Content Comparison

Quick links

...

Setup Wireshark - Download

1. Download the appropriate installer for the Operating System in use

2. Run the installer

3. Leave defaults for Selected Components

4. Leave defaults for Additional Tasks

5. Install to C:\Program Files\Wireshark

6. Check the box to validate “Install Npcap…” is selected

7. Skip USB Capture and Click Install

Dumpcap script

1. Download the DumpcapSetup here

2. Extract the contents

3. Double click the “Install.bat” script

   1. You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use. 

   2. Click the “More info” link, then choose “Run anyway”

4. User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue

5. Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel

6. Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.

   1. Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter

   2. Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.

      Image Modified

   3. Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.

      Image Modified

7. Press Enter

8. Setup is now complete

9. Validate logs are capturing

   1. Navigate to Desktop\DumpCap\Captures

   2. Observe whether file(s) such as the following exist

      1. file_00001_20181101115841.pcap

      2. File size is only expected to increase once audio traffic to/from Sharpen commences

SIP Soft Phone - Rolling Capture

...

Setup Wireshark - Download

1. Download the appropriate installer for the Operating System in use

2. Run the installer

3. Leave defaults for Selected Components

4. Leave defaults for Additional Tasks

5. Install to C:\Program Files\Wireshark

6. Check the box to validate “Install Npcap…” is selected

7. Skip USB Capture and Click Install

SIP Soft-phone

1. Download your preferred soft-phone (MicroSIP or Zoiper recommended)

2. Install soft-phone

3. Navigate to https://app.sharpencx.com/admin/configuration/extensions/

4. Locate your extension and choose the edit button

5. Take note of your “username”, “password”, and “Server Address” fields. Leave this page up to copy paste from.

6. Register soft-phone with the noted information

   1. Zoiper setup

   2. MicroSIP setup

Dumpcap script

1. Download the DumpcapSetup here

2. Extract the contents

3. Double click the “Install.bat” script

   1. You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use. 

   2. Click the “More info” link, then choose “Run anyway”

4. User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue

5. Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel

6. Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.

   1. Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter

   2. Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.

      Image Modified

   3. Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
      

      Image Modified

7. Press Enter

8. Setup is now complete

9. Validate logs are capturing

   1. Navigate to Desktop\DumpCap\Captures

   2. Observe whether file(s) such as the following exist

      1. file_00001_20181101115841.pcap

      2. File size is only expected to increase once audio traffic to/from Sharpen commences

Retrieval, Analysis, and Removal

Once an event has been captured, the logs from the capture must be retrieved and sent to SharpenCare for analysis. Follow the steps below to gather and send the logs to Sharpen.

1. Navigate to the original extraction point of the DumpcapSetup.zip

2. Locate the “Uninstall.bat” file and double-click

3. User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue

4. Navigate to Desktop\DumpCap\Captures

5. Identify the proper capture associated with the incident

   1. Date and time can be interpreted by observing the file name

      1. file_00001_20181101115841.pcap

         1. Year, Month, Day, Hour, Minute, Second indicates start time of file Date Modified File Explorer column indicates the end time of the file

6. Copy the identified packet capture file

7. Upload the file to a cloud storage solution such as Google Drive, Onedrive, Dropbox, etc...

8. Provide public link to Sharpen in SharpenCare case

9. Sharpen will analyze the capture in conjunction with server-side captures to help reach root cause understanding.

Polycom Live Capture

This method is useful if you’re able to reproduce an issue on demand, and are using a polycom phone. This involves enabling an optional setting on the phone, and capturing the stream of the phone remotely via Wireshark.

Setup Polycom phone

1. Identify the IP address of your Polycom phone (Settings>Status>Network>TCP/IP Parameters)

2. In a web browser, enter https://x.x.x.x (eg.. https://10.0.5.68) to navigate to your web configuration for the phone

3. Depending on your browser, you will see a variation of a security warning. Choose to proceed to the web page

4. Authenticate using Admin as the user, and 6311 as the password

5. Navigate to Utilities > Import & Export Configuration

6. Import the pcap_on.cfg file from here (To disable capturing after work is complete, import the pcap_off.cfg file)

7. Reboot phone

Setup Wireshark - Download

1. Download the appropriate installer for the Operating System in use

2. Run the installer

3. Leave defaults for Selected Components

4. Leave defaults for Additional Tasks

5. Install to C:\Program Files\Wireshark

6. Check the box to validate “Install WinPcap…” is selected

7. Skip USB Capture and Click Install

Capture

1. Launch Wireshark

2. Navigate to Capture>Options

3. Choose “Manage Interfaces”

4. Select the “Remote Interfaces” tab

5. Click the “+” button

6. Enter the IP address of your Polycom phone

7. Enter 2002 in the Port: field

8. Choose the Password authentication radio button

9. Enter Polycom for the Username:

10. Enter the MAC address of the phone (without colons or spaces, all lowercase) for the Password:

11. Press OK

12. You may see 2 new interfaces. If this is the case, choose the one which has a collapsed sub-item which identifies as the phone’s IP address

13. Press Start

14. Reproduce issue

15. Press the Stop button at the top left of the interface

16. Choose File>Save As… to save the packet capture.

17. Send capture to SharpenCare