The Oracle® Enterprise Session Border Controller's packet trace tool provides the user with the ability to capture traffic from the Oracle® Enterprise Session Border Controller itself. The packet capture command is documented elsewhere, but the syntax and operation for VNF systems is not the same.

There are two capture modes across the product line, one that saves traffic locally and one that mirrors traffic to a user-specified target. Software only deployments support local capture only.

The user invokes the tool from the ACLI, manually specifying:

• How to capture (local only for VNF)
• What to capture
• Capture start and stop

Local capture supports PCAP filters to specify the signaling traffic you want to capture. The default packet trace filter uses the specified interface to capture both ingress and egress traffic. The user can then use the packet-trace command's syntax to filter based on target IP ad well as local and remote port. To further specify captured traffic, the user can also append the command with a PCAP filter enclosed in quotes. PCAP filter syntax is widely published.

The user can run only a single capture on a given interface. However, the user can run multiple captures simultaneously, as long as they are on separate interfaces.

Local packet capture is dependent on access control configuration, not capturing any denied traffic.

VNF platforms require the user to manually stop a local packet capture prior to restarting it. The command syntax does not notify the user of this requirement prior to capture re-start. Running the command to either "stop all" or "stop the specific capture" allow you to successfully restart your capture.

Packet Trace Local enables the Oracle® Enterprise Session Border Controller to capture traffic between two endpoints, or between itself and a specific endpoint. To accomplish this, the Oracle® Enterprise Session Border Controller replicates the packets sent and received and saves them to disk in .PCAP format.

By default, the system saves the .PCAP file in /opt/traces, naming it with the applicable interface name as well as the date and time of the capture. Alternatively, the user can specify file name using the system supports the PCAP filter flags -w.

The system rotates the PCAPs created in this directory by size. The last 25 files are kept and are rotated when they reach 100 MB. If there are capture files in the /opt/traces directory when this command is run, the system prompts the user to remove them before running new captures. If preferred, the user can decline this file deletion.