|
ESI Hosted Services Support may request a PCAP of your SIP and RTP data from your Asterisk server on occasion in order to help diagnose your issues.
You can execute the commands below in order to generate a Packet Capture file that is capable of being loaded into Wireshark for analysis by a ESI Hosted Services Support Technician.
In order to execute the commands below you will need root or sudo access to root to generate a proper PCAP file.
tcpdump -i <interface> -s 65535 -w <some-file> -G <num_seconds> -w 'trace_%Y%m%d-%H%M%S.pcap'
example :
tcpdump -i eth0 -s 65535 -w /tmp/eth0.pcap -G 3600 -w 'trace_%Y%m%d-%H%M%S.pcap' udp
The above example will produce a PCAP file stored in /tmp/eth0.pcap capturing all UDP data from your Asterisk server.
-iListen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback). Ties are broken by choosing the earliest match.On Linux systems with 2.2 or later kernels, an interface argument of ``any'' can be used to capture packets from all interfaces. Note that captures on the ``any'' device will not be done in promiscuous mode.If the -D flag is supported, an interface number as printed by that flag can be used as the interface argument.
-sSnarf snaplen bytes of data from each packet rather than the default of 65535 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred. Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should limit snaplen to the smallest number that will capture the protocol information you're interested in. Setting snaplen to 0 sets it to the default of 65535, for backwards compatibility with recent older versions of tcpdump.
-wWrite the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is ``-''. See pcap-savefile(5) for a description of the file format.
-GIf specified, rotates the dump file specified with the -w option every rotate_seconds seconds. Savefiles will have the name specified by -w which should include a time format as defined by strftime(3). If no time format is specified, each new file will overwrite the previous.If used in conjunction with the -C option, filenames will take the form of `file<count>'.
| 
(0 votes)
This article was helpful
This article was not helpful