[c-nsp] Question about monitoring DSCP marking

[Ryan Goldberg]

> capture capabilities in a customer's network, is there any way in the Cisco
> IOS to see if the incoming VoIP packets really do have the express
> forwarding bit set?

Embedded packet capture is among my best friends:

http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture_ps6441_TSD_Products_Configuration_Guide_Chapter.html

My own quick ref:

! here, I make a filter
conf t
object-group network REGISTERS 
 range 10.1.26.110 10.1.26.140
ip access-list extended REGISTERS
 permit ip object-group REGISTERS any
! then, there's a few steps to getting a packet capture
! 1) define a buffer (where to stuff your capture)
! 2) define a capture point (where you want to grab data from)
! 3) associate the buffer with the point
! 4) start the cap
! 5) stop the cap
! 6) copy the cap via ftp
!!! define the buffer
! I upped the buffer from default 256 to 512Kbyte and the max packet size from default 68 bytes to 256bytes
! I also made it circular so I could go grab some coffee and let it fill up, and when I come back to stop it, it will have the latest data
monitor capture buffer pakcap size 512 max-size 256 circular 
! my filter
monitor capture buffer pakcap filter access-list REGISTERS
!!! the capture point
monitor capture point ip cef pakcappoint FastEthernet0/1 both
!!! associate them
monitor capture point associate pakcappoint pakcap
!!! start the cap
monitor capture point start pakcappoint
!!! grab coffee, or wait for some good reason to stop the capture
!!! stop the cap
monitor capture point start pakcappoint
!! shuffle er off to ftp
monitor capture buffer pakcap export ftp://ftp.yourdomain.com/pakcap 

Also, rememeber to clear the buffer if circular before you start the next one, else you'll be momentarily confused.

Ryan

...