Attention: The Cisco Support Community site will be in read only mode on Dec14, 2017 from 12:01am PST to 11:30am for standard maintenance. Sorry for the inconvenience.
We have a setup of about 400 users and use Verint as a call recording solution
The voice vlan is spanned across to the destination port where the verint VAM is connected. Lately we have seen that the recorded calls are cracking and are not clear.
On checking with ethereal, we found that there seems to be loss of packets (attached)
The switch ports do not show any errors.
Is there anything else that could cause this problem or is it just that the destination port is receiving too much traffic
Switch is a 3750G-24TS-S. Voice Codec used is G711
Switch IOS - 122-25.SEE3
MS_INDR_L3_SW1#sh monitor session 1
Type : Local Session
Source VLANs :
Both : 11
Destination Ports : Gi2/0/20
Encapsulation : Native
Ingress : Disabled
MS_INDR_L3_SW1#sh int g 2/0/20
GigabitEthernet2/0/20 is up, line protocol is down (monitoring)
Hardware is Gigabit Ethernet, address is 001c.f609.2814 (bia 001c.f609.2814)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 186/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input never, output 00:17:16, output hang never
Last clearing of "show interface" counters 00:27:29
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 73010000 bits/sec, 41960 packets/sec
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts (0 multicast)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
0 input packets with dribble condition detected
54131347 packets output, 3192063240 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
are you sure there is is only voice on vlan 11 ? 73 mbps for 400 phones (supposedly not all active at the same time), seems too much.
it's possible that the destination port is being overwhelmed with traffic. Although it is a Gig port, it shows only 100/Full.
Possibly you can help me. Exact same scenario as you, using the Verint for Call Recording, SPAN the VLAN but only capture a one-way conversation (but a two-way call is definitely occuring). Promiscuous mode is on, standard SPAN statements:
monitor session 1 source vlan xx
monitor session 1 destination interface Fa0/x
Even placed everything on same switch, same VLAN and SPAN specific port. Same result. Tried two different 6513 switches and one 3560 switch - doubt this is IOS code related.
The customer here is using Nortel and VLAN 11 is the CLAN as well as the Voice VLAN.
I did see some drop counts on the port asic level (sh controllers ethernet-controller port-asic statistics). unfortunately does not show which ports are associated to it. Anyway i raised a TAC case for the same
Steve, i dont have any issues like one way speech. Are you sure you are spanning the vlan where the SVI is created?
I simplified the SPAN scenario to only monitor a specific port in which two-way VoIP calls are occuring, at the time of the capture. Both IP Phones are on the same switch, same VLAN and SPAN destination port is also on the same switch. Verint only sees one side of the RTP transmissions. Even tried standalone sniffer with the same result.
I am curious as to what commands you used to setup the SPAN - just to see if you're doing it differently.
That would depend on the platform you use IOS/CATOS
On the 3750 i use the following
monitor session 1 source vlan
monitor session 1 destination interface
Same config works fine on the 3550 as well
I've tired this on two different 6513s (IOS based) and a 3560 switch - they all are configured the same way (which is what you show in your post). I suspect our issue is not with the SPAN configuration, rather with settings that need to be changed to allow bi-directional capture of RTP packets.
To all that participated in this thread,
As a rsolution to the my specific SPAN problem encountered ... it was, as I suspected, nothing to do with the SPAN configuration. Rather, the NIC card that was utilized by Wireshark is not a "promiscous" card and not capable of picking up all of the packets properly. Once a proper NIC was used, both sides of the conversation were captured.
Thanks Steve for telling us the reason for the stange problem.
Narayan, I'm not quite sure what a CLAN is, but I think that any recorder with "normal" hardware will have trouble dealing with 70 mbps and more of traffic.
I am having same recording problem. We have Veriant recording software and three days ago recording was not clear but now everything is working fine.
We are doing investigation to find out the route cause to avoid same issue in the future.
Two Redundant CME + Two Audiolog Veriant Server.
I understand that you're integrating a CUCM with Verint recording and that you use SPAN to send RTP traffic to be recorded.
I'm having an issue as I'm trying to do the same but no RTP traffic is seen on verint devices.
Besides the monitoring session you configure on the switches, do you use any special configuration on the CUCM and phones? could you please help?
Did you get any solution for this issue? I am also facing similar issue with Cisco 7841 IP Phone recording with Verint V5 SP2 HFR2. I've already posted in this discussion for my issue as well. If you have any idea or suggestion, please kindly suggest me.