Network packet drops?

Content Authoring
1

having an issue where at random times Skype for Business drop calls within a minute, wondering if there is anyway i can use a fixlet to notify me when the call drops or even if there are any ideas please share

Thanks

2

Does Skype keep a log of dropped calls that we could parse from the client?

3

i enable Event Viewer logging

this one just happened. here are the logs

Log Name: Application
Source: Lync
Date: 12/12/2016 2:46:26 PM
Event ID: 11
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: pc3.domain.com
Description:
A SIP request made by Lync failed in an unexpected manner (status code 0). More information is contained in the following technical data:

RequestUri: sip:rsingh@domain.com;opaque=user:epid:4Mk10UNZ11yo1TC8JRrmpgAA;gruu
From: sip:azolnierz@domain.com;tag=998019fe52
To: sip:rsingh@domain.com;tag=96d1d3d11a
Call-ID: 221612fcdacb46b397e5f1b1ccafc967
Content-type: application/sdp;call-type=audiovideo

v=0
o=- 0 1 IN IP4 192.123.41.122
s=session
c=IN IP4 192.123.41.122
b=CT:99980
t=0 0
a=x-mediabw:main-video send=12000;recv=6000
a=x-devicecaps:audio:send,recv;video:send,recv
m=audio 50014 RTP/SAVP 117 104 114 9 112 111 0 8 103 116 115 97 13 118 119 101
a=x-ssrc-range:1258598656-1258598656
a=rtcp-fb:* x-message app send:dsh recv:dsh
a=rtcp-rsize
a=label:main-audio
a=x-source:main-audio
a=ice-ufrag:l02M
a=ice-pwd:RGKFNRfT4UabOKla0ivn64Mt
a=candidate:1 1 UDP 2130706431 192.123.41.122 50014 typ host
a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:yJ6DA7T3MIcu0fkrdtncDpgmkoSrf5moN0DKUcRQ|2^31|1:1
a=remote-candidates:1 192.123.22.116 50003 2 192.123.22.116 50003
a=maxptime:200
a=rtpmap:117 G722/8000/2
a=rtpmap:104 SILK/16000
a=fmtp:104 useinbandfec=1; usedtx=0
a=rtpmap:114 x-msrta/16000
a=fmtp:114 bitrate=29000
a=rtpmap:9 G722/8000
a=rtpmap:112 G7221/16000
a=fmtp:112 bitrate=24000
a=rtpmap:111 SIREN/16000
a=fmtp:111 bitrate=16000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:103 SILK/8000
a=fmtp:103 useinbandfec=1; usedtx=0
a=rtpmap:116 AAL2-G726-32/8000
a=rtpmap:115 x-msrta/8000
a=fmtp:115 bitrate=11800
a=rtpmap:97 RED/8000
a=rtpmap:13 CN/8000
a=rtpmap:118 CN/16000
a=rtpmap:119 CN/24000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=rtcp-mux
a=ptime:20
a=extmap:1 http:\www.webrtc.org\experiments\rtp-hdrext\abs-send-time
m=video 50032 RTP/SAVP 122 121 123
a=x-ssrc-range:1258598657-1258598756
a=rtcp-fb:* x-message app send:src,x-pli recv:src,x-pli
a=rtcp-rsize
a=label:main-video
a=x-source:main-video
a=ice-ufrag:6GWd
a=ice-pwd:d2P+P9Xe6iux2CcBNUQtbolF
a=x-caps:121 263:1920:1080:30.0:2000000:1;4359:1280:720:30.0:1500000:1;8455:640:480:30.0:600000:1;12551:640:360:30.0:600000:1;16647:352:288:15.0:250000:1;20743:424:240:15.0:250000:1;24839:176:144:15.0:180000:1
a=candidate:1 1 UDP 2130706431 192.123.41.122 50032 typ host
a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:yJ6DA7T3MIcu0fkrdtncDpgmkoSrf5moN0DKUcRQ|2^31|1:1
a=remote-candidates:1 192.123.22.116 50038 2 192.123.22.116 50038
a=rtpmap:122 X-H264UC/90000
a=fmtp:122 packetization-mode=1;mst-mode=NI-TC
a=rtpmap:121 x-rtvc1/90000
a=rtpmap:123 x-ulpfecuc/90000
a=rtcp-mux
a=extmap:1 http:\www.webrtc.org\experiments\rtp-hdrext\abs-send-time

Response Data:

101 Progress Report
ms-diagnostics: 13004;reason=“Request was proxied to one or more registered endpoints”;source=“BL20A09FES15.INFRA.LYNC.COM”;Count=“1”;appName=“InboundRouting”

180 Ringing

183 Session Progress

0 (null)
(null): 51004; reason=“Action initiated by user”;UserType=“Callee”;MediaType=“audio”;MediaChanBlob=“NetworkErr=no error,ErrTime=0,RTPSeq=0,SeqDelta=0,RTPTime=3690560781854,RTCPTime=3690560778414,TransptRecvErr=0x0,RecvErrTime=0,TransptSendErr=0x0,SendErrTime=0,InterfacesStall=0x0,InterfacesConnCheck=0x0,MediaTimeout=0,BlobVer=1”;BaseAddress=“192.123.22.116:50006”;LocalAddress=“192.123.22.116:50003”;LocalSite=“192.94.252.2:50006”;NetworkName=“domain.com”;RemoteAddress=“192.123.41.122:50014”;RemoteSite=“132.245.0.9:50013”;MediaEpBlob=“ICEWarn=0x400000,ICEWarnEx=0x0,LocalMR=132.245.0.35:55499,RemoteMR=132.245.0.45:50333,PortRange=50000:50019,LocalMRTCPPort=52477,RemoteMRTCPPort=50333,LocalLocation=1,RemoteLocation=1,FederationType=0,StunVer=2,CsntRqOut=46,CsntRqIn=46,CsntRspOut=46,CsntRspIn=46,Interfaces=0x2,BaseInterface=0x2,Protocol=0,LocalInterface=0x2,LocalAddrType=0,RemoteAddrType=0,IceRole=2,RtpRtcpMux=1,AllocationTimeInMs=211,FirstHopRTTInMs=12,TransportBytesSent=1469,TransportPktsSent=49,IceConnCheckStatus=4,PrelimConnChecksSucceeded=0,IceInitTS=3690560544868,ContactSrvMs=162,AllocFinMs=214,FinalAnsRcvMs=0,FirstPathMs=2871,ReinviteRcvMs=8250,AckReinviteSntMs=8303,FCsntRqSntMs=8357,FCsntRqRcvMs=8577,LCsntRqSntMs=234801,LCsntRqRcvMs=234971,BlobGenTime=3690560781936,MediaDllVersion=6.0.8953.246,BlobVer=1”;MediaMgrBlob=“MrDnsE=mediaedge0A.online.lync.com,MrResE=1,MrErrE=0,MrBgnE=36905605448554848,MrEndE=36905605448675232,MrDnsI=sipedgeBL20A.infra.lync.com,MrResI=0,MrErrI=11001,MrBgnI=36905605448552280,MrEndI=36905605448559672,MrDnsCacheReadAttempt=0,BlobVer=1”;OriginalPresenceState=“0”;CurrentPresenceState=“0”;MeInsideUser=“No”;ConversationInitiatedBy=“0”;SourceNetwork=“0”;RemotePartyCanDoIM=“No”

Resolution:
If this error continues to occur, please contact your network administrator. The network administrator can use a tool like winerror.exe from the Windows Resource Kit or lcserror.exe from the Office Communications Server Resource Kit in order to interpret any error codes listed above.
Event Xml:



11
3
0
0x80000000000000

662396
Application
PC3.domain.com



Lync
0
RequestUri: sip:rsingh@domain.com;opaque=user:epid:4Mk10UNZ11yo1TC8JRrmpgAA;gruu
From: sip:azolnierz@domain.com;tag=998019fe52
To: sip:rsingh@domain.com;tag=96d1d3d11a
Call-ID: 221612fcdacb46b397e5f1b1ccafc967
Content-type: application/sdp;call-type=audiovideo

v=0
o=- 0 1 IN IP4 192.168.14.46
s=session
c=IN IP4 192.123.41.122
b=CT:99980
t=0 0
a=x-mediabw:main-video send=12000;recv=6000
a=x-devicecaps:audio:send,recv;video:send,recv
m=audio 50014 RTP/SAVP 117 104 114 9 112 111 0 8 103 116 115 97 13 118 119 101
a=x-ssrc-range:1258598656-1258598656
a=rtcp-fb:* x-message app send:dsh recv:dsh
a=rtcp-rsize
a=label:main-audio
a=x-source:main-audio
a=ice-ufrag:l02M
a=ice-pwd:RGKFNRfT4UabOKla0ivn64Mt
a=candidate:1 1 UDP 2130706431 192.123.41.122 50014 typ host
a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:yJ6DA7T3MIcu0fkrdtncDpgmkoSrf5moN0DKUcRQ|2^31|1:1
a=remote-candidates:1 192.123.22.116 50003 2 192.123.22.116 50003
a=maxptime:200
a=rtpmap:117 G722/8000/2
a=rtpmap:104 SILK/16000
a=fmtp:104 useinbandfec=1; usedtx=0
a=rtpmap:114 x-msrta/16000
a=fmtp:114 bitrate=29000
a=rtpmap:9 G722/8000
a=rtpmap:112 G7221/16000
a=fmtp:112 bitrate=24000
a=rtpmap:111 SIREN/16000
a=fmtp:111 bitrate=16000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:103 SILK/8000
a=fmtp:103 useinbandfec=1; usedtx=0
a=rtpmap:116 AAL2-G726-32/8000
a=rtpmap:115 x-msrta/8000
a=fmtp:115 bitrate=11800
a=rtpmap:97 RED/8000
a=rtpmap:13 CN/8000
a=rtpmap:118 CN/16000
a=rtpmap:119 CN/24000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-16
a=rtcp-mux
a=ptime:20
a=extmap:1 http:\www.webrtc.org\experiments\rtp-hdrext\abs-send-time
m=video 50032 RTP/SAVP 122 121 123
a=x-ssrc-range:1258598657-1258598756
a=rtcp-fb:* x-message app send:src,x-pli recv:src,x-pli
a=rtcp-rsize
a=label:main-video
a=x-source:main-video
a=ice-ufrag:6GWd
a=ice-pwd:d2P+P9Xe6iux2CcBNUQtbolF
a=x-caps:121 263:1920:1080:30.0:2000000:1;4359:1280:720:30.0:1500000:1;8455:640:480:30.0:600000:1;12551:640:360:30.0:600000:1;16647:352:288:15.0:250000:1;20743:424:240:15.0:250000:1;24839:176:144:15.0:180000:1
a=candidate:1 1 UDP 2130706431 192.123.41.122 50032 typ host
a=crypto:2 AES_CM_128_HMAC_SHA1_80 inline:yJ6DA7T3MIcu0fkrdtncDpgmkoSrf5moN0DKUcRQ|2^31|1:1
a=remote-candidates:1 192.123.22.116 50038 2 192.123.22.116 50038
a=rtpmap:122 X-H264UC/90000
a=fmtp:122 packetization-mode=1;mst-mode=NI-TC
a=rtpmap:121 x-rtvc1/90000
a=rtpmap:123 x-ulpfecuc/90000
a=rtcp-mux
a=extmap:1 http:\www.webrtc.org\experiments\rtp-hdrext\abs-send-time

Response Data:

101 Progress Report
ms-diagnostics: 13004;reason=“Request was proxied to one or more registered endpoints”;source=“BL20A09FES15.INFRA.LYNC.COM”;Count=“1”;appName=“InboundRouting”

180 Ringing

183 Session Progress

0 (null)
(null): 51004; reason=“Action initiated by user”;UserType=“Callee”;MediaType=“audio”;MediaChanBlob=“NetworkErr=no error,ErrTime=0,RTPSeq=0,SeqDelta=0,RTPTime=3690560781854,RTCPTime=3690560778414,TransptRecvErr=0x0,RecvErrTime=0,TransptSendErr=0x0,SendErrTime=0,InterfacesStall=0x0,InterfacesConnCheck=0x0,MediaTimeout=0,BlobVer=1”;BaseAddress=“192.123.22.116:50006”;LocalAddress=“192.123.22.116:50003”;LocalSite=“192.94.252.2:50006”;NetworkName=“domain.com”;RemoteAddress=“192.123.41.122:50014”;RemoteSite=“132.245.0.9:50013”;MediaEpBlob=“ICEWarn=0x400000,ICEWarnEx=0x0,LocalMR=132.245.0.35:55499,RemoteMR=132.245.0.45:50333,PortRange=50000:50019,LocalMRTCPPort=52477,RemoteMRTCPPort=50333,LocalLocation=1,RemoteLocation=1,FederationType=0,StunVer=2,CsntRqOut=46,CsntRqIn=46,CsntRspOut=46,CsntRspIn=46,Interfaces=0x2,BaseInterface=0x2,Protocol=0,LocalInterface=0x2,LocalAddrType=0,RemoteAddrType=0,IceRole=2,RtpRtcpMux=1,AllocationTimeInMs=211,FirstHopRTTInMs=12,TransportBytesSent=1469,TransportPktsSent=49,IceConnCheckStatus=4,PrelimConnChecksSucceeded=0,IceInitTS=3690560544868,ContactSrvMs=162,AllocFinMs=214,FinalAnsRcvMs=0,FirstPathMs=2871,ReinviteRcvMs=8250,AckReinviteSntMs=8303,FCsntRqSntMs=8357,FCsntRqRcvMs=8577,LCsntRqSntMs=234801,LCsntRqRcvMs=234971,BlobGenTime=3690560781936,MediaDllVersion=6.0.8953.246,BlobVer=1”;MediaMgrBlob=“MrDnsE=mediaedge0A.online.lync.com,MrResE=1,MrErrE=0,MrBgnE=36905605448554848,MrEndE=36905605448675232,MrDnsI=sipedgeBL20A.infra.lync.com,MrResI=0,MrErrI=11001,MrBgnI=36905605448552280,MrEndI=36905605448559672,MrDnsCacheReadAttempt=0,BlobVer=1”;OriginalPresenceState=“0”;CurrentPresenceState=“0”;MeInsideUser=“No”;ConversationInitiatedBy=“0”;SourceNetwork=“0”;RemotePartyCanDoIM=“No”

4

BigFix probably isn’t the best tool for aggregating your event logs, but I think @strawgate has done some work in his C3 content to find event log entries. If you made an Analysis to look for matching events, you could set up a Web Report to notify you when the results change.

5

Searching Event logs is very slow but there is a workaround you can use to limit the number of logs the client looks at (to like the last 500 log messages).

Something like this should work:

(time generated of it, description of it) of records ((integers in(item 0 of it + item 1 of it - 1,maximum of (item 0 of it + item 1 of it - 500;item 1 of it))) of (record count of it, oldest record number of it)) whose (source of it = "Lync" and (event id of it = 11)) of application event log