Wireshark抓包分析.ppt

Polycom,Inc.Allrightsreserved.1Wireshark抓包分析抓包分析Polycom,Inc.Allrightsreserved.2Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.3交换机镜像(Mirror+Wireshark)设备本身抓包(下载后，使用Wireshark进行分析）RPAD抓包的方法DMA抓包的方法RPD抓包的方法RMX抓包的方法How to capture?Polycom,Inc.Allrightsreserved.4Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.5Wireshark的安装的安装注意以下界面，一定要安装WINCAP。Polycom,Inc.Allrightsreserved.6Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.7Wireshark的使用的使用FilterPolycom,Inc.Allrightsreserved.8Wireshark的使用的使用Importantthingsfirst:WiresharkwillnotusuallyrecognizeanyVoIPcallsinacaptureunlesscallsignaling(H.225.0,H.245,SIP/SDP)isalsoincludedinthecapture.CaptureswhichdonotincludecallsignalingwilllistRTPasUDPpackets;H.245asTCPpacketsonly.Polycom,Inc.Allrightsreserved.9Wireshark的使用的使用分析RTPStreamWiresharkconsidersallout-of-orderpacketsasbeinglost.WiresharkwillNOTconsiderlate-arrivingpacketsasbeinglostifthepacketsarestillcapturedinorder,nomatterhowlatethosepacketsarrive.JittercalculationsdonebyWiresharkshouldbeignored.Polycom,Inc.Allrightsreserved.10Wireshark的使用的使用分析TCPStreamPolycom,Inc.Allrightsreserved.11Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.12How to read H.323 message?Polycom,Inc.Allrightsreserved.13How to read H.323 message?H.225AdmissionPolycom,Inc.Allrightsreserved.14How to read H.323 message?H.225ConnectPolycom,Inc.Allrightsreserved.15How to read H.323 message?H.245OLC&OLCACKPolycom,Inc.Allrightsreserved.16How to read H.323 message?H.460.18(Signaling)H.460.19(Media)Polycom,Inc.Allrightsreserved.17Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.18网络设备对我们的影响网络设备对我们的影响TCPlayerissueUDPlayerissueALGPolycom,Inc.Allrightsreserved.19TCP BasicTCP三次握手发起断链发起断链Polycom,Inc.Allrightsreserved.20H.245 Round tripHDXsystemstransmitH.245RoundTripDelayRequestevery30seconds.AnH.323systemisnotrequiredtotransmitH.245RoundTripDelayRequestItismandatorythatasystemwhichreceivedH.245RoundTripDelayRequestacknowledgetherequestwithH.245RoundTripDelayResponseIfHDXdoesnotreceiveRoundTripDelayResponse,itwillterminatetheH.323callPolycom,Inc.Allrightsreserved.21Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案例ALG故障案例Polycom,Inc.Allrightsreserved.22故障现象故障现象接到反馈，MCU（103.10.87.227）呼出沈阳终端（61.161.147.105），每2小时有断线故障。13:41MCU呼出沈阳终端。15:53沈阳终端发生断线。断线问题！断线问题！Polycom,Inc.Allrightsreserved.23TCP issue沈阳：可以看到13:41有端口号为10035以及10036两个TCP握手。Polycom,Inc.Allrightsreserved.24TCP issue两个小时候，MCU发出TCPKEEPALIVE消息，总计发出了9次，但是每次都没有收到终端返回的响应。所以MCU认为TCP已经断链，呼叫被结束。Polycom,Inc.Allrightsreserved.25Wireshark的安装云视频目录目录Wireshark的使用How to read H.323 message?网络设备对我们的影响How to capture?断线问题案列ALG故障案列Polycom,Inc.Allrightsreserved.26三件套的部署三件套的部署Outside Firewall Configuration ImplementaWAN(untrusted)andLAN(trusted)configuration Configure1:1NAT SetinterfacemodetoNAT DisableH.323andSIPALG(ApplicationLayerGateway)DisableanyH.323helperservicesonthefirewall(forexample,CiscoH.323Fixup).Inside Firewall Configuration ImplementaWAN(untrusted)andLAN(trusted)configuration DisableH.323andSIPALGSetinterfacemodetoRouteDisabletheportNAT.DisableanyH.323helperservicesonthefirewall(forexample,CiscoH.323Fixup).Polycom,Inc.Allrightsreserved.27故障现象故障现象完成部署后，H323与SIP外网注册无问题。MCU呼叫外网终端（在某公司的内网），MCU可以接收到呼叫，但是点击应答后无响应，无法建立视频流，振铃持续若干秒后断线。外网终端（在某公司的内网）呼叫MCU，提示无法连接。Polycom,Inc.Allrightsreserved.28故障分析故障分析-场景场景1 使用使用MCU呼叫外网呼叫外网RPD进行了相关抓包，以下是在外网RPD的抓包，咱们收到的从RPAD发过来的FACILITY里面带的IP是202.106.51.251(路由器IP)Polycom,Inc.Allrightsreserved.29故障分析故障分析-场景场景2 从外网从外网RPD呼叫内网呼叫内网以下是RPD上的抓包，可以看到与网闸交互的ADMINCONFIRM完成后，没有从RPD发生SETUP消息至内网，说明与内网反馈的ADMISSIONCONFIRM返回来的IP地址TCP建立肯定有问题。可以看到ADMISSIONCONFIRM里面带的IP地址是202.106.51.251，咱们已经了解到这个IP地址是个路由器的IP，按照理解应该是114.247.102.96（RPAD的外网NAT地址）才对，同场景1，也需要检查客户网络设备哪里更改了。Polycom,Inc.Allrightsreserved.30解决方法解决方法向客户说明了我们的发现与我们怀疑网络设备开启了H.323ALG功能。客户检查了防火墙上，发现有一些H323的选项是打开的，但是担心风险，客户没有进行取消向客户说明了先检查做NAT的网络设备是否打开了H.323ALG，客户与CISCO厂家沟通后，在CISCO3945路由器上对给RPAD的NAT配置后面加了no-payload参数，配置完成后，呼叫正常。与客户沟通了，如果加上no-payload参数，路由器就不会对包进行检测与修改。Polycom,Inc.Allrightsreserved.31ThankYou!