Netmon capabilities for Skype for Business online troubleshooting

Many times we need to do network trace using tools like wireshark, netmon or Message analyzer.

i find wireshark overwhelming since it doesnt filter the by process, Netmon and Message analyzer provide a way more efficient user interface and filtering based on process as shown on the picture below from netmon:

but even when you sort by process still you get some noise and i will help you have a clean fast look on by the following capabilities in netmon.

1- Display Filters

First we need to know that SfB online use pre defined source ports based on modality; unlike SfB on-premises where you can configure and change source ports as you wish (reference https://technet.microsoft.com/en-us/library/jj204760(v=ocs.15).aspx)

The pre-defined source ports are listed here https://support.microsoft.com/en-us/help/2409256/you-can-t-connect-to-skype-for-business-online,-or-certain-features-don-t-work,-because-an-on-premises-firewall-blocks-the-connection

so based on these ports we can have the following display filters to narrow down on which network capture we need.

 //INBOUND SfB

// Source ports: 50000 - 50019 Audio
(tcp.dstPort>=50000 AND tcp.dstPort<=50019) OR (udp.dstPort>=50000 AND udp.dstPort<=50019)
// Source ports: 50020 - 50039 Video
or
(tcp.dstPort>=50020 AND tcp.dstPort<=50039) OR (udp.dstPort>=50020 AND udp.dstPort<=50039)
// Source ports: 50040 - 50060 VBSS and AppShare
or
(tcp.dstPort>=50040 AND tcp.dstPort<=50060) OR (udp.dstPort>=50040 AND udp.dstPort<=50060)

OR

//OUTBOUND SfB

// Source ports: 50000 - 50019 Audio
(tcp.SrcPort>=50000 AND tcp.SrcPort<=50019) OR (udp.SrcPort>=50000 AND udp.SrcPort<=50019)
// Source ports: 50020 - 50039 Video
or
(tcp.SrcPort>=50020 AND tcp.SrcPort<=50039) OR (udp.SrcPort>=50020 AND udp.SrcPort<=50039)
// Source ports: 50040 - 50060 VBSS and AppShare
or
(tcp.SrcPort>=50040 AND tcp.SrcPort<=50060) OR (udp.SrcPort>=50040 AND udp.SrcPort<=50060)

All you need is to past the above code in the display filter and Apply then "Save Filter" like in the below picture

2- Color Rules

now we would need to do some color coding for easy reading of these traffic, like below screen shot; i filtered the voice packets on green color, video on red, RDP traffic on grey and VBSS traffic on grey with bold fonts

you can use import the following color rules to match these setting by doing the following:

1- Create a new file named color.nmcr

2- Paste the following in the file using notepad

 Version = 1

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50000 AND tcp.SrcPort<=50019) OR (udp.SrcPort>=50000 AND udp.SrcPort<=50019)
or
(tcp.dstPort>=50000 AND tcp.dstPort<=50019) OR (udp.dstPort>=50000 AND udp.dstPort<=50019)


END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 128, 255, 128

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50020 AND tcp.SrcPort<=50039) OR (udp.SrcPort>=50020 AND udp.SrcPort<=50039)
or (tcp.dstPort>=50020 AND tcp.dstPort<=50039) OR (udp.dstPort>=50020 AND udp.dstPort<=50039)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 255, 0, 128

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(tcp.SrcPort>=50040 AND tcp.SrcPort<=50059)
or (tcp.dstPort>=50040 AND tcp.dstPort<=50059)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 192, 192, 192

 Bold = 0

 Italic = 0

 Underline = 0

END_RULE

BEGIN_RULE

BEGIN_FILTER_TEXT

(udp.SrcPort>=50040 AND udp.SrcPort<=50059)
OR(udp.dstPort>=50040 AND Udp.dstPort<=50059)

END_FILTER_TEXT

 Active = 1

 Foreground = 0, 0, 0

 Background = 192, 192, 192

 Bold = 1

 Italic = 0

 Underline = 0

END_RULE

3- from the color rules click Open and browse and select that file.

Comments

• Anonymous
  February 06, 2018
  Mahmoud, This is very useful. Isee this article is from May 2017. Are the port and other details still accurate as of January 2018?
  • Anonymous
    February 27, 2018
    Yes they are for the source ports, destination ports are different tho