[cisco-voip] What debug should I be looking at..

[Ed Leatherman]

Thanks Wes,

How much of a performance hit is it to capture the packets from the
CLI on call manager? I'm seeing some stuff from wireshark/SPAN port
that is making me not trust that my laptop is capturing everything.
Specifically, ACKs for packets that I aren't being captured.

On Thu, Nov 3, 2011 at 10:26 AM, Wes Sisk <wsisk at cisco.com> wrote:
> Ed,
>
> Definitely looks like something suspicious in TCP.  A packet capture would be very helpful.
>
> Example:
> Syslogs.txt:47: VoiceGateway 1517086: Nov  1 15:19:00: TCB68A623F8 setting property TCP_NONBLOCKING_READ (14) 688A4118
> Syslogs.txt:48: VoiceGateway 1517137: Nov  1 15:20:00: TCP0: keepalive timeout (0/4)
> Syslogs.txt:49: VoiceGateway 1517177: Nov  1 15:21:00: TCP0: keepalive timeout (0/4)
> Syslogs.txt:50: VoiceGateway 1517230: Nov  1 15:22:00: TCP0: keepalive timeout (0/4)
> Syslogs.txt:54: VoiceGateway 1517233: Nov  1 15:22:01: TCP0: state was ESTAB -> CLOSEWAIT [28020 -> CUCM-SUB-A(2000)]
>
> Looks like IOS is setting up this TCP session with TCP keepalive enabled.  TCP Keepalive is different from SCCP keepalive.  You see here that the TCP keepalive is is not ACK'd and this eventually leads to session abort.
>
> Regards,
> Wes



-- 
Ed Leatherman