// Network Monitor 3.x display filter for Office Communications Server troubleshooting. tcp.port==5061 // SIP over TLS. This is used by most functions of OCS // Uncomment any additional protocols you wish to monitor. && = logical AND // && tcp.port==5060 // SIP over TCP // && tcp.port==5062 // Default SIP for the A/V edge // && tcp.port==5063 // Default SIP for the A/V Conferencing server // && tcp.port==443 // HTTPS, TCP STUN // && udp.port==3478 // UDP STUN // && tcp.port==8057 // PSOM // && tcp.port==135 // RPC endpoint mapper used on front end servers for WMI and DCOM // && dns // DNS // Media port ranges. These ranges may be commonly used by non OCS devices on the network. // && (udp.Port>=50000 && udp.port<=59999) // RTP media port range on outside A/V edge // && (tcp.Port>=49152 && tcp.port<=65535) // RTP media port range for A/V MCU // && ((tcp.port>=1024 && tcp.port<=65535) || (udp.port>=1024 && udp.port<=65535)) // External Communicator media port range // These are additional filters that may be useful. Add a && token if they are to be used in combination with the above. // The following will show the start of TCP conversations (SYN) as well as resets // TCP.Flags.Reset == 1 || TCP.Flags.Syn == 1 // The following will show retransmits if conversations are enabled // (Property.TCPRetransmit == 1 || Property.TCPSynRetransmit == 1) // The following will hide RDP if the network trace was captured in a terminal session. // !(tcp.port==3389)
相关文章：