Just adding this for future reference.
At the prompt type > tcpdump -s0 -i any -w capturefile.pcap
To stop the trace type CTRL-C
A couple of things to consider when doing the tcpdump is that the folder that you are writing the dump to has write access. There are quite a few folders on MSL that don't have write access. I usually do the dumps to /tmp as that is a safe bet.
As Ralph previously mentioned in his post about limiting the size of the file, if you need to have the logs running for a while, say a couple of days to capture a problem, then rotating the files through when they reach a limit is handy as then you don't need to trawl through an excessively large file to find what you are after, and if you need to email it, or transfer it over the net back to the office, etc, then the files zip down pretty well. I usually set a 20MB rotation, and then that zips down to a few meg to transfer.
Using the -C xxx as a switch sets the file size to rotate through. So "-C 20" would set a 20MB file rotation
Likewise, if you know you only want to capture SIP traffic, then you can also specify the port so that the capture only contains the information you need. This saves capturing other traffic like HTTP/S or SSH, etc that isn't relevant to what you are looking for, and only serves to increase the amount of garbage in the capture. If you specify "port 5060" then the tcpdump will only capture SIP traffic on port 5060.
