or endpoint to the hub, and the hub into the rest of the network

Software required:

• Ethereal* from http://ethereal.com/download.html

Instructions:

1. Download and install Ethereal (in that order) on the PC to be used as a sniffer.

2. Connect the hub into the network, and connect the PC into the hub.

3. Connect the endpoint into the hub. Now, the PC's network interface will be able to see all the traffic that passes between the MCU and the endpoint.

4. Start the Ethereal program.

5. In Ethereal's main window, go to Capture > Start.

6. In the Capture Filter field in the Ethereal: Capture Options page, enter host aaa.bbb.ccc.ddd where aaa.bbb.ccc.ddd is the IP address of either the MCU or the endpoint. To capture only relevant traffic, it is best to enter the IP address of the host which is not plugged into the hub along with the PC: therefore, if you have the MCU plugged into the hub along with the PC, enter the IP address of the endpoint into the capture filter.

7. Click OK. Ethereal will now start sniffing. It will capture all traffic whose source or destination IP address is the host address you entered in the capture filter.

8. With the MCU and endpoint, reproduce the problem as required.

9. After the problem has been reproduced, click Stop on Ethereal's capture window.

10. Save the captured packets in Ethereal's native .cap format and email the resulting file to TANDBERG Customer Support.

* TANDBERG is not responsible for the content of third party web sites

Related Information

• Technical Support & Documentation - Cisco Systems