<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Arial Narrow";
panose-1:2 11 6 6 2 2 2 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></head><body lang="EN-US" link="blue" vlink="purple"><div class="WordSection1"><p class="MsoNormal"><span style="color:#1f497d">Christian</span></p><p class="MsoNormal"><span style="color:#1f497d">Sorry I have not seen something similar. I personally was able to use the below steps and get a working pcap for wirewhark. Can you see SIP messaging when you run a normal debug on the Adtran in the CLI?</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><div><p class="MsoNormal"><b><span style="font-family:"Arial Narrow","sans-serif";color:#1f497d">Thanks—</span></b><span style="color:#1f497d"></span></p>
<p class="MsoNormal"><span style="font-family:"Arial Narrow","sans-serif";color:#1f497d">Zak Rupas | Tier 3 Engineer</span><span style="color:#1f497d"></span></p><p class="MsoNormal"><span style="color:#1f497d"><img width="320" height="101" id="_x0035_de3ecac-af54-44fc-b74e-1a268e92664e" src="cid:image001.png@01CDBE86.C0416A20" alt="Description: cid:image001.png@01CBDE2D.5E1CC730"></span><span style="color:#1f497d"></span></p>
<p class="MsoNormal"><span style="font-family:"Arial Narrow","sans-serif";color:#1f497d">Support Line 303-242-8616 Option 1</span><span style="color:#1f497d"></span></p><p class="MsoNormal"><span style="font-family:"Arial Narrow","sans-serif";color:#1f497d"><a href="http://www.simplesignal.com/">www.simplesignal.com</a></span><span style="color:#1f497d"></span></p>
</div><p class="MsoNormal"><span style="color:#1f497d"> </span></p><div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Christian Pena [mailto:<a href="mailto:christian.pena@corp.earthlink.com">christian.pena@corp.earthlink.com</a>] <br>
<b>Sent:</b> Friday, November 09, 2012 2:06 PM<br><b>To:</b> 'Brad Anouar'; 'Zak Rupas'; <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br><b>Subject:</b> RE: [VoiceOps] TCPDump on an Adtran TA908E</span></p>
</div></div><p class="MsoNormal"> </p><p class="MsoNormal"><span style="color:#1f497d">Blast from the past!</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">I have tried to follow something very similar to this (didn’t use an access-list) on some Adtrans I have in the field. Some are 908Es, some Netvantas 6300. When I do this, I can certainly see tons of data, can convert it with text2pcap but not much I could identify as SIP when I know there is SIP running through the box. Am using the Adtrans SIP proxy – not sure if this has anything to do with it? </span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">Anyone seen anything similar? </span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a> [<a href="mailto:voiceops-bounces@voiceops.org">mailto:voiceops-bounces@voiceops.org</a>] <b>On Behalf Of </b>Brad Anouar<br>
<b>Sent:</b> Thursday, September 22, 2011 6:54 PM<br><b>To:</b> 'Zak Rupas'; <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br><b>Subject:</b> Re: [VoiceOps] TCPDump on an Adtran TA908E</span></p>
</div></div><p class="MsoNormal"> </p><p class="MsoNormal"><span style="color:#1f497d">Hi Zak,</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">The following is the whole procedure on how to obtain and convert a packet capture to a pcap file.</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">From the command line, we have the ability to look at every packet coming in and out of the router, along with the ability to limit that debug with an access-list. This is best done from a telnet or SSH session, as the console can drop some of the output due to a limited buffer size.</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">It is preferable to not have any other messages pop up that may interfere with the capture text. The events and any other debugs should be turned off before performing this debug. This can be done with the following commands:</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">Router# no events</span></p><p class="MsoNormal"><span style="color:#1f497d">Router# undebug all</span></p><p class="MsoNormal">
<span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">The general command is:</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d"><> = optional</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">Router# debug ip packet <access-list name> <detail / dump></span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p>
<p class="MsoNormal"><span style="color:#1f497d">NOTE: It is not recommended to run this command without referencing an access-list.</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal">
<span style="color:#1f497d">---------------------------------------------------</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">To limit the traffic to and from a particular peer:</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">ip access-list extended test</span></p><p class="MsoNormal"><span style="color:#1f497d"> permit ip any host <IP in question></span></p>
<p class="MsoNormal"><span style="color:#1f497d"> permit ip host <IP in question> any</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">For example:</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">ip access-list extended test</span></p><p class="MsoNormal"><span style="color:#1f497d"> permit udp host 192.168.40.22 any eq 5060</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">debug ip packet test detail</span></p><p class="MsoNormal">
<span style="color:#1f497d">debug ip packet test dump</span></p><p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">---------------------------------------------------</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">If you desire to see more than what 'detail' provides, choosing 'dump' will output the entire packet in text form. This can be copied to a text document and converted to an actual packet capture.</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">The program Wireshark (</span><a href="http://www.wireshark.org">www.wireshark.org</a><span style="color:#1f497d">) comes with a utility known as Text2Pcap. Copy (text2pcap.exe) from the Wireshark folder to a root drive, as well as the text file. Run the following command from a DOS prompt:</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">text2pcap.exe -e 0x800 <Text Filename> <Capture Filename to Create (extension .pcap)></span></p><p class="MsoNormal">
<span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">The capture file can then be opened in Wireshark. If the unit is running a firewall, you will probably see every packet twice (once entering the firewall & once leaving, depending on the ACL you are using); the second may be after a NAT process if NAT is enabled.</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><p class="MsoNormal"><span style="color:#1f497d">If the traffic is across a VPN, the second packet will not be seen since it enters/leaves the router encapsulated in VPN.</span></p>
<p class="MsoNormal"><span style="color:#1f497d"> </span></p><div><div><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Verdana","sans-serif";color:#314b98">Brad Anouar</span></b><b><span style="font-family:"Verdana","sans-serif";color:#314b98"> </span></b><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:#454545"> </span></b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:#454545">| Anywhere (310) 360-2028 | Corporate (800) 942-4700 | </span><a href="http://www.broadcore.com/"><span style="font-size:8.0pt;font-family:"Verdana","sans-serif";color:#454545">www.broadcore.com</span></a><span style="color:#1f497d"></span></p>
</div></div><p class="MsoNormal"><span style="color:#1f497d"> </span></p><div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:voiceops-bounces@voiceops.org">voiceops-bounces@voiceops.org</a> [<a href="mailto:voiceops-bounces@voiceops.org">mailto:voiceops-bounces@voiceops.org</a>] <b>On Behalf Of </b>Zak Rupas<br>
<b>Sent:</b> Thursday, September 22, 2011 3:24 PM<br><b>To:</b> <a href="mailto:voiceops@voiceops.org">voiceops@voiceops.org</a><br><b>Subject:</b> [VoiceOps] TCPDump on an Adtran TA908E</span></p></div></div><p class="MsoNormal">
</p><p class="MsoNormal">Does anyone know the TCP Dump commands for the Adtran TA908e CLI?</p><p class="MsoNormal"> </p><p class="MsoNormal"><b>Thanks-</b></p><p class="MsoNormal">Zak Rupas</p><p class="MsoNormal">Tier 3 Engineer</p>
<p class="MsoNormal">Support: 303-242-8606 option 1</p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:#7f7f7f"> </span><span style="color:#1f497d">Like SimpleSignal on </span><a href="http://www.facebook.com/SimpleSignal"><b>Facebook</b></a><b><span style="color:#1f497d"> !</span></b></p>
<p class="MsoNormal"><span style="color:#1f497d">SimpleSignal Inc.</span></p><p class="MsoNormal"><span style="color:#1f497d">3600 S. Yosemite Street</span></p><p class="MsoNormal"><span style="color:#1f497d">Suite 150</span></p>
<p class="MsoNormal"><span style="color:#1f497d">Denver, CO 80237</span></p><p class="MsoNormal"><span style="color:#1f497d"><img border="0" width="320" height="101" id="Picture_x0020_1" src="cid:image001.png@01CDBE86.C0416A20" alt="Description: Description: Description: cid:image001.png@01CBDE2D.5E1CC730"></span></p>
<p class="MsoNormal"> </p></div></body></html>