Span configuration + switch + calls record

habouzyad · ‎04-14-2009

Hi,

please , can you verify with me this switch configuration. i want to SpAN traffic from Voice Vlan , to record the calls on the SpAN server.

thanks in advance.

hicham

Nicholas Matthews · ‎04-14-2009

The major issue you have look for when SPAN'ing the VLAN is only using one direction. This causes you to get duplicate packets because all packets enter and transmit through the VLAN.

This means you would want to use a command like this:

no monitor session 1 source vlan 233 rx

monitor session 1 source vlan 233 tx

hth,

nick

habouzyad · ‎04-15-2009

hi,

by using this configuration, for the skinny message , i only receive skinnykeealive , and not the skinny message that inform for start and stoP call are not received [ that is imPortant for the aPPlication used for recording each call).

Nicholas Matthews · ‎04-15-2009

You can try using the keyword 'both', but from my experience this causes duplicate packets.

You may be on the wrong switch for the traffic you're looking for if you're not seeing the right SCCP messages. The VLAN traffic you're looking for may not go through that particular switch. Find out where the phone is at, where the destination is at, and check out your spanning tree topology.

hth,

nick

nengkung · ‎08-06-2010

hi hicham,

I have a same your problem that show skinny message keepalive only.

How do you fix this case? Please tell me.

Thanks a lot

tanate

paolo bevilacqua · ‎08-06-2010

Check your recording application because span in itself unlikely to have issues.

afmmanicke · ‎08-06-2010

I'd plug in a PC running WireShark. From there you can filter and get just the VoIP Data.

I have the following in a working config:
monitor session 1 source vlan 1
monitor session 1 destination interface Fa0/44 ingress untagged vlan 1

TONY

nengkung · ‎08-06-2010

Hi

I try to config span that it still same a problem.

And Engineer's record team told that

"To elaborate further for the voice packet sniffed from IP phone connected to CallManager 8.0.2, we analyzed the packet by using Wireshark (a network protocol analyzer) and found that aside SKINNY mes sage “KeepAliveMessage” & “KeepAliveAckMessage”, there is no other SKINNY message such as “CallStateMessage=1 (off hook)”, “CallStateMessage=2 (on hook)”, “CallStateMessage=5 (connected)”, etc" but in CallManager 4.2 have all SKINNY message."

How I do this case?

I attach file that how a different between capture packet CCM4.2 and CCM 8.0.

Please help and thank you a lot.

Aaron Harrison · ‎08-07-2010

Hi

Post up the actual captures - it's possible that the packets just aren't recognised by wireshark and/or the app you have as the SCCP protocol has changed..

Or are you running encrypted signalling?

Aaron

Aaron Please remember to rate helpful posts to identify useful responses, and mark 'Answered' if appropriate!