Using Wireshark to Log Interfaces
Scope
Here is a procedure for setting up rolling packet captures on a Telos-commissioned Asterisk* SIP server.
* Any information provided here regarding "Wireshark," "Asterisk" or "FreePBX" servers refers only to Telos-commissioned FreePBX (Asterisk) servers used with Telos Alliance telephony products. While these are third-party servers and software, we are able to provide limited pointers and advice (like this article) under normal support.
Description
Sometimes the causes of issues experienced with telephony gear are rather ambiguous. In a few of these cases, it becomes necessary to take packet captures of the Asterisk* server's network interfaces to prove where the problem is originating. These packet captures can be very large, so you'll need to configure Wireshark* to manage the data it's saving to your server to avoid filling up the disk and crashing the system. If your Asterisk* server was built by Announcement Technologies or commissioned by Telos, there should already be a version of Wireshark* installed. Below, we'll show you one way to do this.
1) Log in to Asterisk* and start XWindow
- Click here for instructions on logging in to Asterisk*
- Once logged in to the command line, type startx and press Enter to load the xWindow UI.
2) Start Wireshark*
From the menu bar in xWindow, go to Applications -> Internet and choose Wireshark Network Analyzer.
3) Create a Capture Session
When Wireshark* opens, click Interface List under the Capture section:
This will bring up a list of interfaces available to capture from. In this example, we'll tell it to look at any interface. Once we've done that, click Options:
In the options window, click Browse under Capture File(s)
This is where you will tell Wireshark* where to save the packet captures. We'll usually create a new folder on the Desktop. Once you've created / selected the folder, name the session and click OK. (in this example we have created a folder on the desktop called "troubleshoot" and we have named the session "capture")
4) Configure a Rolling Packet Capture
Once you've created a folder and a name for the session and have clicked OK, you will be brought back to the capture options window.
Under Capture File(s):
- Check Use multiple files
- Check Next file every and set this to 500MB
- Check Ring buffer with and configure for 6 files
Then under Display Options,
- Uncheck Update list of packets in real time
- Uncheck Hide Capture info dialog
Finally, Click Start.
This begins the capture process, which will continue running until you stop it.
5) Gathering and Sending Results
Once the issue has been reproduced, make note of the time it happened, the time it stopped happening, and the caller ID that was displayed or the number that was dialed when the issue occurred. This gives us a place to start looking.
- Click the Stop button on the capture info dialog to stop the recording
- Plug a USB thumb drive into the Asterisk*
- Go to the Desktop in xWindow and drag the folder you created to the thumb drive
- Send us the files for analysis along with the information described above.
* Any information provided here regarding "Wireshark," "Asterisk" or "FreePBX" servers refers only to Telos-commissioned FreePBX (Asterisk) servers used with Telos Alliance telephony products. While these are third-party servers and software, we are able to provide limited pointers and advice (like this article) under normal support.
Let us know how we can help
If you have further questions on this topic or have ideas about how we can improve this document, please contact us.
