[asterisk-users] OT: Capture Asterisk traffic

[Steve Totaro]

> -----Original Message-----
> From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-
> bounces at lists.digium.com] On Behalf Of Joe acquisto
> Sent: Wednesday, May 02, 2007 6:08 AM
> To: Asterisk Users Mailing List - Non-Commercial Discussion
> Subject: Re: [asterisk-users] OT: Capture Asterisk traffic
> 
> . . .
> > man tcpdump indicates that I should be able to use >= syntax but it
> > doesn't
> > work as expected. Any further advice appreciated.
> >
> > Cameron
> 
> When interested in packets, I usually use ethereal and a 4 port hub,
> plugging the ethereal and asterisk boxs into the hub and uplink the
hub to
> where the asterisk box plugged into.  It does require more hardware
and a
> momentary interruption of communications, but seems more flexible and
less
> intrusive (to asterisk) to me.
> 
> joe a.
> 


If you have a halfway decent manageable switch, you can mirror one port
to another.  Just mirror the I/O of the port that has the interesting
traffic to an empty port and hookup your laptop running ethereal to that
port.  There is no interruption in communications this way and it should
be totally invisible to everything.  

One caveat, just because a switch can mirror ports does not mean that it
won't affect the data.  Older Cisco switches have port monitor options
but the Packets Per Second (PPS) proved to be a bottleneck (these are
10/100 manageable switches from a couple years ago in my experience).
Check the PPS figure in the docs for your switch.

Thanks,
Steve Totaro
http://www.asteriskhelpdesk.com
KB3OPB