Introduction
Setting up a packet capture may be necessary in times of troubleshooting IP phone connectivity or call quality issues. This guide describes how to remotely or locally setup a packet capture using the commonly known Wireshark tool, or it’s subcomponent, Dumpcap.
Please note, due to encrypted RTP present in webRTC traffic, this guide is NOT applicable to Sharpen Q phone if we’re looking to capture and interpret audio quality. For call quality concerns related to Sharpen Q phone, please refer to the webRTC-internals guide. Signaling and general RTP availability concerns through Sharpen Q Phone can still benefit from this guide.
What is Wireshark?
Wireshark is a commonly used tool to capture inbound and outbound traffic from a designated network interface. The captured data is then used to provide historical troubleshooting material for the SharpenCare team. The tool is distributed in an open source model, free of charge.
What is Dumpcap?
Dumpcap is a CLI subtool of the commonly used Wireshark packet analysis tool which can be run without launching the full Wireshark user interface. It captures traffic specified by predefined capture filters on a user defined network interface. We use dumpcap for its minimal resource utilization and automation capabilities. Your users will be able to set it up once and go about their job without disruption. You’ll see the application running as “dumpcap.exe” in Windows Task Manager following successful setup.
What should I expect?
Using Wireshark
Wireshark comes with a visual interface meant to capture and analyze the data in real time. The capture can be viewed live or saved for archival. Data will only be captured while the application is running, and after capturing has been manually initiated on the defined capture interface. Data can be filtered at the time of capture, so data shared with the SharpenCare team contains only necessary data. Wireshark capture filters are clearly documented here.
This method is best used for events which are reproducible on demand.
Using Dumpcap
Dumpcap runs in the background and does not disrupt the user experience. Once the necessary data has been captured, the process can be removed via the uninstall script. Logs can then be gathered and sent to the SharpenCare team. Like Wireshark, capture filters are configurable. By default, our dumpcap script captures only traffic sent or received to/from the Sharpen network and Google STUN resources.
This method is best used for incidents which are not easy to predict. You can setup the logging, wait for the issue to happen and then gather the logs. Log files are stored with date/time references to allow for historical use. The script is configured to retain the last 50 files of ~90 MB each. Once the 50th file is written, it replaces the 1st with what would be the 51st. This allows for reasonable history of events, but not so much which will exhaust storage.
Prerequisites
Windows Desktop
A Windows desktop with administrator privileges is necessary for the setup and install of Wireshark. In addition, the Dumpcap script, leveraging Windows task scheduler, requires administrator privileges to execute.
Wireshark
Wireshark provides the mechanism for capturing pcap data
SIP soft-phone
SIP soft-phone is necessary to accomplish a rolling packet capture since it can be capturing local to the workstation where dumpcap will be running.
Polycom Phone (If troubleshooting physical IP Phone)
Supported phone for live capturing via steps provided. Yealink phones have an alternate capture method referenced here.
Setting up rolling capture – Does not apply to capturing remotely from Polycom
This method is useful for most capture scenarios. It involves setting up Wireshark, installing and configuring a soft-phone (optional), setting up the dumpcap script, and capturing the issue.
Please note, due to encrypted RTP present in webRTC traffic, this guide is NOT applicable to Sharpen Q phone if we’re looking to assess audio quality. For call quality concerns related to Sharpen Q phone, please refer to the webRTC-internals guide. Signaling and general RTP availability concerns through Sharpen Q Phone can still benefit from this guide.
Setup Wireshark - Download
Download the appropriate installer for the Operating System in use
Run the installer
Leave defaults for Selected Components
Leave defaults for Additional Tasks
Install to C:\Program Files\Wireshark
Check the box to validate “Install WinPcap…” is selected
Skip USB Capture and Click Install
SIP Soft-phone (Optional. Use this method if needing to capture unencrypted audio)
Download your preferred soft-phone (MicroSIP or Zoiper recommended)
Install soft-phone
Navigate to https://app.sharpencx.com/admin/configuration/extensions/
Locate your extension and choose the edit button
Take note of your “username”, “password”, and “Server Address” fields. Leave this page up to copy paste from.
Register soft-phone with the noted information
Dumpcap script
Download the DumpcapSetup here
Extract the contents
Double click the “Install.bat” script
You will likely be prompted by Windows defender indicating “Windows Defender SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk.” – This is expected since the batch file was not created local to the machine in use.
Click the “More info” link, then choose “Run anyway”
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Observe the text at the top of the command prompt window. It will display all the observed network interfaces available to dumpcap, and will launch the windows network connections control panel
Input the corresponding numeric entry associated with the active network interface handling Sharpen traffic.
Tip: In most cases, multiple network adapters will show. Choose the one which has the name matching the “Connected” status. Unless simultaneously connected to networks, this will be the active adapter
Please also note that dumpcap’s identification of network adapters by ID can change upon reboot. The initial setup of this script sets the ID statically. So, if the ID changes, the capture will not work. If possible, it is best to disable all but the necessary (“Connected”) network interface for the duration of the data gathering.
Here’s an example from a machine with a few virtual adapters, a VPN, and a bridged WiFi connection. In this case, the bridge is the active connection, so option “1” would be chosen in the command prompt.
Press Enter
Setup is now complete
Validate logs are capturing
Navigate to Desktop\DumpCap\Captures
Observe whether file(s) such as the following exist
file_00001_20181101115841.pcap
File size is only expected to increase once audio traffic to/from Sharpen commences
Retrieval, Analysis, and Removal
Once an event has been captured, the logs from the capture must be retrieved and sent to SharpenCare for analysis. Follow the steps below to gather and send the logs to Sharpen.
Navigate to the original extraction point of the DumpcapSetup.zip
Locate the “Uninstall.bat” file and double-click
User Account Control will prompt for evaluated permissions. Continue or enter Administrator credentials to continue
Navigate to Desktop\DumpCap\Captures
Identify the proper capture associated with the incident
Date and time can be interpreted by observing the file name
file_00001_20181101115841.pcap
Year, Month, Day, Hour, Minute, Second indicates start time of file Date Modified File Explorer column indicates the end time of the file
Copy the identified packet capture file
Upload the file to a cloud storage solution such as Google Drive, Onedrive, Dropbox, etc...
Provide public link to Sharpen in SharpenCare case
Sharpen will analyze the capture in conjunction with server-side captures to help reach root cause understanding.
Setting up live capture (Polycom)
This method is useful if you’re able to reproduce an issue on demand, and are using a polycom phone. This involves enabling an optional setting on the phone, and capturing the stream of the phone remotely via Wireshark.
Setup Polycom phone
Identify the IP address of your Polycom phone (Settings>Status>Network>TCP/IP Parameters)
In a web browser, enter https://x.x.x.x (eg.. https://10.0.5.68) to navigate to your web configuration for the phone
Depending on your browser, you will see a variation of a security warning. Choose to proceed to the web page
Authenticate using Admin as the user, and 6311 as the password
Navigate to Utilities > Import & Export Configuration
Import the pcap_on.cfg file from here (To disable capturing after work is complete, import the pcap_off.cfg file)
Reboot phone
Setup Wireshark - Download
Download the appropriate installer for the Operating System in use
Run the installer
Leave defaults for Selected Components
Leave defaults for Additional Tasks
Install to C:\Program Files\Wireshark
Check the box to validate “Install WinPcap…” is selected
Skip USB Capture and Click Install
Capture
Launch Wireshark
Navigate to Capture>Options
Choose “Manage Interfaces”
Select the “Remote Interfaces” tab
Click the “+” button
Enter the IP address of your Polycom phone
Enter 2002 in the Port: field
Choose the Password authentication radio button
Enter Polycom for the Username:
Enter the MAC address of the phone (without colons or spaces, all lowercase) for the Password:
Press OK
You may see 2 new interfaces. If this is the case, choose the one which has a collapsed sub-item which identifies as the phone’s IP address
Press Start
Reproduce issue
Press the Stop button at the top left of the interface
Choose File>Save As… to save the packet capture.
Send capture to SharpenCare