// Network Monitor 3.x display filter for Office Communications Server troubleshooting.
tcp.port==5061 // SIP over TLS. This is used by most functions of OCS
// Uncomment any additional protocols you wish to monitor. && = logical AND
// && tcp.port==5060 // SIP over TCP
// && tcp.port==5062 // Default SIP for the A/V edge
// && tcp.port==5063 // Default SIP for the A/V Conferencing server
// && tcp.port==443 // HTTPS, TCP STUN
// && udp.port==3478 // UDP STUN
// && tcp.port==8057 // PSOM
// && tcp.port==135 // RPC endpoint mapper used on front end servers for WMI and DCOM
// && dns // DNS
// Media port ranges. These ranges may be commonly used by non OCS devices on the network.
// && (udp.Port>=50000 && udp.port<=59999) // RTP media port range on outside A/V edge
// && (tcp.Port>=49152 && tcp.port<=65535) // RTP media port range for A/V MCU
// && ((tcp.port>=1024 && tcp.port<=65535) || (udp.port>=1024 && udp.port<=65535)) // External Communicator media port range
// These are additional filters that may be useful. Add a && token if they are to be used in combination with the above.
// The following will show the start of TCP conversations (SYN) as well as resets
// TCP.Flags.Reset == 1 || TCP.Flags.Syn == 1
// The following will show retransmits if conversations are enabled
// (Property.TCPRetransmit == 1 || Property.TCPSynRetransmit == 1)
// The following will hide RDP if the network trace was captured in a terminal session.
// !(tcp.port==3389)
