Wireshark抓包分析PPT学习课件

1、Wireshark抓包分析,Carol.Z,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?,断线问题案例,ALG故障案例,交换机镜像(Mirror + Wireshark) 设备本身抓包(下载后，使用Wireshark进行分析） RPAD抓包的方法 DMA抓包的方法 RPD抓包的方法 RMX抓包的方法,How to capture?,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影

2、响,How to capture?,断线问题案例,ALG故障案例,Wireshark的安装,注意以下界面，一定要安装WINCAP。,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?,断线问题案例,ALG故障案例,Wireshark的使用,Filter,Wireshark的使用,Important things first: Wireshark will not usually recognize any VoIP calls in a capture unless cal

3、l signaling (H.225.0, H.245, SIP/SDP) is also included inthe capture. Captures which do not include call signaling will list RTP as UDP packets; H.245 as TCP packets only.,Wireshark的使用,分析RTP Stream,Wireshark considers all out-of-order packets as being lost. Wireshark will NOT consider late-arriving

4、packets as being lost if the packets are still captured in order, nomatter how late those packets arrive. Jitter calculations done by Wireshark should be ignored.,Wireshark的使用,分析TCP Stream,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?,断线问题案例,ALG故障案例,How to re

5、ad H.323 message?,How to read H.323 message?,H.225 Admission,How to read H.323 message?,H.225 Connect,How to read H.323 message?,H.245 OLC & OLC ACK,How to read H.323 message?,H.460.18 (Signaling) H.460.19 (Media),Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?

6、,断线问题案例,ALG故障案例,网络设备对我们的影响,TCP layer issue UDP layer issue ALG,TCP Basic,TCP三次握手 发起断链 发起断链,H.245 Round trip,HDX systems transmit H.245 RoundTripDelayRequest every 30 seconds. An H.323 system is not required to transmit H.245 RoundTripDelayRequest It is mandatory that a system which received H.245 Ro

7、undTripDelayRequest acknowledge the request with H.245 RoundTripDelayResponse If HDX does not receive RoundTripDelayResponse, it will terminate the H.323 call,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?,断线问题案例,ALG故障案例,故障现象,接到反馈，MCU（103.10.87.227）呼出沈阳终端（61.1

8、61.147.105），每2小时有断线故障。 13:41 MCU呼出沈阳终端。 15:53 沈阳终端发生断线。,断线问题！,TCP issue,沈阳：可以看到13:41有端口号为10035以及10036两个TCP握手。,TCP issue,两个小时候，MCU发出TCP KEEP ALIVE消息，总计发出了9次，但是每次都没有收到终端返回的响应。,所以MCU认为TCP已经断链，呼叫被结束。,Wireshark的安装,云视频,目录,Wireshark的使用,How to read H.323 message?,网络设备对我们的影响,How to capture?,断线问题案列,ALG故障案列,三件

9、套的部署,Outside Firewall Configuration Implement a WAN (untrusted) and LAN (trusted) configuration Configure 1:1 NAT Set interface mode to NAT Disable H.323 and SIP ALG (Application Layer Gateway) Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup).,Inside Firewall Config

10、uration Implement a WAN (untrusted) and LAN (trusted) configuration Disable H.323 and SIP ALG Set interface mode to Route Disable the port NAT. Disable any H.323 helper services on the firewall (for example, Cisco H.323 Fixup).,故障现象,完成部署后，H323与SIP外网注册无问题。 MCU呼叫外网终端（在某公司的内网），MCU可以接收到呼叫，但是点击应答后无响应，无法建

11、立视频流，振铃持续若干秒后断线。 外网终端（在某公司的内网）呼叫MCU，提示无法连接。,故障分析-场景1 使用MCU呼叫外网RPD,进行了相关抓包， 以下是在外网RPD的抓包，咱们收到的从RPAD发过来的FACILITY里面带的IP是202.106.51.251(路由器IP),故障分析-场景2 从外网RPD呼叫内网,以下是RPD上的抓包，可以看到与网闸交互的ADMINCONFIRM完成后，没有从RPD发生SETUP消息至内网，说明与内网反馈的ADMISSION CONFIRM返回来的IP地址TCP建立肯定有问题。 可以看到ADMISSION CONFIRM里面带的IP地址是202.106.51.251，咱们已经了解到这个IP地址是个路由器的IP，按照理解应该是114.247.102.96（RPAD的外网NAT地址）才对，同场景1，也需要检查客户网络设备哪里更改了。,解决方法,向客户说明了我们的发现与我们怀疑网络设备开启了H.323 ALG功能。 客户检查了防火墙上，发现有一些H