IP Office Server Edition - tcpdump / Wireshark

[john3voltas]

Hi there.
IPO SE has an option under :7071 to capture packets. Such capture is supposed to be a tcpdump capture that can later be downloaded.
We have a customer experiencing one-way-voice-only on a couple of phones (1608 and an analogue connected to an ATA device). Those 2 telephones are the only ones affected by the issue and those are the only two sets that have been installed on a given remote office.
All other remote offices are fine. Just this one is experiencing the issue.
Their networking/security team asked us to grab some tcpdump captures that can shed some light on the issue. But after grabbing the dump, unzipping it, un-taring it and loading it in Wireshark, I end up with something that apparently can't be decoded by wireshark and seems to be a bit hexadecimal-ish.
Anyone with experience in loading the packet capture in wireshark that can give us some hints?
Usually I'd do a port-mirror on the switch but apparently this particular lan switch doesn't have that option...?!...or at least, so they say.
Thanks in advance.
Cheers

 

[Menniss]

Hey John

I use this without issue, it provides a file .pcap0 and I open it in wireshark and it looks normal. Your screen grab looks like the normal details pane.

System I have done this one are all R11.1 Wireshark version is 4.0.5

I realize I haven't provided much help, perhaps it's a display issue or version issue on one side.

Here is a screen shot of a trace captured from my lab system.

 

[derfloh]

I don't like the start/stop from WebUI and login via SSH and become root.

There use the following command:

tcpdump -i eth0 -w /home/Administrator/test.pcap

Afterwards change owner:

chown Administrator:Administrator /home/Administrator/test.pcap

Then you can download the file with WinSCP. This way you have the option to add some filters and no restrictions.

 

[john3voltas]

Thank you both.
I now know what I was doing wrong. I was archiving and downloading the debug logs instead of the packet capture logs.......



I'm leaving this print so that no one falls for the same mistake I fell.
Thanks a bunch guys.
Cheers