I am having a problem where UDP SIP packets do not show up on the span dst port in my captures.
I am seeing TCP traffic and some other UDP traffic as well as the broadcasts and I know there are UDP SIP packets because when I do a capture on the device itself it shows a SIP keepalive exchange every minute.
Has anyone run into this before? I have spent a few hours searching for info on why this might be both from span (cisco) perspective and from 2 different capture software vendors with no hits yet that could explain it.
Thanks in advance.
What is your SPAN configuration? Are you monitoring a particular port or an entire VLAN? My question is directed towards verifying that your are monitoring the appropriate port and appropriate VLAN.
There is no reason for a switch to filter out SIP messages from monitored traffic so I conclude that either the source of the SPAN session is not configured properly, or the destination is unable to pass out the SIP messages (tagging issue perhaps)?