Recently, I encountered an issue with SIP calls passing through a Cisco router (CUBE) and required a method to effectively capture and examine the stream.

To accomplish this, the following items are necessary:

1. CLI access to the router
   

2. Wireshark installed on your PC

3. tftp server installed on your PC (I used tftpd found here:tftpd32)

Here are the steps required:

Log into your router and create the capture policy:

ip traffic-export profile <name> mode capture bidirectional

Assign the capture profile to the interface:

interface <interface>

 ip traffic-export apply <name> size 20000000

Clear any data and start the export:

traffic-export interface <interface> clear

traffic-export interface <interface> start

Test your application (or in my case, a SIP call)

Once the test is complete, stop the export:

traffic-export interface <interface> stop

Export the captured traffic to your PC via tftp:

traffic-export interface <interface> copy tftp:

Use Wireshark to open the file, then click "Telephony" at the top and then "VoIP Calls" to analyze the SIP traffic

Also, if you want to send your logs (in case of a debug) to your PC via tftp, the command is:

show logging | redirect tftp://tftpserver/destinationfilename| redirect tftp://tftpserver/destinationfilename

Source: https://thevoiceman.wordpress.com/2014/11/28/ip-traffic-exporting-cube/

Cisco Router Packet Capture and Export allows network administrators to capture and export packets from Cisco routers. This feature enables the analysis of network traffic for troubleshooting and monitoring purposes. By capturing packets, administrators can gain insights into network performance, identify potential issues, and take appropriate actions to ensure optimal network operation. The exported packets can be saved in various file formats, such as pcap, for further analysis using third-party tools. This capability provided by Cisco routers is essential for maintaining network reliability and security.

If you have more questions about Cisco Routers and Cisco Switches. You could contact us www.hi-network.com  (Email: [email protected])