1. Call Traffic Monitoring Guide
  2. Packet Trace

4 Packet Trace

The Oracle® Enterprise Session Border Controller (Enterprise SBC) packet trace tool provides the ability to capture traffic from the Enterprise SBC.

Caution:

packet-trace is a troubleshooting tool for use only with Oracle Support guidance. Oracle recommends using packet-trace only in lab environments and not under heavy load.

Invoke the packet trace manually from the ACLI by specifying the following.

  • Capture method (local vs remote)
  • What to capture
  • Capture start and stop

There are two capture modes, one that saves traffic locally and one that mirrors traffic to a user-specified target.

  • Local capture supports PCAP filters to specify the type of traffic to capture. Remote capture supports its own syntax to identify the traffic to mirror.
  • Local packet capture is dependent on access control configuration, not capturing any denied traffic. Remote capture mirrors traffic regardless of access control configuration.
  • The system does not capture RTP through local packet capture.
  • The system does not support running packet trace on a standby node.

Do not run packet-trace simultaneously with other Enterprise SBC replication features, such as SRS, SIP Monitoring and Trace, and Call Recording. These features may interfere with each other, corrupting each ones results.

The default packet trace filter uses the specified interface to capture both ingress and egress traffic. To specify captured traffic, you can append the command with a PCAP filter enclosed in quotes. PCAP filter syntax is widely published (See Oracle Linux man pages). You can determine the version of libpcap with the show platform components command.

Refer to Wireshark, tcpdump and Berkley Packet Filter (BPF) syntax and example resources as guidance for your capture filters:

https://wiki.wireshark.org/CaptureFilters

https://www.tcpdump.org/manpages/pcap-filter.7.html

http://biot.com/capstats/bpf.html

Note:

When operating on a VNF, The Enterprise SBC requires that you prepend the VLAN key to a capture filter to run packet-trace on VLAN interface. These commands take the following form.

ORACLE# packet-trace local start <network interface> < vlan [vlan_id]&& capture filter>

Examples include:

ORACLE# packet-trace local start M00:100 "vlan && port 5060"

or

ORACLE# packet-trace local start M00:100 "vlan 100 && port 5060"