Did you think I was done busting caps after that last post? Really? You must not have know that I’m an O.G.
Sometimes it’s not enough to be busting caps on the IP encapsulated stuff. Sometimes you need to pull a PCM trace from the router or VG224.
Cisco makes it easy for you if you’re using an ISR G2 router – or a VG350, but if you have to do it on a VG224 – it’s not so straight-forward. The commands to get the PCM.dat file are really no big deal. Capturing on port 2/0 looks like this:
voice hpi capture destination flash:pcm.dat
voice hpi capture buffer 5000000
test voice port 2/0 pcm-dump caplog 7
test voice port 2/0 pcm-dump disable
Directory of slot0:/
1 -rw- 21237908 Feb 28 2002 19:06:04 -05:00 vg224-i6s-mz.124-22.T5.bin
2 -rw- 28900564 Feb 28 2002 19:22:52 -05:00 vg224-i6k9s-mz.151-4.M6.bin
3 -rw- 4954752 Aug 2 1993 12:31:10 -05:00 pcm.dat
64012288 bytes total (8912896 bytes free)
copy pcm.dat tftp
Address or name of remote host ? 10.98.1.198
Destination filename [pcm.dat]?
4954752 bytes copied in 43.960 secs (112710 bytes/sec)
The tricky part is that you need to decode this file to listen to it, and it’s a cisco-only “Packet Capture Extraction Tool” that TAC uses to do this. Fuckers.
If anybody out there reading this can help an O.G. figure out how to do this on your own – please hit me up with a comment!