How To: Packet Capturing on an AudioCodes Mediant 1000B

Troubleshooting SIP trunks and voice traffic requires being able to view traffic at many different points in the total path. Two of the main points to view and validate traffic are on the inside and outside of the voice gateway or Session Border Controller (SBC).

Typically, we are looking at troubleshooting traffic on the outside of the voice gateway, and typically we setup a span port on the switch that the SBC is connected into. Many times, this is unavailable or difficult due to the remote location of the SBC. So being able to packet capture off the voice gateway would be useful.

To start off capturing the Mediant 1000B, you will need web access and command line access to the device. If SSH/Telnet access is not set up, go to the Administration Tab (top tab)> Web & CLI > CLI Settings (left hand side bar). Ensure that the “Enable SSH Server” is set to “Enable”. The below screen shot is from a Mediant 1000B running the 7.2 code.

Hit the “Apply” button on the bottom.

You should then be able to SSH into the voice gateway.

Next, we need to verify the VLAN that the WAN, or outside link, is attached to. To do this, we will go to the “IP Network” tab. Then on the left-hand menu, go to the Core Entities > IP Interfaces. Highlight the interface you want to capture off of. Now down on the page, you should see the “Ethernet Device” with the “View” link next to it. Click that “View” link.

This will bring you to the “Ethernet Devices” page, where you can see the VLAN ID. In my example, it is 3.

Now armed with the knowledge of the proper VLAN ID of 3, we can SSH into the voice gateway and run the debug command. After you ssh into the voice gateway (typically via the inside interface), go to the “Enable” mode (the default password of “Admin” is required and cannot be changed). When in “Enable” mode, use the command

• debug capture voip interface vlan <VLAN-ID> proto all host <Remote-System-IP>

Since we know that the VLAN ID is 3, I will run with my temporary firewall IP.

• debug capture voip interface vlan 3 proto all host 65.113.254

I ran a test telnet (port 5060) to the outside of the SBC just to validate that TCP traffic was getting to the SIP port, and it worked. Below is the output from my test. I can now see the traffic even if it doesn’t show up on the syslog view.

Jason Howe, PEI

Find more networking tips and tricks just like this on the Networking Section of our blog!