we are implementing a VoIP Recorder (which has not successfully captured both ends of the conversation, only one-way). The actual VoIP call is a two-way conversation - no issues in this regard.
To simply the situation, I connected Wireshark to a 3560 switch port and configured it to monitor one specific port, in both directions (default setting but I specified "both" regardless). The specific port contains an IP phone.
Wireshark does not sniff RTP packets in both directions, only one direction. When we change which phone initiates the call, the same scenario occurs.
This is a local SPAN, the sniffer and both IP phone connected to the exact same switch, the exact same VLANs. I even tried VSPAN but still get the same scenario. This is being done on either a 6513 or a 3560 switch (same result).
Any ideas would be appreciated.
A sample of how it was configured is:
monitor session 1 source interface Fa0/44
monitor session 1 destination interface Fa0/41
Fa0/44 would have the IP phone attached and Fa0/41 is where the sniffer is attached.