Wireshark抓包分析

1、 Polycom, Inc. All rights reserved. Carol.Z Polycom, Inc. All rights reserved.2Wireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例ALG故障案例 Polycom, Inc. All rights reserved.3 交換機(jī)鏡像(Mirror + Wireshark) 設(shè)備本身抓包(下載后，使用Wireshark進(jìn)行分析） RPAD抓包的方法 DMA抓包的方法 RPD抓包的方法 RMX抓包的方法 Po

2、lycom, Inc. All rights reserved.4Wireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例ALG故障案例 Polycom, Inc. All rights reserved.5 注意以下界面，一定要安裝WINCAP。 Polycom, Inc. All rights reserved.6Wireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例

3、ALG故障案例 Polycom, Inc. All rights reserved.7 Filter Polycom, Inc. All rights reserved.8 Important things first: Wireshark will not usually recognize any VoIP calls in a capture unless call signaling (H.225.0, H.245, SIP/SDP) is also included inthe capture. Captures which do not include call signaling

4、 will list RTP as UDP packets; H.245 as TCP packets only. Polycom, Inc. All rights reserved.9 分析RTP StreamWireshark considers all out-of-order packets as being lost.Wireshark will NOT consider late-arriving packets asbeing lost if the packets are still captured in order, nomatter how late those pack

5、ets arrive.Jitter calculations done by Wireshark should be ignored. Polycom, Inc. All rights reserved.10 分析TCP Stream Polycom, Inc. All rights reserved.11Wireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例ALG故障案例 Polycom, Inc. All rights reserved.12 Polycom, Inc. All

6、 rights reserved.13 H.225 Admission Polycom, Inc. All rights reserved.14 H.225 Connect Polycom, Inc. All rights reserved.15 H.245 OLC & OLC ACK Polycom, Inc. All rights reserved.16 H.460.18 (Signaling) H.460.19 (Media) Polycom, Inc. All rights reserved.17Wireshark的安裝云視頻Wireshark的使用How to read H.323

7、message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例ALG故障案例 Polycom, Inc. All rights reserved.18 TCP layer issue UDP layer issue ALG Polycom, Inc. All rights reserved.19 TCP三次握手 發(fā)起斷鏈 發(fā)起斷鏈 Polycom, Inc. All rights reserved.20 HDX systems transmit H.245 RoundTripDelayRequest every 30 seconds. An H.323 system is no

8、t required to transmit H.245 RoundTripDelayRequest It is mandatory that a system which received H.245 RoundTripDelayRequest acknowledge the request with H.245 RoundTripDelayResponse If HDX does not receive RoundTripDelayResponse, it will terminate the H.323 call Polycom, Inc. All rights reserved.21W

9、ireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案例ALG故障案例 Polycom, Inc. All rights reserved.22 接到反饋，MCU（103.10.87.227）呼出沈陽終端（61.161.147.105），每2小時(shí)有斷線故障。 13:41 MCU呼出沈陽終端。 15:53 沈陽終端發(fā)生斷線。 Polycom, Inc. All rights reserved.23 沈陽：可以看到13:41有端口號(hào)為10035以及10036兩個(gè)TCP握手。 Polycom

10、, Inc. All rights reserved.24 兩個(gè)小時(shí)候，MCU發(fā)出TCP KEEP ALIVE消息，總計(jì)發(fā)出了9次，但是每次都沒有收到終端返回的響應(yīng)。 所以MCU認(rèn)為TCP已經(jīng)斷鏈，呼叫被結(jié)束。 Polycom, Inc. All rights reserved.25Wireshark的安裝云視頻Wireshark的使用How to read H.323 message?網(wǎng)絡(luò)設(shè)備對(duì)我們的影響How to capture?斷線問題案列ALG故障案列 Polycom, Inc. All rights reserved.26Outside Firewall Configuration

11、 Implement a WAN (untrusted) and LAN (trusted) configuration Configure 1:1 NAT Set interface mode to NAT Disable H.323 and SIP ALG (Application Layer Gateway) Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup).Inside Firewall Configuration Implement a WAN (untrusted)

12、and LAN (trusted) configuration Disable H.323 and SIP ALG Set interface mode to Route Disable the port NAT. Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup). Polycom, Inc. All rights reserved.27完成部署后，H323與SIP外網(wǎng)注冊(cè)無問題。MCU呼叫外網(wǎng)終端（在某公司的內(nèi)網(wǎng)），MCU可以接收到呼叫，但是點(diǎn)擊應(yīng)答后無響應(yīng)，無法建立視頻流，振

13、鈴持續(xù)若干秒后斷線。外網(wǎng)終端（在某公司的內(nèi)網(wǎng)）呼叫MCU，提示無法連接。 Polycom, Inc. All rights reserved.28進(jìn)行了相關(guān)抓包， 以下是在外網(wǎng)RPD的抓包，咱們收到的從RPAD發(fā)過來的FACILITY里面帶的IP是202.106.51.251(路由器IP) Polycom, Inc. All rights reserved.29以下是RPD上的抓包，可以看到與網(wǎng)閘交互的ADMINCONFIRM完成后，沒有從RPD發(fā)生SETUP消息至內(nèi)網(wǎng)，說明與內(nèi)網(wǎng)反饋的ADMISSION CONFIRM返回來的IP地址TCP建立肯定有問題。 可以看到ADMISSION CONFIRM里面帶的IP地址是202.106.51.251，咱們已經(jīng)了解到這個(gè)IP地址是個(gè)路由器的IP，按照理解應(yīng)該是114.247.102.96（RPAD的外網(wǎng)NAT地址）才對(duì)，同場(chǎng)景1，也需要檢查客戶網(wǎng)絡(luò)設(shè)備哪里更改了。 Polycom, Inc. All rights reserved.30向客戶說明了我們的發(fā)現(xiàn)與我們懷疑網(wǎng)絡(luò)設(shè)備開啟了H.323 ALG功能?？蛻魴z查了防火墻上，發(fā)現(xiàn)有一