[c-nsp] Question about monitoring DSCP marking

[Nick Voth]

Thanks very much Ryan. I'll give that a shot!

-Nick


> From: Ryan Goldberg <RGoldberg at compudyne.net>
> Date: Sun, 16 May 2010 15:11:58 -0500
> To: Nick Voth <nvoth at estreet.com>, "cisco-nsp at puck.nether.net"
> <cisco-nsp at puck.nether.net>
> Conversation: Question about monitoring DSCP marking
> Subject: RE: Question about monitoring DSCP marking
> 
>> capture capabilities in a customer's network, is there any way in the Cisco
>> IOS to see if the incoming VoIP packets really do have the express
>> forwarding bit set?
> 
> Embedded packet capture is among my best friends:
> 
> http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capt
> ure_ps6441_TSD_Products_Configuration_Guide_Chapter.html
> 
> My own quick ref:
> 
> ! here, I make a filter
> conf t
> object-group network REGISTERS
>  range 10.1.26.110 10.1.26.140
> ip access-list extended REGISTERS
>  permit ip object-group REGISTERS any
> ! then, there's a few steps to getting a packet capture
> ! 1) define a buffer (where to stuff your capture)
> ! 2) define a capture point (where you want to grab data from)
> ! 3) associate the buffer with the point
> ! 4) start the cap
> ! 5) stop the cap
> ! 6) copy the cap via ftp
> !!! define the buffer
> ! I upped the buffer from default 256 to 512Kbyte and the max packet size from
> default 68 bytes to 256bytes
> ! I also made it circular so I could go grab some coffee and let it fill up,
> and when I come back to stop it, it will have the latest data
> monitor capture buffer pakcap size 512 max-size 256 circular
> ! my filter
> monitor capture buffer pakcap filter access-list REGISTERS
> !!! the capture point
> monitor capture point ip cef pakcappoint FastEthernet0/1 both
> !!! associate them
> monitor capture point associate pakcappoint pakcap
> !!! start the cap
> monitor capture point start pakcappoint
> !!! grab coffee, or wait for some good reason to stop the capture
> !!! stop the cap
> monitor capture point start pakcappoint
> !! shuffle er off to ftp
> monitor capture buffer pakcap export ftp://ftp.yourdomain.com/pakcap
> 
> Also, rememeber to clear the buffer if circular before you start the next one,
> else you'll be momentarily confused.
> 
> Ryan
> 
> ...