Netmon capabilities for Skype for Business online troubleshooting

Many times we need to do network trace using tools like wireshark, netmon or Message analyzer.

i find wireshark overwhelming since it doesnt filter the by process, Netmon and Message analyzer provide a way more efficient user interface and filtering based on process as shown on the picture below from netmon:

process

but even when you sort by process still you get some noise and i will help you have a clean fast look on by the following capabilities in netmon.

1- Display Filters

First we need to know that SfB online use pre defined source ports based on modality; unlike SfB on-premises where you can configure and change source ports as you wish (reference https://technet.microsoft.com/en-us/library/jj204760(v=ocs.15).aspx)

The pre-defined source ports are listed here https://support.microsoft.com/en-us/help/2409256/you-can-t-connect-to-skype-for-business-online,-or-certain-features-don-t-work,-because-an-on-premises-firewall-blocks-the-connection

Modality Source Destination Source Port Destination port
Audio Client Office 365 50000 - 50019 UDP and TCP 443 TCP, 3478 UDP, 50000 - 59999 UDP and TCP
Video Client Office 365 50020 - 50039 UDP and TCP 443 TCP, 3478 UDP, 50000 - 59999 UDP and TCP
Desktop Sharing Client Office 365 50040 - 50059 UDP and TCP 443 TCP, 50000 - 59999 TCP

so based on these ports we can have the following display filters to narrow down on which network capture we need.

 //INBOUND SfB

// Source ports: 50000 - 50019 Audio
(tcp.dstPort>=50000 AND tcp.dstPort<=50019) OR (udp.dstPort>=50000 AND udp.dstPort<=50019)
// Source ports: 50020 - 50039 Video
or
(tcp.dstPort>=50020 AND tcp.dstPort<=50039) OR (udp.dstPort>=50020 AND udp.dstPort<=50039)
// Source ports: 50040 - 50060 VBSS and AppShare
or
(tcp.dstPort>=50040 AND tcp.dstPort<=50060) OR (udp.dstPort>=50040 AND udp.dstPort<=50060)

OR

//OUTBOUND SfB

// Source ports: 50000 - 50019 Audio
(tcp.SrcPort>=50000 AND tcp.SrcPort<=50019) OR (udp.SrcPort>=50000 AND udp.SrcPort<=50019)
// Source ports: 50020 - 50039 Video
or
(tcp.SrcPort>=50020 AND tcp.SrcPort<=50039) OR (udp.SrcPort>=50020 AND udp.SrcPort<=50039)
// Source ports: 50040 - 50060 VBSS and AppShare
or
(tcp.SrcPort>=50040 AND tcp.SrcPort<=50060) OR (udp.SrcPort>=50040 AND udp.SrcPort<=50060)

All you need is to past the above code in the display filter and Apply then "Save Filter" like in the below picture

display

2- Color Rules

now we would need to do some color coding for easy reading of these traffic, like below screen shot; i filtered the voice packets on green color, video on red, RDP traffic on grey and VBSS traffic on grey with bold fonts

 

color

 

you can use import the following color rules to match these setting by doing the following:

1- Create a new file named color.nmcr

2- Paste the following in the file using notepad

 Version = 1

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50000 AND tcp.SrcPort<=50019) OR (udp.SrcPort>=50000 AND udp.SrcPort<=50019)
or
(tcp.dstPort>=50000 AND tcp.dstPort<=50019) OR (udp.dstPort>=50000 AND udp.dstPort<=50019)


END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 128, 255, 128

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50020 AND tcp.SrcPort<=50039) OR (udp.SrcPort>=50020 AND udp.SrcPort<=50039)
or (tcp.dstPort>=50020 AND tcp.dstPort<=50039) OR (udp.dstPort>=50020 AND udp.dstPort<=50039)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 255, 0, 128

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50040 AND tcp.SrcPort<=50059)
or (tcp.dstPort>=50040 AND tcp.dstPort<=50059)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 192, 192, 192

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(udp.SrcPort>=50040 AND udp.SrcPort<=50059)
OR(udp.dstPort>=50040 AND Udp.dstPort<=50059)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 192, 192, 192

 Bold = 1

 Italic = 0

 Underline = 0

END_RULE

3- from the color rules click Open and browse and select that file.

Comments

  • Anonymous
    February 06, 2018
    Mahmoud, This is very useful. Isee this article is from May 2017. Are the port and other details still accurate as of January 2018?
    • Anonymous
      February 27, 2018
      Yes they are for the source ports, destination ports are different tho