Network Capture

Unlike a T4 you cannot remotely connect Wireshark to the turret to take a network capture, instead, one of the following methods must be used;

•performing a network capture by remotely connecting Wireshark to the TPO (preferred option for investigating signalling issues)

•a TAP

•a SPAN port

•running tcpdump on the turret (beware the capture must be filtered and/or run for a short time due to the limited disk space on the turret)

Running tcpdump on the turret

You will need a PC with the following installed;

•Putty (or other SSH client)

•WinSCP (or another SCP client)

•Wireshark (or another Network Analyser)

To perform the capture;

1.SSH to the turret (username root/password 969131)

2.Run the following commands

cd /dev/shm

tcpdump -i any -s 0 -w filename.pcap

If you can filter the capture it will reduce the size of the file significantly

# Capture SIP traffic on port 5060

tcpdump -i any -s 0 -w filename.pcap port 5060

# Capture traffic between this device and IP address 1.2.3.4

tcpdump -i any -s 0 -w filename.pcap host 1.2.3.4

3.Press control-C to terminate the capture.

4.To copy the file use your SCP client to copy /dev/shm/filename.pcap to your local PC.

5.The downloaded file can be opened in Wireshark.