AudioCodes Mediant 2600 - Filtering IP Network Traces

Version 6.8 509 Mediant 2600 E-SBC
User's Manual 39. Syslog and Debug Recordings
Parameter Description
Value
CLI: value
[LoggingFilters_Value]
Defines the value of the selected filtering type in the 'Filter Type'
parameter.
The value can be the following:
 A single value
 A range, using a hyphen "-" between the two values, e.g., "1-3"
 Multiple, non-contiguous values, using commas "," between
each value, e.g., "1,3,9"
 Any to indicate all
 For IP trace expressions, see ''Filtering IP Network Traces'' on
page 509
Syslog
CLI: syslog
[LoggingFilters_Syslog]
Enables Syslog messages for the defined logging filter:
 [0] Disable (default)
 [1] Enable
Note: This parameter is not applicable when 'Filter Type' is set to
IP Trace.
Capture Type
CLI: capture-type
[LoggingFilters_CaptureType]
Enables debug recordings for the defined logging filter and defines
what to record:
 [0] None (default)
 [1] Signaling = Information related to signaling such as SIP
signaling messages, Syslog, CDR, and the device's internal
processing messages.
 [2] Signaling & Media = Signaling and media (RTP/RTCP/T.38).
 [3] Signaling & Media & PCM = Signaling, media, and PCM
Note: This parameter is not applicable when 'Filter Type' is set to
IP Trace.
39.5.1 Filtering IP Network Traces
You can filter Syslog and debug recording messages for IP network traces, by setting the
'Filter Type' parameter to IP Trace in the Logging Filters table. IP traces are used to record
any IP stream, according to destination and/or source IP address, or port and Layer-4
protocol (UDP, TCP or any other IP type as defined by http://www.iana.com
). Network
traces are typically used to record HTTP.
When the IP Trace option is selected, only the ‘Value’ parameter is applicable; the 'Syslog'
and 'Capture Type' parameters are not relevant. The 'Value' parameter configures the
Wireshark-like filtering expressions for your IP trace. The following Wireshark-like
expressions are supported:
Table 39-6: Supported Wireshark-like Expressions for 'Value' Parameter
Expression Description
ip.src, ip.dst Source and destination IP address
ip.addr IP address - up to two IP addresses can be entered
ip.proto IP protocol type (PDU) entered as an enumeration value
(e.g., 1 is ICMP, 6 is TCP, 17 is UDP)
udp, tcp, icmp, sip, ldap, http, https Single expressions for protocol type
udp.port, tcp.port Transport layer