Best Practices for Getting a Packet Capture From Your Internal Network
Objective
Gather a packet capture on the internal network where your 8x8 phones and applications are deployed.
Applies To
- Wireshark Packet Captures
- Internal Switch(s)/Router(s)
- 8x8 hardphones
- Trouble-Shooting
Equipment and Software Needed
- Laptop (recommended) or PC
- 10/100/1000 Base-T Network Tap. (Needed only if switch or router does not support mirroring
- example: Dualcomm Model DCSW-1005PT
- Wireshark packet analyzer (Download here)
Disclaimer: 8x8 is not affiliated with Wireshark and does not endorse or or offer support for his product. Wireshark is an opensorce software with a vast knowledge base for assistance.
Procedure
Important:
Depending on you internal switch or routers make and model, please consult the original equipment manufacture for details on how to setup and capture packets. 8x8 cannot assist in this setup. This guide is generic in nature suggesting best practices.
In some instances for trouble-shooting issues like registration and time sync as examples, 8x8 will request packet captures of the device. The following are steps to provide those packet captures.
Before You Begin
It is best to understand if your network devices have port mirroring capability. Port mirroring is a means to allow a target phone to be monitored by a laptop running Wireshark.
- Scenario One: Port mirroring on your network Switch. The below example shows what a port mirror would look like. The example shows ports 1 and 2, these can be any port. Another example is the phone may be on port 11 and the laptop to be used is on port 24. 24 will be established to mirror port 11.
- Scenario Two: Using a network tap. A network tap offers a quick means to gather packet captures without disrupting all users on a given switch or router. The example below shows how a TAP would sit on a network.
- Scenario Three: Using a HUB. Hubs are pretty much obsolete, if you have a HUB that is Full Duplex 10/100 these will work exactly like a network tap. Establish the HUB in the same way as a network tap.
Warning on HUBS:
HUBS are generally half duplex and 10mb while Some are 10/100 full duplex the use of HUBS is not recommenced. HUBS are only mentioned as the chance of having a 10/100 full duplex.
- Scenario Four: Egress and ingress at the edge. Occasionally packet captures are needed at your Firewall. 8x8 will request both egress and ingress. Capturing both internal and external traffic can be accomplished on most firewalls such as Sonicwall, Cisco, Palo Alto, and others. You will need to consult your original equipment manufacturer on how this is completed with your edge device.