Child pages
  • How to make large or permanent PCAP traces


Contents

If PCAP traces larger than 500 KB are needed, the PCAP Trace functionality of the Snom phone cannot be used because of space limitations.


  1. In this case, you can still capture packets coming and going to the phone by using a PC in the same network with the phone.

    You will need to get all packets to and from the phone to also reach the PC, which you can achieve by:
    1. Either using a managed switch which supports port mirroring and mirror all packets to the PC
    2. Or connecting both the PC and the phone to a hub


    You can find more informations about Ethernet capture setup into the Wireshark wiki page.

    Once you have all packets reaching the PC, you can capture them in one the following ways, depending on whether you are using Windows, Linux or Mac OSX:

  2. Alternatively you can store the PCAP on a USB stick. How to do this can be found in this article: How to store a PCAP trace into an USB mass-storage device



Windows or Mac OSX:

  • Install Wireshark (http://www.wireshark.org)
  • Start Wireshark
  • Start capturing: click the Capture menu, choose Options, press 'Start' for the appropriate interface
  • After the test is over, stop capturing by clicking Capture -> Stop
  • Save the capture by clicking File -> Save


GNU/Linux:

Install tcpdump and run as root using command:

# tcpdump -s0 -w dump.pcap -i eth0

 

Where dump.pcap is the saved PCAP trace and eth0 is the network interface.