Logging H.248 Messages
You can use the traceoptions feature to log H.248 messages exchanged between a virtual BGF and its associated gateway controller. These messages can include all transactions, transaction replies, and transaction acknowledgements, depending on the specified trace level. Corrupted messages, messages with invalid syntax, and messages that fail interim AH validation can also be logged. The captured data includes both the raw H.248 message (as it appears on the wire) and associated metadata.
The captured data is stored by default in the pgcpd file in
the /var/log directory. In addition
to H.248 messages, this file contains all other BGF operations that
you have chosen to trace. To make it easier to find H.248 messages
in the file, there is a BEGIN field and an END field, each with a
matching sequence number.
When you enable logging of H.248 messages, the software logs messages for all virtual BGFs on the router. To determine which virtual BGF exchanged the message, use the 5-tuple field in the H.248 message.
This topic covers:
Fields in the H.248 Messages
Each H.248 message contains the following fields:
TRACE_TIMESTAMP [BEGIN #SEQNUM TIMESTAMP 5-TUPLE DIRECTION MSG_SIZE] MegacoMessage [END #SEQNUM]
The following is a sample ServiceChange message:
Oct 10 09:32:28
[BEGIN #778 Oct 10 09:32:28 UDP:10.50.40.100:2944->172.16.1.1:2944 TX 168]
AU=0x00000000:0x00000000:0x000000000000000000000000
!/1 [10.50.40.100]:2944
T=1{
C=-{
SC=ROOT{
SV{MT=RS,RE="901",AD=2944,PF=JNPR_PGCP/1,V=3,20071010T09322800}}}}
[END #778]Table 1 describes the fields in H.248 messages.
Table 1: Description of Fields in H.248 Messages
Field | Description |
|---|---|
TRACE_TIMESTAMP | Time the messaged was captured. The timestamp is in the HH:MM:SS.mmmmmm format. |
BEGIN | Constant string BEGIN that indicates the beginning of a message. |
#SEQNUM | Sequential number of the message used to correlate the BEGIN header with the END footer. |
TIMESTAMP | Date and time of the message. Time is displayed in the HH:MM:SS.mmmmmm format. |
5-TUPLE | UDP or TCP packet’s 5-tuple (transport protocol, source address and port, destination address and port). Used to identify the virtual BGF and the gateway controller that exchanged the message. |
DIRECTION | Direction message was sent from the virtual BGF:
|
MSG_SIZE | Size of message, in bytes, excluding transport protocol (UDP/TCP/IP) overhead. |
MegacoMessage | Captured data including the interim authentication header (if any). |
END | Constant string END that indicates the end of a captured message. |
Messages That Exceed Output Buffer Limit
The trace file has a limit on the size of a single output buffer. Messages longer than this limit are divided into several trace buffers. Messages divided into buffers use the following template:
TRACE_TIMESTAMP [BEGIN #SEQNUM TIMESTAMP 5-TUPLE DIRECTION MSG_SIZE] MegacoMessage (1st part) TRACE_TIMESTAMP (--- contd ---) MegacoMessage (2nd part) ... TRACE_TIMESTAMP (--- contd ---) MegacoMessage (n'th part) [END #SEQNUM]
The following is an example of a divided message:
Oct 10 09:32:56
[BEGIN #779 Oct 10 09:32:56 UDP:22.0.0.6:2944->10.50.40.100:2944 RX 436]
AU=0x00000000:0x00000000:0x000000000000000000000000
MEGACO/3 [22.0.0.6]:2944
Transaction = 12567418{
Context = 65323 {
Modify=ip/4/vif-0/3 {
Media{
Stream=1{
LocalControl{Mode=SR,DS/DSCP=00,TMAN/POL=on}}}},
Modify=ip/4/vif-0/3 {
Media{
Stream=1{
Oct 10 14:13:19 (--- contd ---)
LocalControl{Mode=SR,DS/DSCP=00,TMAN/POL=on}}}}}}
[END #779]
