Cisco CUCM Troubleshooting with CUCM Packet Capture

Today I had to troubleshoot a Cisco Unified Communications Manager 7.1.3 and the system logs didn't reveal the core of the problem. Next step would have been to place a Wireshark box somewhere in between the flow. But in this case that was not an option. So I remembered an article I had read here:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a0080b36101.shtml
Should have solved my problem. Well it would, if it had worked. Whilst blaming Cisco for their faulty documentation I searched a little bit further and found a guide for the same topic regarding CUPS:
 http://docwiki.cisco.com/wiki/Cisco_Unified_Presence,_Release_7.x_--_utils_network_capture_eth0_CLI_Command
The solution was to mix both documents to a working solution. So, lets see how it works:
We want to capture max 5000 Packets with max packet size of 1500 bytes from phone 172.20.23.222 to our CUCM. So we enter this in CUCM:

admin:utils network capture eth0 numeric file test count 5000 size 1500 host ip 172.20.23.222

Warning: existing test.cap was renamed test_7.cap

Executing command with options:

 size=1500               count=5000              interface=eth0

 src=                    dest=                   port=

 ip=172.20.23.222

Control-C pressed

The warning is because of my previous failed attemts. I always entered the same line with test.cap as destination file. CUCM recognizes the existence of the file and renames it automatically to an appropriate syntax. After testing the function / provocating the problem I finished the capture via ctrl+c. Now lets verify if the file is where we expect it:

admin:file list  activelog platform/cli/ detail

09 Aug,2011 01:59:35        6,336  test.cap

09 Aug,2011 01:18:49      111,488  test_1.cap

09 Aug,2011 01:41:16       12,482  test_2.cap

09 Aug,2011 01:42:45       37,540  test_3.cap

09 Aug,2011 01:43:23        6,062  test_4.cap

09 Aug,2011 01:47:14        6,348  test_5.cap

09 Aug,2011 01:53:11        4,688  test_6.cap

09 Aug,2011 01:59:09        7,338  test_7.cap

dir count = 0, file count = 8

Looks fine. So lets download the capturefile for further analysis. You need to setup a SFTP server on your laptop / pc and copy it to there. Btw. I had some problems with CoreFTP. Each try resulted in an "Invalid download directory specified" error. So I switched to FreeSSHd which worked fine:

admin:file get activelog platform/cli/test_7.cap

Please wait while the system is gathering files info ...done.

Sub-directories were not traversed.

Number of files affected: 1

Total size in Bytes: 7338

Total size in Kbytes: 7.1660156

Would you like to proceed [y/n]? y

SFTP server IP: 172.20.23.82

SFTP server port [22]:

User ID: cisco

Password: *****

Download directory: /

.

Transfer completed.

admin:

You can find other options in the links above (src / dst / port / etc. filtering).
Well thats it. Easy if you know how ...

Cisco CUCM IP Phone Services with CUCM 7 & 8

If you had your Cisco IP phones registered to a CUCM 8.x system and you go back to a 7.x system, you should remember to downgrade the firmware to an appropiate one for 7.x. Otherwise chances are good to end up in problems when trying to access the IP phone services of the CUCM 7.x system.

Problem seems to be that CUCM 7.x tries to address the services via an URL like:
http://172.20.23.210:8080/ccmcip/getservicesmenu.jsp

The phones with the phone load for CUCM 8.x still tries to access the services via:
https://172.20.23.210:8443/ccmcip/getservicesmenu.jsp

So, the only thing you will see, while trying to open the corporate directory, is a "Requesting..." which finaly will end in a "Host not found" message. A factory reset would be the easiest way to go back to the right phone load. Just keep that in mind ....