Sniffing Skinny on CCM5.1 or 6.0.

Unanswered Question
Dec 14th, 2007

Anyone done any packet caputres off a CallManager 5.x or Communications Manager 6.x server?

I am spanning the CallManager server port and can't capture any SKINNY (SCCP for those searching for alternate search terms) packets from the CallManager server. Using Ethereal 0.99.0. Sniffer is plugged into another switch port (not the back of the phone.)

Plugged in a CallManager 4.x to the same SPAN source port and kept the same SPAN configuration and voila--there they all are. Plugged in a CCM 5.x server and no more skinny packets. Same as 6.0.

I did see some MGCP keepalives to/from the voice gateway and saw a COUPLE SKINNY packets from a couple phones that I didn't configure in CCM. (Saw the station alert and registration rejected messages.

I do see RTP from CCM if I put a phone on hold. See TFTP, etc.

Tried a 3750G-24TS switch and a 3524-PWR-XL-EN switch. Same results.

Weird.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
gogasca Fri, 12/14/2007 - 18:54

I would use Wireshark

Ethereal devs are not programming anymore, all Eth development is in Wireshark now.

mciarfello Fri, 12/14/2007 - 22:40

Thanks for the tip. Will use Wireshark now and in the future.

No difference to my original problem though.

Only sniffer software difference is winpcap 3.1 versus WinPCap 4.0.1 that Wireshark installed.

mciarfello Sat, 12/15/2007 - 20:32

Update: If I reset the phone (from **#** or ccmadmin reset) I can sniff skinny packets from that phone for a while. Seems to go away again in about an hour.

Continuing to play.

Actions

This Discussion