mirror voice date and monitoring on 5412zl core switch

[abdullah.shboull]

Dear all;

I faced a problem in sniffing voice date from core switch of our customer Invest bank-Jordan.

The scenario was as follows:

1. Connected laptop on core switch port C3 with wireshark application to sniffing the voice traffic.

2. Mirroring all the traffic to port C3.

3. Monitoring the interfaces B17 and B18. ( where the Call Manager is connected).

4. When applying filter to display just the voice traffic, there is no result.

5. All the results was network traffic like ARP and SNMP and VRRP and so on.

6. I used another program than wireshark, its name OmmniPeek and I did not get any UDP packets or voice traffic. !!!

I have also disable DHCP snooping and ARP-Protection and SNMPv3 and all the possibility that might affect the sniffing working properly!!

Note:

I have made the test in many sites to mirror voice traffic from port on core switch 5412zl switch to laptop connected to the same core and with no results.

But if you do the test on any edge switch it will success!! so why on the mirroring on core switches in many sites not working.

Kindly advice and I will be appreciated to you..

Thanks...

[Antonio Milanese]

Hello,

Does VOIP traffic belongs to a VLAN?
if so by default the switch retain the VLAN tag and consequently if the network card driver does not support VLAN tags in promiscuous mode will not pass any frames to the sniffer..

If the option "no-tag-added" is specified the traffic is visible?
Can you post the relevant configuration lines?

Regards,

Antonio

[abdullah.shboull]

Hello,

Thanks a lot for your help.

I did the same configuration on both core 5412zl switch and many edge switch like 2610 and also 3500yl switches.

The results was only you can get traffic on edge switches and no results on core switch.!!!