How to Enable Packet-Trace (Port Mirroring) on the Session Director

Asset ID:	1-71-1594565.1
Update Date:	2017-08-01
Keywords:

Solution Type Technical Instruction Sure

Solution 1594565.1 : How to Enable Packet-Trace (Port Mirroring) on the Session Director

Applies to:

Acme Packet 3820 - Version S-Cx6.4.x and later
Net-Net 3810 - Version S-Cx6.4.x and later
Net-Net OS - Version S-Cx6.3.0 and later
Acme Packet 4500 - Version S-Cx6.4.x and later
Acme Packet OS

Goal

This document explains how packet-trace (port mirroring) on the Session Director (SD) can be enabled.

Note: The packet-trace feature should be enabled only in a maintenance window or when the server is running with low traffic because it can affect performance. To minimize performance impact, limit the tracing only to the IP addresses that you are interested in.

This feature requires an external tracing server, which can be any host that is running a packet trace application such as tcpdump, wireshark, tshark etc.

Solution

In the following example, the device will be configured to capture everything to the access realm sip-interface, and send it to external tracing server 192.168.11.200 via the core side sip-interface.

Assuming the SD sip-interface tied to M10:0 via the core realm is 192.168.11.100, and the external tracing server 192.168.11.200 is accessible in the core side network:

sip-interface
state enabled
realm-id core
sip-port
address 192.168.11.100
port 5060
transport-protocol UDP
tls-profile
allow-anonymous all

To set up the Packet Trace server 192.168.11.200 connection via the core side sip-interface, navigate in the CLI to system > capture-receiver and set it:

capture-receiver
state enabled
address 192.168.11.200
network-interface M10:0
last-modified-date 2007-07-30 21:16:38

Now you can mirror specific packets on any interface. Assuming the SD sip-interface on the access realm is 11.0.0.100:5060 :

sip-interface
state enabled
realm-id access
sip-port
address 11.0.0.100
port 5060
transport-protocol UDP
tls-profile
allow-anonymous all

For series 6.x release the Acme Command Line Interface (ACLI) command to start the trace to mirror all packets from or to IP 11.0.0.100 on interface M00:0 would be:

packet-trace start M00:0 11.0.0.100

For series 7.x release the Acme Command Line Interface (ACLI) command to start the trace to mirror all packets from or to IP 11.0.0.100 on interface M00:0 would be:

packet-trace remote start M00:0 11.0.0.100

The ACLI command to stop the trace is

packet-trace stop M00:0 11.0.0.100

Attachments

This solution has no attachment