Session Border Controller - Using Network Capture Filters

In most cases it is acceptable to capture all packets when using the Network Capture feature for SBC troubleshooting. However, in some cases it might be beneficial to only capture certain packets, or exclude certain packets, such as RTP packets, in order to keep the capture file size lower.

On the Network Capture dialogue the SBC offers a "Filter(s)" text box. By default this textbox contains ".*" which tells the SBC to capture all packets. This textbox allows the use of standard tcpdump filter parameters.

For example on an SBC the RTP port range might be ports 10000 - 20000. The following filter will exclude packets to/from these ports and therefore not capture RTP packets:

Open

You can find the RTP port range on your SBC in the WebUI under Configuration -> IP Settings -> Media Interfaces.

Here are a few examples of capture filters:

• only captures packets to/from port 5060:

• captures only packets to/from ports 5060 to 5070:

• captures everything except packets to/from port 80:

• captures everything except packets to/from ports 10000 to 20000:

• It is also possible to combine filters. This filter captures everything except packets to/from ports 10000 to 20000 and port 80:

Further capture filters can be found on the tcpdump manpage.