...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| title | Table of Contents |
|---|
...
| Table of Contents | ||||||||
|---|---|---|---|---|---|---|---|---|
|
Introduction
Setting up a packet capture may be necessary in times of troubleshooting IP phone connectivity or call quality issues. This guide describes how to remotely or locally setup a packet capture using the commonly known Wireshark tool, or it’s subcomponent, Dumpcap.
...
Wireshark is a commonly used tool to capture inbound and outbound traffic from a designated network interface. The captured data is then used to provide historical troubleshooting material for the SharpenCare team. The tool is distributed in an open source model, free of charge.
...
Dumpcap is a CLI subtool of the commonly used
Wireshark packet analysis tool which can be run without launching the full Wireshark user interface. It captures traffic specified by predefined capture filters on a user defined network interface. We use dumpcap for its minimal resource utilization and automation capabilities. Your users will be able to set it up once and go about their job without disruption. You’ll see the application running as “dumpcap.exe” in Windows Task Manager following successful setup.
What should I expect?
Using Wireshark
Wireshark comes with a visual interface meant to capture and analyze the data in real time. The capture can be viewed live or saved for archival. Data will only be captured while the application is running, and after capturing has been manually initiated on the defined capture interface. Data can be filtered at the time of capture, so data shared with the SharpenCare team contains only necessary data. Wireshark capture filters are clearly documented here.
This method is best used for events which are reproducible on demand.
...
What is Dumpcap?
Dumpcap runs in the background and does not disrupt the user experience. is a CLI sub-component of Wireshark, which can be run without launching the full Wireshark user interface. It captures traffic specified by predefined capture filters on a user defined network interface. We use Dumpcap for its minimal resource utilization and automation capabilities. Utilizing a simple batch script, a Windows scheduled task is configured to initiate dumpcap.exe with our specified capture filter. Once set up, users can continue without disruption and you’ll be gathering the information we need. You’ll see the application running as “dumpcap.exe” in Windows Task Manager following successful setup.
Once the necessary data has been captured, the process can be removed via the uninstall script. Logs can then be gathered and sent to the SharpenCare team. Like Wireshark, capture filters are configurable. By default, our dumpcap script captures only traffic sent or received to/from the Sharpen network and Google STUN resources.
This method is best used for incidents which are not easy to predict. You can setup the logging, wait for the issue to happen and then gather the logs. Log files are stored with date/time references to allow for historical use. The script is configured to retain the last 50 files of ~90 MB each. Once the 50th file is written, it replaces the 1st with what would be the 51st. This allows for reasonable history of events, but not so much which will exhaust storage.
Prerequisites
Windows Desktop | A Windows desktop with administrator privileges is necessary for the setup and install of Wireshark. In addition, the Dumpcap script, leveraging Windows task scheduler, requires administrator privileges to execute. |
Wireshark | Wireshark provides the mechanism for capturing pcap data. |
Dumpcap Script | Capture script configured to gather Sharpen traffic from the client workstation. |
Sharpen Q phone | Included as part of Sharpen Q, the webRTC-based soft-phone client built into Sharpen Q will be necessary if we’re tracking down audio issues within Sharpen Q. |
SIP soft-phone | SIP soft-phone is necessary |
...
if you’re looking to troubleshoot audio quality issues. This allows for RTP to be captured in an unencrypted manner, giving us clear insight into the performance of the call from the client perspective. | |
Polycom Phone | Supported phone for live capturing via steps provided. Yealink phones have an alternate capture method referenced here. |
...
Setup
Sharpen Q Phone - Rolling Capture
This method is useful for most capture scenarios. It involves setting up Wireshark, installing and configuring a soft-phone (optional), setting up the dumpcap script, and capturing the issue.
| Infonote |
|---|
Please note, due to encrypted RTP present in webRTC traffic, this guide is NOT applicable to the information gathered will not allow us to diagnose audio quality issue with Sharpen Q phone if we’re looking to assess audio quality. For call quality concerns related to Sharpen Q phone, please refer to the webRTC-internals guide. Signaling and general RTP availability concerns through troubleshooting efforts for Sharpen Q Phone can still benefit from gathering this guideinformation. |
Setup Wireshark - Download
Download the appropriate installer for the Operating System in use
Run the installer
Leave defaults for Selected Components
Leave defaults for Additional Tasks
Install to C:\Program Files\Wireshark
Check the box to validate “Install WinPcap…” Npcap…” is selected
Skip USB Capture and Click Install
Dumpcap script
Download the DumpcapSetup here
Extract the contents
Double click the “Install.bat” script
You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use.
Click the “More info” link, then choose “Run anyway”
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel
Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.
Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter
Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.
Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
Press Enter
Setup is now complete
Validate logs are capturing
Navigate to Desktop\DumpCap\Captures
Observe whether file(s) such as the following exist
file_00001_20181101115841.pcap
File size is only expected to increase once audio traffic to/from Sharpen commences
SIP Soft
...
Phone - Rolling Capture
This method is useful for scenarios where we’re trying to assess call quality concerns. It involves setting up Wireshark, installing and configuring a soft-phone, setting up the dumpcap script, and capturing the issue.
Setup Wireshark - Download
Download the appropriate installer for the Operating System in use
Run the installer
Leave defaults for Selected Components
Leave defaults for Additional Tasks
Install to C:\Program Files\Wireshark
Check the box to validate “Install Npcap…” is selected
Skip USB Capture and Click Install
SIP Soft-phone
Download your preferred soft-phone (MicroSIP or Zoiper recommended)
Install soft-phone
Navigate to https://app.sharpencx.com/admin/configuration/extensions/
Locate your extension and choose the edit button
Take note of your “username”, “password”, and “Server Address” fields. Leave this page up to copy paste from.
Register soft-phone with the noted information
Dumpcap script
Download the DumpcapSetup here
Extract the contents
Double click the “Install.bat” script
You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use.
Click the “More info” link, then choose “Run anyway”
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel
Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.
Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter
Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.
Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
Press Enter
Setup is now complete
Validate logs are capturing
Navigate to Desktop\DumpCap\Captures
Observe whether file(s) such as the following exist
file_00001_20181101115841.pcap
File size is only expected to increase once audio traffic to/from Sharpen commences
...
Navigate to the original extraction point of the DumpcapSetup.zip
Locate the “Uninstall.bat” file and double-click
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Navigate to Desktop\DumpCap\Captures
Identify the proper capture associated with the incident
Date and time can be interpreted by observing the file name
file_00001_20181101115841.pcap
Year, Month, Day, Hour, Minute, Second indicates start time of file Date Modified File Explorer column indicates the end time of the file
Copy the identified packet capture file
Upload the file to a cloud storage solution such as Google Drive, Onedrive, Dropbox, etc...
Provide public link to Sharpen in SharpenCare case
Sharpen will analyze the capture in conjunction with server-side captures to help reach root cause understanding.
...
Identify the IP address of your Polycom phone (Settings>Status>Network>TCP/IP Parameters)
In a web browser, enter https://x.x.x.x (eg.. https://10.0.5.68) to navigate to your web configuration for the phone
Depending on your browser, you will see a variation of a security warning. Choose to proceed to the web page
Authenticate using Admin as the user, and 6311 as the password
Navigate to Utilities > Import & Export Configuration
Import the pcap_on.cfg file from here (To disable capturing after work is complete, import the pcap_off.cfg file)
Reboot phone
Setup Wireshark - Download
Download the appropriate installer for the Operating System in use
Run the installer
Leave defaults for Selected Components
Leave defaults for Additional Tasks
Install to C:\Program Files\Wireshark
Check the box to validate “Install WinPcap…” is selected
Skip USB Capture and Click Install
...