Policy - Tcpdump examples for capturing Diameter traffic

Asset ID:	1-75-1677040.1
Update Date:	2017-04-12
Keywords:

Solution Type Troubleshooting Sure

Solution 1677040.1 : Policy - Tcpdump examples for capturing Diameter traffic

Applies to:

Oracle Communications Policy Management - Version POLICY 7.5.0 and later
Tekelec
reviewed and ready to publish

Purpose

Capture and provide Diameter Packet Captures to TAC for troubleshooting

Troubleshooting Steps

Example tcpdump commands for capturing Diameter Traffic

For certain issues, such as network or communication issues, TAC may require a packet capture(s) in order to further troubleshoot. Packet captures should be stored in the /var/camiant/ path, as this has the most space. A new directory (Example: /var/camiant/pcaps/) can be created if preferred.

Useful Tcpdump Options
-s0	no limit on packet size
-n	no DNS lookup
-w	Write to specific filename <path/filename>
-i	Interface to capture on
-W	Maximum number of files to create before writing over first
-C	Maximum file size (in millions of bytes)
-Z root	Run as root
nohup xxx &	Run command in background (kill using kill command)
port xxx	The port to capture on
host x.x.x.x	To/From Host. Use "host x.x.x.x or x.x.x.x" for multiple hosts

Pre-Checks

In order to determine the correct interface to capture on, please use "netstat -rn" to print the routing table, which can then be used to determine the route and interface the packets will traverse.
To verify there is enough space, use the "df -h" command.

TCP Dump Examples

Example 1:

Capture 20 files at 100MB each on bond0.5 for diameter port 3868. Run in the background

nohup tcpdump -Z root -C 100 -W 20 -i bond0.5 -s0 -w /var/camiant/mpe2-B.pcap port 3868 &

Example 2:

Capture all traffic except port 22 to any interface (NOTE: any will capture on every interface, resulting in triple size pcap)

tcpdump -Z root -i any -s0 -w /var/camiant/mpe2-B.pcap not port 22

Example 3:

Capture 10 files each 50MB of diameter traffic to SPR 1.1.1.1

nohup tcpdump -Z root -C 50 -W 10 -i bond1 -s0 -w /var/camiant/mpe-to-spr.pcap host 1.1.1.1

Once packet capture(s) have been collected, please upload them directly to the SR, or to the Oracle SFTP Server (Oracle SFTP Instructions in Doc ID 1676882).

Attachments

This solution has no attachment