How to capture a SIP trace with Cisco CUBE
Cisco CUBE (Unified Border Element) exposes SIP messaging via IOS `debug ccsip` commands. You can stream the trace to the terminal monitor or buffer it to memory, then copy off the box and feed it to SIP Flow as text — or pull a built-in IOS packet capture.
When to reach for this
- You're troubleshooting a CUBE-fronted SIP trunk (most enterprise PSTN)
- You need carrier-side ↔ enterprise-side leg correlation
- You can't (or don't want to) install third-party tools on the router
Before you start
- Privileged EXEC (`enable`) access on the CUBE
- Enough free DRAM for a logging buffer (2-10 MB is plenty for a few calls)
- For the embedded packet capture path, IOS XE 3.7+ on a supported platform
Steps
- 1
Size and arm the logging buffer
Don't `terminal monitor` debugs into your SSH session on a production CUBE — they'll trash the line. Buffer instead.
conf t logging buffered 10000000 debugging no logging console end clear logging - 2
Enable SIP message debugging
`debug ccsip messages` is the single most useful CUBE debug — it dumps every inbound and outbound SIP message in full.
debug ccsip messages - 3
Reproduce the call
Place (or wait for) the failing call. Keep the test window short — CUBE logging buffer is finite and FIFO.
- 4
Pull the buffer off the box
Either `show logging | redirect tftp:` it off, or just paste the relevant section. SIP Flow parses the raw `debug ccsip` output directly.
show logging | redirect bootflash:cube-sip.txt - 5
Or run an embedded packet capture
IOS XE EPC writes a real pcap to flash — useful when you also want RTP. Replace `Gi0/0/1` with your service interface.
monitor capture CAP interface GigabitEthernet0/0/1 both monitor capture CAP match ipv4 any any monitor capture CAP buffer size 10 monitor capture CAP start ! ... reproduce the call ... monitor capture CAP stop monitor capture CAP export bootflash:cube.pcap - 6
Disable debugs (always)
Forgetting to turn off `debug ccsip messages` on a busy CUBE can take down the box. Always end with `undebug all`.
undebug all
Tips from people who've done this 1,000 times
- Use `debug ccsip messages | exclude OPTIONS` to drop keepalives from the noise
- `show call active voice brief` correlates SIP Call-ID to the CUBE call leg ID
- For TDM-side issues, also enable `debug voip ccapi inout`
Pitfalls
- Running debug with `terminal monitor` on the console can crash older ISR/CUBE platforms under load
- The buffer is shared across all `debug` output — bigger isn't always better; 10 MB is a safe ceiling
- EPC capture has per-platform packet rate limits; on heavy SIP trunks consider mirroring to an external sniffer instead
Got the trace? Render the ladder.
Drop your Cisco CUBE export into SIP Flow and we'll render the call flow, surface RFC issues, and (optionally) ask Gemini to explain what went wrong — all client-side by default.
Open analyzer