Span configuration + switch + calls record

Unanswered Question
Apr 14th, 2009

Hi,

please , can you verify with me this switch configuration. i want to SpAN traffic from Voice Vlan , to record the calls on the SpAN server.

thanks in advance.

hicham

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Nicholas Matthews Tue, 04/14/2009 - 18:02

The major issue you have look for when SPAN'ing the VLAN is only using one direction. This causes you to get duplicate packets because all packets enter and transmit through the VLAN.

This means you would want to use a command like this:

no monitor session 1 source vlan 233 rx

monitor session 1 source vlan 233 tx

hth,

nick

habouzyad Wed, 04/15/2009 - 04:09

hi,

by using this configuration, for the skinny message , i only receive skinnykeealive , and not the skinny message that inform for start and stoP call are not received [ that is imPortant for the aPPlication used for recording each call).

Nicholas Matthews Wed, 04/15/2009 - 05:13

You can try using the keyword 'both', but from my experience this causes duplicate packets.

You may be on the wrong switch for the traffic you're looking for if you're not seeing the right SCCP messages. The VLAN traffic you're looking for may not go through that particular switch. Find out where the phone is at, where the destination is at, and check out your spanning tree topology.

hth,

nick

nengkung Fri, 08/06/2010 - 11:25

hi hicham,

I have a same your problem that  show  skinny message keepalive only.

How do you fix this case? Please tell me.

Thanks a  lot

tanate

afmmanicke Fri, 08/06/2010 - 12:37

I'd plug in a PC running WireShark.   From there you can filter and get just the VoIP Data.

I have the following in a working config:
monitor session 1 source vlan 1
monitor session 1 destination interface Fa0/44 ingress untagged vlan 1

TONY

nengkung Fri, 08/06/2010 - 20:39

Hi

I try to config span that it still same a problem.

And Engineer's record team told that

"To elaborate further for the voice packet sniffed from IP phone connected to CallManager 8.0.2, we analyzed the packet by using Wireshark (a network protocol analyzer) and found that aside SKINNY mes sage “KeepAliveMessage” & “KeepAliveAckMessage”, there is no other SKINNY message such as “CallStateMessage=1 (off hook)”, “CallStateMessage=2 (on hook)”, “CallStateMessage=5 (connected)”, etc" but in CallManager 4.2 have all SKINNY message."

How I do this case?

I attach file that how a different between capture packet CCM4.2 and CCM 8.0.

Please help and thank you a lot.

Attachment: 
Aaron Harrison Sat, 08/07/2010 - 02:56

Hi

Post up the actual captures - it's possible that the packets just aren't recognised by wireshark and/or the app you have as the SCCP protocol has changed..

Or are you running encrypted signalling?


Aaron

Actions

This Discussion