Debug Capturing on Physical VoIP Interfaces

You can capture traffic on the device's physical (Ethernet LAN) VoIP interfaces (Layer-2 VLAN tagged packets). The captured traffic can be saved in a PCAP-format file (suitable for Wireshark) to a TFTP (default) or an FTP server. The generated PCAP file is in the Extensible Record Format (ERF). You can also save the capture to a USB device. The maximum file size of debug captures that can be saved to the device is 20 MB100 MB.

To capture traffic on physical VoIP interfaces, use the following CLI commands:

■

Starts physical VoIP debug capture:

# debug capture voip physical eth-lan
# debug capture voip physical start

■

Captures packets continuously in a cyclical buffer (packets always captured until stop command):

# debug capture VoIP physical cyclic buffer

■

Retrieves latest capture (PCAP file) saved on a specified server:

# debug capture VoIP physical get_last_capture <TFTP/FTP server IPv4 / IPv6 address>

The file is saved to the device's memory (not flash) and erased after a device restart.

■

Marks the captured file (useful for troubleshooting process):

# debug capture VoIP physical insert-pad

Before running this command, the debug capture must be started.

■

Displays debug status and configured rules:

# debug capture VoIP physical show

■

Specifies the destination (FTP, TFTP, or USB) where you want the PCAP file sent:

# debug capture VoIP physical target <ftp|tftp|usb>

■

Stops the debug capture, creates a file named debug-capture-voip-<timestamp>.pcap, and sends it to the TFTP or FTP server:

# debug capture voip physical stop <TFTP/FTP server  IPv4 / IPv6 address>

If no IP address is defined, the capture is saved on the device for later retrieval.