On the PBXWare machine, live or connected via an SSH console:

Simply run this command:

tcpdump -i eth0 -n -s 0 port 5060 -vvv -w /home/capture_file_name.pcap 

By specifying port 5060 only the SIP exchanges will be captured, but not the RTP (audio) exchanges

To capture everything:

tcpdump -i eth0 -n -s 0 -vvv -w /home/capture_file_name.pcap

-i = interface on which you want to capture, eth0, eth1, eth2, etc.
-n = Do not convert IP addresses into names, prevents DNS lookups.
-s = How many bytes of data to capture from each packet, zero means use the length required to capture whole packets.
port = Which port to listen on, 5060 is the default port for SIP.
-vvv = Verbose, this will give you as much detail as possible.
-w = Write to a file to be analyzed later.

To perform an infinite packet capture without saturating the PBXWare server disk space:

tcpdump -i eth0 -n -s 0 -vvv -w /home/capture_file_name.pcap -W20 -C50

-W20 (Indicates the number of files to keep in retention, here 20)
-C50 (Indicates to split the capture files every 50 MB)
in this example we will therefore have 20x50MB = 1GB of files in retention.
Once it reaches 20×50 files, on the next capture file it will delete the oldest file and thus creates a loop.

In order to run the command in the background with the ability to close the console without stopping the capture:

nohup tcpdump -i eth0 -n -s 0 -vvv -w /home/capture_file_name.pcap -W20 -C50

Second solution:

Type this command:

/opt/pbxware/sh/sngrep

or to capture only calls

/opt/pbxware/sh/sngrep -c

or to capture only calls including the capture of RTP packets (audio)

/opt/pbxware/sh/sngrep -c -r

A table is displayed with the ongoing SIP traffic, including calls.

In order to analyze the packet captures, please consult our dedicated tutorial.