VoIP Ethernet Capture TSBC5000

Capturing using the internal host of the SN10500 unit

The internal host of the SN10500 can be used for capturing packets that are mirrored from the VOIP0 and/or VOIP1 physical ports. This includes RTP traffic.

Start Capture

You need two SSH sessions to capture the traffic:

Step 1

• Access the SN10500 management interface using SSH. Then, access the telecom baseboard using telnet:

telnet [eth0 IP address of the telecom unit]

For example

telnet 172.16.123.45

Prompt is now:

0/tbgw>

• Do command "mv88eMonitor" to get the PortMask and PortNumber:

mv88eMonitor

The output should be like this:

Port Mapping:
PortDesc   :                       voip0  voip1 sw6352   fpga  mgmt0  mgmt1   eth0   eth1   host sw6321    cpu
PortNumber :      0      1      2      3      4      5      6      7      8      9     10     11     12     13
PortMask   :    0x1    0x2    0x4    0x8   0x10   0x20   0x40   0x80  0x100  0x200  0x400  0x800 0x1000 0x2000

• Use this command to capture VoIP0 traffic (for 600 seconds or 10 minutes):

mv88eMonitor 0x8 0x8 11 600

• Use this command to capture VoIP1 traffic:

mv88eMonitor 0x10 0x10 11 600

In the example, the duration is 600 seconds. This will capture traffic for 10 minutes.

Note: We do not recommend to keep capturing for a long time. This is only used for debugging purpose.

Step 2

• Access the SN10500 management interface using SSH
  

start tbx_cli_tools_remote

[root@TB016635 ~]# tbx_cli_tools_remote

• Connect to tbrouter

(The following is displayed:)

Available remote hosts to control (TBX_GW_PORT=12358, local IPs 172.16.0.1 / 172.18.0.1). Press corresponding letter to
control:
   a : TB016634.tbrouter
   b : TB016635.gateway
   c : TB016635.logtrace
   d : TB016635.stream_server
   e : TB016635.tboam_app
   f : TB016635.tbrouter       <------------tbrouter
   g : TB016635.tbsnmpagent
   h : TB016635.tbsyslog
   i : TB016635.tbuctwriter
   j : TB016635.toolpack_engine
   k : TB016635.toolpack_sys_mgr
   l : TB016635.web_server

• Select the tbrouter application. (Letter 'f' in the above example)

• Once you have access to the tbrouter application, press 'p'

       Capture circular buffer size (nb of packets)?      : 50000  <-- set the number of packets to capture
       Capture mode (1:In 2:Out 4:Monitor) (ex: 3=In+out) : 4      <-- Select 4
       VLAN id (list, -1:All) (ex:151, 152, 153, 154)     : -1
       Convert DSA tags to VLAN tags                      : Yes
       Capture only firewall-protected VLANs              : Yes

Press Enter to start the capture.

Stop Capture

Press 'P' (capital letter) to stop the capture.

• Access the telecom baseboard from the SN10500 using telnet.

telnet 172.16.123.45

• Stop the capture

mv88eMonitor 0 0 0

Download Capture

To download the voip_capture.cap file, use SSH secure copy ("sftp") to the SN10500 management port. This can be done on Windows using tools like Filezilla or WinSCP.
The file location of the capture is:

/lib/tb/toolpack/tbrouter/pcap

References

• VoIP Ethernet Capture
• FreeSBC VoIP Ethernet Capture