Filtering Ip Network Traces - AudioCodes Mediant 2000 User Manual

User's Manual
Parameter
Capture Type
[LoggingFilters_Ca
ptureType]

41.4.1 Filtering IP Network Traces

You can filter Syslog and debug recording messages for IP network traces, by setting the
'Filter Type' parameter to IP Trace in the Logging Filters table. IP traces are used to record
any IP stream that is not associated with media (RTP/RTCP), according to destination
and/or source IP address, or port and Layer-4 protocol (UDP, TCP or any other IP type as
defined by http://www.iana.com).
When the IP Trace option is selected, only the 'Value' parameter is applicable; the 'Syslog'
and 'Capture Type' parameters are not relevant. The 'Value' parameter configures the
Wireshark-like filtering expressions for your IP trace. The following Wireshark-like
expressions are supported:
Supported Wireshark-like Expressions for 'Value' Parameter
Expression
ip.src, ip.dst
ip.addr
ip.proto
udp, tcp, icmp, sip, ldap, http, https
udp.port, tcp.port
udp.srcport, tcp.srcport
udp.dstport, tcp.dstport
and, &&, ==, <, >
Below are examples of configured expressions for the 'Value' parameter:

udp && ip.addr==10.8.6.55

ip.src==10.8.6.55 && udp.port>=5000 and udp.port<6000

ip.dst==10.8.0.1/16

ip.addr==10.8.6.40
Version 6.6
Enables debug recordings for the defined logging filter and defines what to
record:

[0] None (default)

[1] Signaling = Information related to signaling such as SIP signaling
messages, Syslog, CDR, and the device's internal processing
messages.

[2] Signaling & Media = Signaling and media (RTP/RTCP/T.38).

[3] Signaling & Media & PCM = Signaling, media, and PCM (voice
signals from and to TDM).

[4] PSTN trace = ISDN and CAS traces - applicable only for Trunk-
related filters.
Source and destination IP address
IP address - up to two IP addresses can be entered
IP protocol type (PDU) entered as an enumeration value
(e.g., 1 is ICMP, 6 is TCP, 17 is UDP)
Single expressions for protocol type
Transport layer
Transport layer for source port
Transport layer for destination port
Between expressions
41. Syslog and Debug Recordings
Description
Description
483 Mediant 2000