> capture capabilities in a customer's network, is there any way in the Cisco > IOS to see if the incoming VoIP packets really do have the express > forwarding bit set?
Embedded packet capture is among my best friends: http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture_ps6441_TSD_Products_Configuration_Guide_Chapter.html My own quick ref: ! here, I make a filter conf t object-group network REGISTERS range 10.1.26.110 10.1.26.140 ip access-list extended REGISTERS permit ip object-group REGISTERS any ! then, there's a few steps to getting a packet capture ! 1) define a buffer (where to stuff your capture) ! 2) define a capture point (where you want to grab data from) ! 3) associate the buffer with the point ! 4) start the cap ! 5) stop the cap ! 6) copy the cap via ftp !!! define the buffer ! I upped the buffer from default 256 to 512Kbyte and the max packet size from default 68 bytes to 256bytes ! I also made it circular so I could go grab some coffee and let it fill up, and when I come back to stop it, it will have the latest data monitor capture buffer pakcap size 512 max-size 256 circular ! my filter monitor capture buffer pakcap filter access-list REGISTERS !!! the capture point monitor capture point ip cef pakcappoint FastEthernet0/1 both !!! associate them monitor capture point associate pakcappoint pakcap !!! start the cap monitor capture point start pakcappoint !!! grab coffee, or wait for some good reason to stop the capture !!! stop the cap monitor capture point start pakcappoint !! shuffle er off to ftp monitor capture buffer pakcap export ftp://ftp.yourdomain.com/pakcap Also, rememeber to clear the buffer if circular before you start the next one, else you'll be momentarily confused. Ryan ... _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
