1. Call Traffic Monitoring Guide
  2. Packet Trace
  3. Running Packet Trace

Running Packet Trace

There are four steps you take when you use the packet-trace remote feature. For packet-trace local, there are only two.

  • Configuring the Oracle® Enterprise Session Border Controller with the trace server information so that the Oracle® Enterprise Session Border Controller knows where to send replicated data. (packet-trace remote only)
  • Setting up the capture filter ip proto 4 in your software protocol analyzer if you only want to see the results of the Oracle® Enterprise Session Border Controller packet trace(s). (packet-trace remote only)
  • Starting a packet trace.
  • Stopping a packet trace.

This section provides information about how to perform all tasks.

Configuring a Trace Server

Trace servers only apply to packet-trace remote. You need to configure a trace server on the Oracle® Enterprise Session Border Controller; this is the device to which the Oracle® Enterprise Session Border Controller sends replicated data. The Oracle® Enterprise Session Border Controller supports one trace server.

To configure a trace server on your Oracle® Enterprise Session Border Controller:

  1. In Superuser mode, type configure terminal and press Enter. 
    ACMEPACKET# configure terminal
  2. Type system and press Enter. 
    ACMEPACKET(configure)# system
ACMEPACKET(system)#
  3. Enter capture-receiver and press Enter. 
    ACMEPACKET(system)# capture-receiver
ACMEPACKET(capture receiver)#
  4. state—Type enabled so that you can use the trace server to which you want to send the mirrored packets for calls you are packet tracing. The default is disabled. The valid values are:

    • enabled | disabled

      Disable capture receivers you are not actively using for traces to prevent potential service outages caused by the capture’s system resource utilization.

  5. address—Enter the IP address of the trace server; there is no default.
  6. network-interface—Enter the name and subport of the Oracle® Enterprise Session Border Controller network interface from which the Oracle® Enterprise Session Border Controller is to send mirrored packets. Your entry needs to take the form name:subport. The default is :0.
  7. Save and activate your configuration.

Starting a Remote Packet Trace

You start a remote packet trace on all platforms by entering the appropriate ACLI command with these pieces of information:

  • Network interface (name:subport ID combination)
  • IP address to be traced; if you do not enter local and/or remote ports when you start the trace, the Oracle® Enterprise Session Border Controller will trace all ports
  • (Optional) Local UDP/TCP port on which the Oracle® Enterprise Session Border Controller sends and receives traffic to be traced
  • (Optional) Remote UDP/TCP port to which the Oracle® Enterprise Session Border Controller sends traffic, and from which it receives traffic to be traced; you cannot enter the remote port without specifying a local port

    To start a packet trace with local and remote ports specified:

  1. Enter the ACLI packet-trace remote command followed by a Space, and the word start. After another Space, type in the name and subport ID for the network interface followed by a Space, the IP address to be traced followed by a Space, the local port number followed by a Space, and then optionally the remote port number. Then press Enter. 
    ACMEPACKET# packet-trace remote start core:0 192.168.10.99 5060 5060
Trace started for 192.168.10.99

Stopping a Remote Packet Trace

You stop a remote packet trace on all platforms by entering the appropriate ACLI command with these pieces of information:

  • Network interface (name:subport ID combination)
  • IP address to be traced
  • (Optional) Local UDP/TCP port on which the Oracle® Enterprise Session Border Controller sends and receives traffic to be traced
  • (Optional) Remote UDP/TCP port to which the Oracle® Enterprise Session Border Controller sends traffic, and from which it receives traffic to be traced

If the packet trace you want to stop has no entries for local and/or remote ports, then you do not have to specify them.

  1. To stop a packet trace with local and remote ports specified, enter the ACLI packet-trace remote command followed by a Space, and the word stop. After another Space, type in the name and subport ID for the network interface followed by a Space, the IP address to be traced followed by a Space, the local port number followed by a Space, and then optionally the remote port number. Then press Enter. 
    ACMEPACKET# packet-trace remote stop core:0 192.168.10.99 5060 5060
  2. To stop all packet traces on the Oracle® Enterprise Session Border Controller, enter the ACLI packet-trace remote command followed by a Space, and the word stop. After another Space, type the word all and press Enter. 
    ACMEPACKET# packet-trace remote stop all

Starting a Local Packet Trace on Non-DPDK Platforms

You use the start a local packet trace by entering the appropriate ACLI command with these pieces of information:

  • Network interface (name:subport ID combination)
  • (Optional) Enter a tcpdump command line within quotes

Note that the system supports local packet trace on all platforms.

  1. Enter the ACLI packet-trace local command followed by a Space. Type in the name and subport ID for the network interface followed by a Space. Type in any desired capture filter surrounded by quotes, then press Enter. 
    
ACMEPACKET# packet-trace local s0p0 "host 192.168.12.12"
Files found in trace directory. Remove [y/n]?: y
File: /opt/traces/s0p0_0_00001_20150723095442.pcap
Packets: 5 Packets dropped: 0
    The ACLI session does not accept use input while the packet-trace local command is running.

Stopping a Local Packet Trace on Non-DPDK Platforms

Type Ctrl-C to stop a local packet trace. This also re-enables the command line session.

Starting a Local Packet Trace on DPDK Systems

Local packet-trace syntax differs on the platforms using the DPDK datapath. The primary differences include using the start argument and the ability to continue to use the ACLI while running packet-capture. Additional considerations include:

  • You can run only a single capture on a given interface. However, you can run multiple captures simultaneously, as long as they are on separate interfaces.
  • You must manually stop a local packet capture prior to restarting it. The command syntax does not notify you of this requirement prior to capture re-start. Running the command to either "stop all" or "stop the specific capture" allows you to successfully restart your capture.

You use the start a local packet trace by entering the appropriate ACLI command with these pieces of information:

  • Network interface (name:subport ID combination)
  • (Optional) Enter a tcpdump command line within quotes

Note:

When operating on a VNF, The Oracle® Enterprise Session Border Controller requires that you prepend the VLAN key to a capture filter to run packet-trace on VLAN interface. These commands take the following form.

ORACLE# packet-trace local start <network interface> < vlan [vlan_id]&& capture filter>

Examples include:

ORACLE# packet-trace local start M00:100 "vlan && port 5060"

or

ORACLE# packet-trace local start M00:100 "vlan 100 && port 5060"
  1. Enter the ACLI packet-trace local command followed by a Space, and the word start followed by a space. Type in the name and subport ID for the network interface followed by a Space. Type in any desired capture filter surrounded by quotes, then press Enter. 
    
ACMEPACKET# packet-trace local start s0p0 "vlan && host 192.168.12.12"
Files found in trace directory. Remove [y/n]?: y
ACMEPACKET#

Stopping a Local Packet Trace on DPDK Systems

You stop a specific local packet trace by entering the appropriate ACLI command with these pieces of information:

  • Network interface (name:subport ID combination)
  • (Optional) Enter a tcpdump command line within quotes

If the packet trace you want to stop has no entries for local and/or remote ports, then you do not have to specify them.

  1. To stop a packet trace with local and remote ports specified, enter the ACLI packet-trace local command followed by a Space, and the word stop. After another Space, type in the name and subport ID for the network interface followed by a Space, the IP address to be traced followed by a Space, the local port number followed by a Space, and then optionally the remote port number. Then press Enter. 
    ORACLE# packet-trace local stop s0p0 "host 192.168.12.12"
  2. To stop all packet traces on the Oracle® Enterprise Session Border Controller, enter the ACLI packet-trace local command followed by a Space, and the word stop. After another Space, type the word all and press Enter. 
    ORACLE# packet-trace local stop all