Thanks very much Ryan. I'll give that a shot! -Nick
> From: Ryan Goldberg <[email protected]> > Date: Sun, 16 May 2010 15:11:58 -0500 > To: Nick Voth <[email protected]>, "[email protected]" > <[email protected]> > Conversation: Question about monitoring DSCP marking > Subject: RE: Question about monitoring DSCP marking > >> capture capabilities in a customer's network, is there any way in the Cisco >> IOS to see if the incoming VoIP packets really do have the express >> forwarding bit set? > > Embedded packet capture is among my best friends: > > http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capt > ure_ps6441_TSD_Products_Configuration_Guide_Chapter.html > > My own quick ref: > > ! here, I make a filter > conf t > object-group network REGISTERS > range 10.1.26.110 10.1.26.140 > ip access-list extended REGISTERS > permit ip object-group REGISTERS any > ! then, there's a few steps to getting a packet capture > ! 1) define a buffer (where to stuff your capture) > ! 2) define a capture point (where you want to grab data from) > ! 3) associate the buffer with the point > ! 4) start the cap > ! 5) stop the cap > ! 6) copy the cap via ftp > !!! define the buffer > ! I upped the buffer from default 256 to 512Kbyte and the max packet size from > default 68 bytes to 256bytes > ! I also made it circular so I could go grab some coffee and let it fill up, > and when I come back to stop it, it will have the latest data > monitor capture buffer pakcap size 512 max-size 256 circular > ! my filter > monitor capture buffer pakcap filter access-list REGISTERS > !!! the capture point > monitor capture point ip cef pakcappoint FastEthernet0/1 both > !!! associate them > monitor capture point associate pakcappoint pakcap > !!! start the cap > monitor capture point start pakcappoint > !!! grab coffee, or wait for some good reason to stop the capture > !!! stop the cap > monitor capture point start pakcappoint > !! shuffle er off to ftp > monitor capture buffer pakcap export ftp://ftp.yourdomain.com/pakcap > > Also, rememeber to clear the buffer if circular before you start the next one, > else you'll be momentarily confused. > > Ryan > > ... _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
