Nicholas Matthews Tue, 04/14/2009 - 18:02
User Badges:
  • Red, 2250 points or more

The major issue you have look for when SPAN'ing the VLAN is only using one direction. This causes you to get duplicate packets because all packets enter and transmit through the VLAN.

This means you would want to use a command like this:

no monitor session 1 source vlan 233 rx

monitor session 1 source vlan 233 tx



habouzyad Wed, 04/15/2009 - 04:09
User Badges:


by using this configuration, for the skinny message , i only receive skinnykeealive , and not the skinny message that inform for start and stoP call are not received [ that is imPortant for the aPPlication used for recording each call).

Nicholas Matthews Wed, 04/15/2009 - 05:13
User Badges:
  • Red, 2250 points or more

You can try using the keyword 'both', but from my experience this causes duplicate packets.

You may be on the wrong switch for the traffic you're looking for if you're not seeing the right SCCP messages. The VLAN traffic you're looking for may not go through that particular switch. Find out where the phone is at, where the destination is at, and check out your spanning tree topology.



nengkung Fri, 08/06/2010 - 11:25
User Badges:

hi hicham,

I have a same your problem that  show  skinny message keepalive only.

How do you fix this case? Please tell me.

Thanks a  lot


paolo bevilacqua Fri, 08/06/2010 - 11:43
User Badges:
  • Super Gold, 25000 points or more
  • Hall of Fame,

    Founding Member

Check your recording application because span in itself unlikely to have issues.

afmmanicke Fri, 08/06/2010 - 12:37
User Badges:

I'd plug in a PC running WireShark.   From there you can filter and get just the VoIP Data.

I have the following in a working config:
monitor session 1 source vlan 1
monitor session 1 destination interface Fa0/44 ingress untagged vlan 1


nengkung Fri, 08/06/2010 - 20:39
User Badges:


I try to config span that it still same a problem.

And Engineer's record team told that

"To elaborate further for the voice packet sniffed from IP phone connected to CallManager 8.0.2, we analyzed the packet by using Wireshark (a network protocol analyzer) and found that aside SKINNY mes sage “KeepAliveMessage” & “KeepAliveAckMessage”, there is no other SKINNY message such as “CallStateMessage=1 (off hook)”, “CallStateMessage=2 (on hook)”, “CallStateMessage=5 (connected)”, etc" but in CallManager 4.2 have all SKINNY message."

How I do this case?

I attach file that how a different between capture packet CCM4.2 and CCM 8.0.

Please help and thank you a lot.

Aaron Harrison Sat, 08/07/2010 - 02:56
User Badges:
  • Super Bronze, 10000 points or more
  • Community Spotlight Award,

    Member's Choice, May 2015


Post up the actual captures - it's possible that the packets just aren't recognised by wireshark and/or the app you have as the SCCP protocol has changed..

Or are you running encrypted signalling?



This Discussion