1、Wireshark抓包分析,Carol.Z,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?,斷線問題案例,ALG故障案例,交換機鏡像(Mirror + Wireshark) 設備本身抓包(下載后，使用Wireshark進行分析） RPAD抓包的方法 DMA抓包的方法 RPD抓包的方法 RMX抓包的方法,How to capture?,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影

2、響,How to capture?,斷線問題案例,ALG故障案例,Wireshark的安裝,注意以下界面，一定要安裝WINCAP。,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?,斷線問題案例,ALG故障案例,Wireshark的使用,Filter,Wireshark的使用,Important things first: Wireshark will not usually recognize any VoIP calls in a capture unless cal

3、l signaling (H.225.0, H.245, SIP/SDP) is also included inthe capture. Captures which do not include call signaling will list RTP as UDP packets; H.245 as TCP packets only.,Wireshark的使用,分析RTP Stream,Wireshark considers all out-of-order packets as being lost. Wireshark will NOT consider late-arriving

4、packets as being lost if the packets are still captured in order, nomatter how late those packets arrive. Jitter calculations done by Wireshark should be ignored.,Wireshark的使用,分析TCP Stream,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?,斷線問題案例,ALG故障案例,How to re

5、ad H.323 message?,How to read H.323 message?,H.225 Admission,How to read H.323 message?,H.225 Connect,How to read H.323 message?,H.245 OLC & OLC ACK,How to read H.323 message?,H.460.18 (Signaling) H.460.19 (Media),Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?

6、,斷線問題案例,ALG故障案例,網(wǎng)絡設備對我們的影響,TCP layer issue UDP layer issue ALG,TCP Basic,TCP三次握手 發(fā)起斷鏈 發(fā)起斷鏈,H.245 Round trip,HDX systems transmit H.245 RoundTripDelayRequest every 30 seconds. An H.323 system is not required to transmit H.245 RoundTripDelayRequest It is mandatory that a system which received H.245 Ro

7、undTripDelayRequest acknowledge the request with H.245 RoundTripDelayResponse If HDX does not receive RoundTripDelayResponse, it will terminate the H.323 call,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?,斷線問題案例,ALG故障案例,故障現(xiàn)象,接到反饋，MCU（103.10.87.227）呼出沈陽終端（61.1

8、61.147.105），每2小時有斷線故障。 13:41 MCU呼出沈陽終端。 15:53 沈陽終端發(fā)生斷線。,斷線問題！,TCP issue,沈陽：可以看到13:41有端口號為10035以及10036兩個TCP握手。,TCP issue,兩個小時候，MCU發(fā)出TCP KEEP ALIVE消息，總計發(fā)出了9次，但是每次都沒有收到終端返回的響應。,所以MCU認為TCP已經(jīng)斷鏈，呼叫被結(jié)束。,Wireshark的安裝,云視頻,目錄,Wireshark的使用,How to read H.323 message?,網(wǎng)絡設備對我們的影響,How to capture?,斷線問題案列,ALG故障案列,三件

9、套的部署,Outside Firewall Configuration Implement a WAN (untrusted) and LAN (trusted) configuration Configure 1:1 NAT Set interface mode to NAT Disable H.323 and SIP ALG (Application Layer Gateway) Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup).,Inside Firewall Config

10、uration Implement a WAN (untrusted) and LAN (trusted) configuration Disable H.323 and SIP ALG Set interface mode to Route Disable the port NAT. Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup).,故障現(xiàn)象,完成部署后，H323與SIP外網(wǎng)注冊無問題。 MCU呼叫外網(wǎng)終端（在某公司的內(nèi)網(wǎng)），MCU可以接收到呼叫，但是點擊應答后無響應，無法建

11、立視頻流，振鈴持續(xù)若干秒后斷線。 外網(wǎng)終端（在某公司的內(nèi)網(wǎng)）呼叫MCU，提示無法連接。,故障分析-場景1 使用MCU呼叫外網(wǎng)RPD,進行了相關抓包， 以下是在外網(wǎng)RPD的抓包，咱們收到的從RPAD發(fā)過來的FACILITY里面帶的IP是202.106.51.251(路由器IP),故障分析-場景2 從外網(wǎng)RPD呼叫內(nèi)網(wǎng),以下是RPD上的抓包，可以看到與網(wǎng)閘交互的ADMINCONFIRM完成后，沒有從RPD發(fā)生SETUP消息至內(nèi)網(wǎng)，說明與內(nèi)網(wǎng)反饋的ADMISSION CONFIRM返回來的IP地址TCP建立肯定有問題。 可以看到ADMISSION CONFIRM里面帶的IP地址是202.106.51.251，咱們已經(jīng)了解到這個IP地址是個路由器的IP，按照理解應該是114.247.102.96（RPAD的外網(wǎng)NAT地址）才對，同場景1，也需要檢查客戶網(wǎng)絡設備哪里更改了。,解決方法,向客戶說明了我們的發(fā)現(xiàn)與我們懷疑網(wǎng)絡設備開啟了H.323 ALG功能。 客戶檢查了防火墻上，發(fā)現(xiàn)有一些H