Cisco ASA 5506-X Configuration Manual page 203

Chapter 8 Inspection for Voice and Video Protocols
Monitoring H.225 Sessions
The show h225 command displays information for H.225 sessions established across the ASA. Along
with the debug h323 h225 event, debug h323 h245 event, and show local-host commands, this
command is used for troubleshooting H.323 inspection engine issues.
If there is an abnormally large number of connections, check that the sessions are timing out based on
the default timeout values or the values set by you. If they are not, then there is a problem that needs to
be investigated.
The following is sample output from the show h225 command:
hostname# show h225
Total H.323 Calls: 1
1 Concurrent Call(s) for
0 Concurrent Call(s) for
This output indicates that there is currently 1 active H.323 call going through the ASA between the local
endpoint 10.130.56.3 and foreign host 172.30.254.203, and for these particular endpoints, there is 1
concurrent call between them, with a CRV for that call of 9861.
For the local endpoint 10.130.56.4 and foreign host 172.30.254.205, there are 0 concurrent calls. This
means that there is no active call between the endpoints even though the H.225 session still exists. This
could happen if, at the time of the show h225 command, the call has already ended but the H.225 session
has not yet been deleted. Alternately, it could mean that the two endpoints still have a TCP connection
opened between them because they set "maintainConnection" to TRUE, so the session is kept open until
they set it to FALSE again, or until the session times out based on the H.225 timeout value in your
configuration.
Monitoring H.245 Sessions
The show h245 command displays information for H.245 sessions established across the ASA by
endpoints using slow start. Slow start is when the two endpoints of a call open another TCP control
channel for H.245. Fast start is where the H.245 messages are exchanged as part of the H.225 messages
on the H.225 control channel.)
The following is sample output from the show h245 command:
hostname# show h245
Total: 1
1
There is currently one H.245 control session active across the ASA. The local endpoint is 10.130.56.3,
and we are expecting the next packet from this endpoint to have a TPKT header because the TPKT value
is 0. The TKTP header is a 4-byte header preceding each H.225/H.245 message. It gives the length of
the message, including the 4-byte header. The foreign host endpoint is 172.30.254.203, and we are
expecting the next packet from this endpoint to have a TPKT header because the TPKT value is 0.
Local: 10.130.56.3/1040
1. CRV 9861
Local: 10.130.56.3/1040
Local: 10.130.56.4/1050
LOCAL TPKT
10.130.56.3/1041
MEDIA: LCN 258 Foreign 172.30.254.203 RTP 49608 RTCP 49609
Local
MEDIA: LCN 259 Foreign 172.30.254.203 RTP 49606 RTCP 49607
Local
Foreign: 172.30.254.203/1720
Foreign: 172.30.254.203/1720
Foreign: 172.30.254.205/1720
FOREIGN TPKT
0 172.30.254.203/1245
10.130.56.3 RTP 49608 RTCP 49609
10.130.56.3 RTP 49606 RTCP 49607
Cisco ASA Series Firewall CLI Configuration Guide
H.323 Inspection
0
8-11