Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] QoS issue

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Tue, 11 Mar 2008 19:49:28 -0400
Lewis, Don wrote:
I am trying to use Wireshark to resolve a QoS issue. We have a polycom video conference camera on our site that is setting up a session with a remote polycom. Our ISP says they are not seeing any packets marked appropriately. Their evidence is NETFLOW reports collected from their edge router located on campus.

Should I be able to set up a remote span session (all Cisco hardware) and see the QoS in the packet�s Differentiated Services Field?

My monitor session look something like this:

Switch 1 (site with our Polycom)

Monitor sess 1 source inter fast x/x both

Monitor sess 1 dest remote vlan 400

Switch 2 (my office)

Monitor sess 1 source remote vlan 400

Monitor sess 1 dest inter fast x/x

I have been looking for a sample QoS trace just to see what it would look like but could not find one.


You should capture on the *egress* port from switch 1. Don't capture the whole vlan, just capture the polycom.

You can also capture it at your office as it leaves for the ISP.

There's no special config for QoS. It just uses 6 bits of the ToS field to come up with the DSCP code points.

I didn't think netflow collect DSCP code points, but I could be wrong.

Anyway, if you capture it, just make sure the polycom traffic's code points correct (correct == whatever is defined on the router to be treated as high priority traffic)

--

Thanks,
Hansang