Setting up SPAN for voice recording - 2960S - not seeing any RTP packets

[snahaw0]

I am using a C2960S-48LPS-L. I enabled the spanning via Telnet as per the manual:

Switch(config)# monitor session 1 source interface gigabitethernet0/1

Switch(config)# monitor session 1 destination interface gigabitethernet0/2
encapsulation replicate

Switch(config)# end

When I run wireshark I see TCP packets between the phones and phone server, as well as the SIP signalling, and the dialing digits, but no RTP packets, (which are UDP if that matters for the spanning.)

What do I need to do to get the RTP stream to the monitor port?

The phone server is a Toshiba IPEdge and the recording is Oaisys running on an HP Windows 2012 server, but neither should matter. I just need the RTP/UDP stream to show up on the mirrored port for the call recording.

Thanks!

 

[snahaw0]

Forgot to add:

No VLAN - switches are strictly for voice network.

 

[VinceWhirlwind]

What is connected to G0/1?

 

[snahaw0]

The source port (actually Gi1/0/46, not 0/1) is a Toshiba IP Edge, with SIP trunks and H.323 phones.

The destination port (actually Gi1/0/40, not 0/2) is a Windows 2012 server running Oaisys call recording software.

The software is licensed and programmed to record 8 extensions. When I place test calls, I see the SIP invite on the mirrored port, as well as other TCP traffic, but no RDP...

Thanks again!

 

[VinceWhirlwind]

Would you expect the RDP traffic to travel via the "Toshiba IP Edge", or does this device merely take care of phone registration and call setup?

 

[snahaw0]

Yes, I expect the RTP/UDP there as the Toshiba is a complete VoIP phone system. When I use a Netgear switch and do the port mirroring, I see the RTP/UDP packets and the recording works.

Thanks,
Scott

 

[VinceWhirlwind]

Try
Switch(config)# monitor session 1 source interface gigabitethernet0/1 both
But you should have seen the RTP in one direction if that was really the issue.

What device is doing the collecting? Its interface isn't configured for dot1q, is it?

 

[snahaw0]

Both is the default on the monitor session.

The recording device on the monitor port is a Windows 2012 server running Oaisys recording software.

No dot1q, as there are no VLan's

If I look at the session I get:

Switch#show monitor session 1
Session 1
---------
Type : Local Session
Source Ports :
Both : Gi1/0/46
Destination Ports : Gi1/0/40
Encapsulation : Replicate
Ingress : Disabled

Thanks again,
Scott