Office 365 的性能疑难解答计划Performance troubleshooting plan for Office 365

您需要了解在 SharePoint Online、OneDrive for business、Exchange Online 或 Skype for business Online 和您的客户端计算机之间识别和修复滞后、挂起和降低性能的步骤吗?Do you need to know the steps to take to identify and fix lags, hangs, and slow performance between SharePoint Online, OneDrive for Business, Exchange Online, or Skype for Business Online, and your client computer? 在致电支持之前,本文可帮助您解决 Office 365 性能问题,甚至修复一些最常见的问题。Before you call support, this article can help you troubleshoot Office 365 performance issues and even fix some of the most common issues.

本文实际上是一个示例操作计划,可用于在发生性能问题时捕获有价值的数据。This article is actually a sample action plan that you can use to capture valuable data about your performance issue as it's happening. 本文还包括一些主要问题。Some top issues are also included in this article.

如果你不熟悉网络性能,并且想要制定长期计划来监视客户端计算机和 Office 365 之间的性能,请查看Office 365 性能调整和故障排除-管理员和 IT 专业人员If you're new to network performance and want to make a long term plan to monitor performance between your client machines and Office 365, take a look at Office 365 performance tuning and troubleshooting - Admin and IT Pro.

性能故障排除操作计划示例Sample performance troubleshooting action plan

此操作计划包含两个部分;准备阶段和日志记录阶段。This action plan contains two parts; a preparation phase, and a logging phase. 如果现在遇到性能问题,并且需要进行数据收集,则可以立即开始使用此计划。If you have a performance problem right now, and you need to do data collection, you can start using this plan right away.

准备客户端计算机Prepare the client computer

  • 查找可能会再现性能问题的客户端计算机。Find a client computer that can reproduce the performance problem. 此计算机将在故障排除过程中使用。This computer will be used during the course of troubleshooting.
  • 记下导致性能问题发生的步骤,以便在测试时做好准备。Write down the steps that cause the performance problem to happen so you're ready when it comes time to test.
  • 安装用于收集和录制信息的工具:Install tools for gathering and recording information:
    • 安装Netmon 3.4 (或使用等效的网络跟踪工具)。Install Netmon 3.4 (or use an equivalent network tracing tool).
    • 安装HTTPWatch的免费基本版本(或使用等效的网络跟踪工具)。Install the free Basic Edition of HTTPWatch (or use an equivalent network Tracing tool).
    • 使用屏幕录制器或运行 Windows Vista 及更高版本附带的步骤记录器(PSR),以保留在测试过程中执行的步骤的记录。Use a screen recorder or run the Steps Recorder (PSR.exe) that comes with Windows Vista and later, in order to keep a record of the steps you take during testing.

记录性能问题Log the performance issue

  • 关闭所有多余的 Internet 浏览器。Close all extraneous Internet browsers.

  • 启动步骤记录器或另一个屏幕录制器。Start the Steps Recorder, or another screen recorder.

  • 启动 Netmon 捕获(或网络跟踪工具)。Start your Netmon capture (or network tracing tool).

  • 通过在命令行中键入 ipconfig/flushdns. 来清除客户端计算机上的 DNS 缓存Clear your DNS cache on the client computer from the command line by typing ipconfig /flushdns.

  • 启动新的浏览器会话并打开 HTTPWatch。Start a new browser session and turn on HTTPWatch.

  • 可选:如果要测试 Exchange Online,请从 Office 365 管理控制台运行 Exchange 客户端性能分析器工具。Optional: If you are testing Exchange Online, run the Exchange Client Performance Analyzer tool from the Office 365 admin console.

  • 重现导致性能问题的确切步骤。Reproduce the exact steps that cause the performance issue.

  • 停止 Netmon 或其他工具的跟踪。Stop your Netmon or other tool's trace.

  • 在命令行中,键入以下命令并按 ENTER,以运行指向 Office 365 订阅的跟踪路由:At the command line, run a trace route to your Office 365 subscription by typing the following command and then pressing ENTER:

    tracert <subscriptionname>.onmicrosoft.com
    
  • 停止步骤记录器并保存视频。Stop the Steps Recorder and save the video. 请务必包括捕获的日期和时间以及它是正常还是坏的性能。Be sure to include the date and time of the capture and whether it demonstrates good or bad performance.

  • 保存跟踪文件。Save the trace files. 此外,请务必包含捕获的日期和时间,以及它是正常还是坏的性能。Again, be sure to include the date and time of the capture and whether it demonstrates good or bad performance.

如果您不熟悉本文中提到的工具的运行,请不要担心,因为我们在下一步提供这些步骤。If you're not familiar with running the tools mentioned in this article, don't worry because we provide those steps next. 如果您习惯于执行此类网络捕获,则可以跳转到如何收集比较基准(描述了筛选和读取日志)。If you're accustomed to doing this kind of network capturing, you can skip to How to collect baselines, which describes filtering and reading the logs.

先刷新 DNS 缓存Flush the DNS Cache first

为什么?Why? 通过刷新 DNS 缓存,你将使用干净的盖板启动测试。By flushing out the DNS cache you're starting your tests with a clean slate. 通过清除缓存,您要将 DNS 解析程序内容重置为最新的条目。By clearing the cache, you're resetting the DNS resolver contents to the most up-to-date entries. 请注意,刷新不会删除主机文件条目。Remember that a flush does not remove HOSTs file entries. 如果频繁使用主机文件条目,则应将这些条目复制到另一个目录中的文件中,然后清空主机文件。If you use HOST file entries extensively, you should copy those entries out to a file in another directory and then empty the HOST file.

刷新 DNS 解析器缓存Flush your DNS resolver cache

  1. 打开命令提示符("开始 > 运行 > cmd or Windows key > cmd")。Open the command prompt, (either Start > Run > cmd or Windows key > cmd).

  2. 键入下面的命令,并按 Enter:Type the following command and press ENTER:

    ipconfig /flushdns
    

NetmonNetmon

Microsoft 网络监控工具(Netmon)分析在网络上的计算机之间传递的数据包(即流量)。Microsoft's Network Monitoring tool (Netmon) analyzes packets, that is traffic, that passes between computers on networks. 通过使用 Netmon 来跟踪使用 Office 365 的流量,您可以捕获、查看和读取数据包标头、标识介入的设备、检查网络硬件上的重要设置、查找丢弃的数据包,并遵循公司中计算机之间的流量流量。网络和 Office 365。By using Netmon to trace traffic with Office 365 you can capture, view, and read packet headers, identify intervening devices, check important settings on network hardware, look for dropped packets, and follow the flow of traffic between computers on your corporate network and Office 365. 由于流量的实际正文已加密,即它(通过 SSL/TLS 在端口443上传输,无法读取正在发送的文件。Because the actual body of the traffic is encrypted, that is, it(travels on port 443 via SSL/TLS, you can't read the files being sent. 而是获取对数据包所采用的路径的未筛选跟踪,从而帮助您跟踪问题行为。Instead, you get an unfiltered trace of the path that the packet takes which can help you track down the problem behavior.

请务必现在不应用筛选器。Be sure you don't apply a filter at this time. 而是在停止跟踪和保存之前,先执行步骤并演示问题。Instead, run through the steps and demonstrate the problem before stopping the trace and saving.

安装 Netmon 3.4 后,打开该工具并执行以下步骤:After you install Netmon 3.4, open the tool and take these steps:

获取 Netmon 跟踪并再现问题Take a Netmon trace and reproduce the issue

  1. 启动 Netmon 3.4。Launch Netmon 3.4. 起始页上有三个窗格: "最近捕获"、"选择网络" 和 " Microsoft 网络监视器3.4 入门"。通知There are three panes on the Start page: Recent Captures, Select Networks, and the Getting Started with Microsoft Network Monitor 3.4. Notice. "选择网络" 面板还将提供可从中捕获的默认网络的列表。The Select Networks panel will also give you a list of the default networks from which you can capture. 确保在此处选择了网卡。Be sure that network cards are selected here.

  2. 单击起始页顶部的 "新建捕获"。Click New Capture at the top of the Start page. 这将在 "起始页" 选项卡(称为捕获 1)旁边添加一个新选项卡。This adds a new tab beside the Start page tab called Capture 1. 显示新的 "捕获"、"启动" 和 "停止" 按钮的 Netmon 用户界面。Netmon's user interface with the New Capture, Start, and Stop buttons highlighted.

  3. 若要获取简单的捕获,请单击工具栏上的 "开始"。To take a simple capture, click Start on the toolbar.

  4. 重现出现性能问题的步骤。Reproduce the steps that present a performance issue.

  5. 单击 "停止 > 文件 > 另存为"。Click Stop > File > Save As. 请记住,请提供时区的日期和时间,并注明它是否演示了坏的或好的性能。Remember to give the date and time with the time zone and to mention if it demonstrates bad or good performance.

HTTPWatchHTTPWatch

HTTPWatch的费用和免费版本。HTTPWatch comes in charged, and a free edition. 免费的基本版本涵盖了此测试所需的一切。The free Basic Edition covers everything you need for this test. HTTPWatch 在浏览器窗口中直接监视网络流量和页面加载时间。HTTPWatch monitors network traffic and page load time right from your browser window. HTTPWatch 是以图形方式描述性能的 Internet Explorer 的插件。HTTPWatch is a plug-in to Internet Explorer that graphically describes performance. 可以在 HTTPWatch Studio 中保存和查看分析。The analysis can be saved and viewed in HTTPWatch Studio.

备注

如果您使用其他浏览器(如 Firefox、Google Chrome 或无法在 Internet Explorer 中安装 HTTPWatch,则打开一个新的浏览器窗口并在键盘上按 F12。If you use another browser, such as Firefox, Google Chrome, or if you can't install HTTPWatch in Internet Explorer, open a new browser window and press F12 on your keyboard. 您应该会看到浏览器底部的 "开发工具" 弹出窗口。You should see the Developer Tool pop-up at the bottom of your browser. 如果使用了 Opera,请按 CTRL + SHIFT + I for Web Inspector,然后单击 "网络" 选项卡并完成下面所述的测试。If you use Opera, press CTRL+SHIFT+I for Web Inspector, then click the Network tab and complete the testing outlined below. 信息会略有不同,但加载时间仍将以毫秒为单位显示。The information will be slightly different, but load times will still be displayed in milliseconds. > HTTPWatch 对 SharePoint Online 页面加载时间的问题也非常有用。> HTTPWatch is also very useful for issues with SharePoint Online page load times.

运行 HTTPWatch 并再现问题Run HTTPWatch and reproduce the issue

HTTPWatch 是一个浏览器插件,因此在浏览器中公开此工具会因 Internet Explorer 的每个版本而略有不同。HTTPWatch is a browser plug-in, so exposing the tool in the browser is slightly different for each version of Internet Explorer. 通常情况下,您可以在 Internet Explorer 浏览器中的命令栏下找到 HTTPWatch。Typically, you can find HTTPWatch under the Commands bar in the Internet Explorer browser. 如果您在浏览器窗口中看不到 HTTPWatch 插件,请单击 "帮助 > ",或在 Internet explorer 的更高版本中查看浏览器的版本,然后单击齿轮符号和 "关于 internet explorer"。If you don't see the HTTPWatch plug-in in your browser window, check the version of your browser by clicking Help > About, or in later versions of Internet Explorer, click the gear symbol and About Internet Explorer. 若要启动命令栏,请在 Internet Explorer 中右键单击菜单栏,然后单击 "命令栏"。To launch the Commands bar, right-click the menu bar in Internet Explorer and click Commands bar.

过去,HTTPWatch 已与命令和浏览器栏相关联,因此在安装后,如果您不立即看到图标(即使在重新启动后),请检查工具以及您的工具栏上的图标。In the past, HTTPWatch has been associated with both the Commands and the Explorer bars, so once you install, if you don't immediately see the icon (even after reboot) check Tools, and your toolbars for the icon. 请注意,可以自定义工具栏,并且可以向其添加选项。Remember that toolbars can be customized and options can be added to them.

显示 HTTPWatch 图标的 Internet Explorer 的命令工具栏。

  1. 在 Internet Explorer 浏览器窗口中启动 HTTPWatch。Launch HTTPWatch in an Internet Explorer browser window. 它将停靠在该窗口底部的浏览器中。It will appear docked to the browser at the bottom of that window. 单击 "记录"。Click Record.

  2. 重现性能问题中涉及的确切步骤。Reproduce the exact steps involved in the performance issue. 单击 HTTPWatch 中的 "停止" 按钮。Click the Stop button in HTTPWatch.

  3. 保存HTTPWatch 或通过电子邮件发送Save the HTTPWatch or Send by Email. 请记住为该文件命名,以使其包含日期和时间信息,并指示您的监视是否包含正常或坏性能的演示。Remember to name the file so that it includes date and time information and an indication of whether your Watch contains a demonstration of good or bad performance.

HTTPWatch,显示 Office 365 主页的页面加载的“网络”选项卡。

此屏幕截图来自 HTTPWatch 的专业版。This screen shot is from the Professional version of HTTPWatch. 您可以打开在具有专业版的计算机上的基本版本中拍摄的跟踪,并在其中阅读。You can open traces taken in the Basic Version on a computer with a Professional version and read it there. 可通过该方法在跟踪中获取额外信息。Extra information may be available from the trace through that method.

问题步骤记录器Problem Steps Recorder

通过步骤记录器或 PSR,可以在出现问题时记录这些问题。Steps Recorder, or PSR.exe, allows you to record issues as they are occurring. 它是一个非常有用的工具,并且运行起来非常简单。It's a very useful tool and very simple to run.

运行问题步骤记录器(PSR)记录您的工作Run Problem Steps Recorder (PSR.exe) to record your work

  1. 使用 "启动 > 运行 >类型" PSR > "确定",或者单击 " Windows 键 >类型PSR > ",然后按 enter。Either use Start > Run > type PSR.exe > OK, or, click the Windows Key > type PSR.exe > and then press ENTER.

  2. 当出现小型 PSR 窗口时,请单击 "开始记录" 并重现再现性能问题的步骤。When the small PSR.exe window appears, click Start Record and reproduce the steps that reproduce the performance issue. 您可以根据需要添加注释,方法是单击 "添加注释"。You can add comments as needed, by clicking Add Comments.

  3. 完成这些步骤后,单击 "停止录制"。Click Stop Record when you have completed the steps. 如果性能问题是页面呈现,请在停止录制之前等待页面呈现。If the performance issue is a page render, wait for the page to render before you stop the recording.

  4. 单击“保存”。Click Save.

步骤记录器或 PSR 的屏幕截图。

为您记录日期和时间。The date and time is recorded for you. 这会及时将您的 PSR 链接到 Netmon 跟踪和 HTTPWatch,并有助于精确的故障排除。This links your PSR to your Netmon trace and HTTPWatch in time, and helps with precision troubleshooting. PSR 记录中的日期和时间可以显示在 URL 的登录和浏览和管理网站的部分呈现之间传递的分钟数,例如。The date and time in the PSR record can show that a minute passed between the login and browsing of the URL and the partial render of the admin site, for example.

阅读跟踪Read your traces

无法通过一篇文章了解有关网络和性能疑难解答的所有内容。It isn't possible to teach everything about network and performance troubleshooting that someone would need to know via an article. 在性能方面取得出色的体验,并了解网络的工作原理以及通常的执行情况。Getting good at performance takes experience, and knowledge of how your network works and usually performs. 但可以对首要问题列表进行舍入,并显示工具如何使您更轻松地消除最常见的问题。But it is possible to round up a list of top issues and show how tools can make it easier for you to eliminate the most common problems.

如果您想要为您的 Office 365 网站挑选阅读网络跟踪的技能,则没有更好的教师定期创建页面加载的跟踪,并获得阅读体验。If you want to pick up skills reading network traces for your Office 365 sites, there is no better teacher than creating traces of page loads regularly and gaining experience reading them. 例如,当你有机会时,请加载 Office 365 服务并跟踪进程。For example, when you have a chance, load an Office 365 service and trace the process. 筛选 DNS 通信的跟踪,或在 FrameData 中搜索您浏览的服务的名称。Filter the trace for DNS traffic, or search the FrameData for the name of the service you browsed. 扫描跟踪以了解服务加载时发生的步骤。Scan the trace to get an idea of the steps that occur when the service loads. 这将帮助您了解正常页面加载的外观,在进行故障排除的情况下,尤其是在性能方面,比较好的对坏跟踪可能会很多。This will help you learn what normal page load should look like, and in the case of troubleshooting, particularly around performance, comparing good to bad traces can teach you a lot.

Netmon 在显示筛选器字段中使用 Microsoft Intellisense。Netmon uses Microsoft Intellisense in the Display filter field. 智能感知或智能代码完成是指在一段时间内键入句点和所有可用选项的技巧显示在下拉选项框中。Intellisense, or intelligent code completion, is that trick where you type in a period and all available options are displayed in a drop-down selection box. 例如,如果你担心 TCP 窗口缩放,你可以通过这种方式查找筛选器(如.protocol.tcp.window < 100)。If, for example, you are worried about TCP window scaling, you can find your way to a filter (such as .protocol.tcp.window < 100) by this means.

显示 "显示筛选器" 字段使用 intellisense 的 Netmon 屏幕截图。

Netmon 跟踪可以在其中包含大量流量。Netmon traces can have a lot of traffic in them. 如果你不熟悉阅读这些文件,可能会在首次打开跟踪时淹没过重。If you aren't experienced with reading them, it's likely you will be overwhelmed opening the trace the first time. 要做的第一件事就是将来自跟踪的背景噪音的信号分开。The first thing to do is separate the signal from the background noise in the trace. 您针对 Office 365 进行了测试,这就是您想要查看的流量。You tested against Office 365, and that's the traffic you want to see. 如果您用于浏览跟踪,则可能不需要此列表。If you are used to navigating through traces, you may not need this list.

您的客户端和 Office 365 之间的流量通过 TLS 传播,这意味着在常规 Netmon 跟踪中,流量的正文将被加密且不可读。Traffic between your client and Office 365 travels via TLS, which means that the body of the traffic will be encrypted and not readable in a generic Netmon trace. 您的性能分析不需要知道数据包中的信息的细节。Your performance analysis doesn't need to know the specifics of the information in the packet. 但是,它非常关注数据包标头及其包含的信息。It is, however, very interested in packet headers and the information that they contain.

获取正确跟踪的提示Tips to get a good trace

  • 了解客户端计算机的 IPv4 或 IPv6 地址的值。Know the value of the IPv4 or IPv6 address of your client computer. 您可以在命令提示符下,键入IPConfig ,然后按 enter 获取。You can get this from the command prompt by typing IPConfig and then pressing ENTER. 了解此地址将使您能够一目了然地了解跟踪中的流量是否直接涉及客户端计算机。Knowing this address will let you tell at a glance whether the traffic in the trace directly involves your client computer. 如果有已知代理,请将其 ping 并获取其 IP 地址。If there is a known proxy, ping it and get its IP address as well.

  • 刷新 DNS 解析器缓存,并在可能的情况下关闭运行测试的所有浏览器之外的其他所有浏览器。Flush your DNS resolver cache and, if possible, close all browsers except the one in which you are running your tests. 如果您无法执行此操作,例如,如果支持使用一些基于浏览器的工具来查看您的客户端计算机的桌面,请准备筛选您的跟踪。If you are not able to do this, for instance, if support is using some browser-based tool to see your client computer's desktop, be prepared to filter your trace.

  • 在繁忙跟踪中,找到您正在使用的 Office 365 服务。In a busy trace, locate the Office 365 service that you're using. 如果以前从未或很少看到你的流量,则在将性能问题与其他网络噪音区分开来时,这是一个非常有用的步骤。If you've never or seldom seen your traffic before, this is a helpful step in separating the performance issue from other network noise. 有几种方法可以实现此目的。There are a few ways to do this. 在测试之前,您可以将_ping_或_PsPing_用于特定服务的 URL (ping outlook.office365.com psping -4 microsoft-my.sharepoint.com:443例如)。Directly before your test, you can use ping or PsPing against the URL of the specific service (ping outlook.office365.com or psping -4 microsoft-my.sharepoint.com:443, for example). 您还可以轻松地在 Netmon 跟踪(按进程名称)中找到 ping 或 PsPing。You can also easily find that ping or PsPing in a Netmon trace (by its process name). 这将为您提供开始查看的位置。That will give you a place to start looking.

如果在出现问题时仅使用 Netmon 跟踪,那也没关系。If you're only using Netmon tracing at the time of the problem, that's okay too. 若要自己定位,请使用类似ContainsBin(FrameData, ASCII, "office")ContainsBin(FrameData, ASCII, "outlook")或的筛选器。To orient yourself, use a filter like ContainsBin(FrameData, ASCII, "office") or ContainsBin(FrameData, ASCII, "outlook"). 您可以从跟踪文件中记录您的帧编号。You can record your frame number from the trace file. 您可能还需要将 "帧摘要" 窗格一直滚动到右侧,并查找 "会话 ID" 列。You may also want to scroll the Frame Summary pane all the way to the right and look for the Conversation ID column. 此特定对话的 ID 指示有一个数字,您还可以在以后记录和查看。There is a number indicated there for the ID of this specific conversation that you can also record and look at in isolation later. 请记住在应用任何其他筛选之前删除此筛选器。Remember to remove this filter before applying any other filtering.

提示

Netmon 有许多有用的内置筛选器。Netmon has a lot of helpful built-in filters. 尝试_显示_筛选窗格顶部的 "加载筛选器" 按钮。Try the Load Filter button at the top of the Display filter pane.

在客户端计算机上的命令行中使用 PSPing 查找您的 IP。

来自客户端的 Netmon 跟踪通过筛选器 TCP 显示相同的 PSPing 命令。标记(Syn = = 1)。

熟悉您的流量,并了解如何查找所需的信息。Get familiar with your traffic, and learn to locate the information you need. 例如,了解如何确定跟踪中的哪个数据包具有对所使用的 Office 365 服务的第一个引用(如 "Outlook")。For example, learn to determine which packet in the trace has the first reference to the Office 365 service you're using (like "Outlook").

以 Office 365 Outlook Online 为例,流量的开始部分如下所示:Taking Office 365 Outlook Online as an example, the traffic begins something like this:

  • 具有匹配 QueryIDs 的 outlook.office365.com 的 DNS 标准查询和 DNS 响应。DNS Standard Query and DNS Response for outlook.office365.com with matching QueryIDs. 请务必注意此转换的时间偏移量,以及 Office 365 全局 DNS 发送请求进行名称解析的位置。It's important to note the time offset for this turn-around, as well as where in the world the Office 365 Global DNS sends the request for name resolution. 理想情况下,尽量在本地进行,而不是世界的一半。Ideally, as locally as possible, rather than halfway across the world.

  • 其状态报告被永久移动的 HTTP GET 请求(301)A HTTP GET Request whose status report Moved Permanently (301)

  • X-RWS-VERSION 流量包括 X-RWS-VERSION Connect 请求和连接答复。RWS Traffic including RWS Connect requests and Connect replies. (这是远程 Winsock 为你建立连接。)(This is Remote Winsock making a connection for you.)

  • TCP SYN 和 TCP SYN/ACK 对话。A TCP SYN and TCP SYN/ACK conversation. 此对话中的很多设置会影响性能。A lot of the settings in this conversation impact your performance.

  • 然后,一系列 TLS: tls 流量,即 TLS 握手和 TLS 证书对话发生的位置。Then a series of TLS:TLS traffic which is where the TLS handshake and TLS certificate conversations take place. (请记住,数据是通过 SSL/TLS 进行加密的。)(Remember the data is encrypted via SSL/TLS.)

流量的所有部分都很重要且已连接,但跟踪量的较小部分包含有关性能故障排除的信息。因此,我们将重点放在这些区域。All parts of the traffic are important and connected, but small portions of the trace contain information particularly important in terms of performance troubleshooting, so we'll focus on those areas. 此外,由于我们在 Microsoft 完成了足够多的 Office 365 性能故障排除,因此,我们将重点介绍这些问题,以及如何使用我们必须将其排除在下一步下的各种工具。Also, since we've done enough Office 365 performance troubleshooting at Microsoft to compile a Top Ten list of common problems, we'll focus on those issues and how to use the tools we have to root them out next.

如果尚未将其安装就绪,则下面的矩阵将使用多个工具。If you haven't installed them all ready, the matrix below makes use of several tools. 如果可能。Where possible. 向安装点提供了链接。Links are provided to the installation points. 此列表包含常见的网络跟踪工具,如NetmonWireshark,但使用您熟悉的任何跟踪工具,并且您习惯于筛选网络流量。The list includes common network tracing tools like Netmon and Wireshark, but use any tracing tool you are comfortable with, and in which you're accustomed to filtering network traffic. 在测试时,请记住:When you're testing, remember:

  • 关闭浏览器并在仅运行一个浏览器的情况下进行测试-这将减少捕获的总体流量。Close your browsers, and test with only one browser running - This will reduce the overall traffic you capture. 它可用于较差的跟踪。It makes for a less busy trace.
  • 在客户端计算机上刷新您的 DNS 解析器缓存-这将在你开始获取捕获时为你提供干净的盖板,以获取更干净的跟踪。Flush your DNS resolver cache on the client computer - This will give you a clean slate when you start to take your capture, for a cleaner trace.

常见问题Common issues

你可能会遇到的一些常见问题以及如何在网络跟踪中查找这些问题。Some common issues you may face and how to find them in your Network trace.

TCP 窗口缩放TCP Windows Scaling

在 SYN-SYN/ACK 中找到。Found in the SYN - SYN/ACK. 旧的或过时的硬件可能无法利用 TCP windows 缩放。Legacy or aging hardware may not take advantage of TCP windows scaling. 如果没有正确的 TCP 窗口缩放设置,TCP 标头中的默认16位缓冲区将以毫秒为单位填充。Without proper TCP windows scaling settings, the default 16-bit buffer in TCP headers fills in milliseconds. 在客户端收到已收到原始数据的确认后,流量将无法继续发送,从而导致延迟。Traffic cannot continue to send until the client receives an acknowledgment that the original data has been received, causing delays.

工具Tools

  • NetmonNetmon
  • WiresharkWireshark

要查找的内容What to look for

在网络跟踪中查找 SYN-SYN/ACK 流量。Look for the SYN - SYN/ACK traffic in your network trace. 在 Netmon 中,使用类似tcp.flags.syn == 1的筛选器。In Netmon, use a filter like tcp.flags.syn == 1. 此筛选器在 Wireshark 中是相同的。This filter is the same in Wireshark.

在 Netmon 或 Wireshark 中筛选两个工具的 Syn 数据包: TCP。标记(Syn = = 1)。

请注意,对于每个 SYN,都会在相关确认(SYN/ACK)的目标端口(Udp.dstport)中匹配一个源端口(Udp.srcport)编号。Notice that for every SYN there is a source port (SrcPort) number that is matched in the destination port (DstPort) of the related Acknowledgment (SYN/ACK).

若要查看你的网络连接使用的 Windows 缩放值,请先展开 SYN,然后再展开相关的 SYN/ACK。To see the Windows Scaling value that is used by your network connection, expand first the SYN, and then the related SYN/ACK.

显示如何将 Udp.srcport 匹配到跟踪中的 Udp.dstport 的图形,以获取时间增量。

TCP 空闲时间设置TCP Idle Time Settings

在过去,大多数外围网络都配置为暂时连接,这意味着空闲连接通常会终止。Historically, most perimeter networks are configured for transient connections, meaning idle connections are generally terminated. 在超过100到300秒的代理和防火墙可以终止空闲的 TCP 会话。Idle TCP sessions can be terminated by proxies and firewalls at greater than 100 to 300 seconds. 这对于 Outlook Online 来说是有问题的,因为它会创建和使用长期连接(无论它们是否处于空闲状态)。This is problematic for Outlook Online because it creates and uses long-term connections, whether they are idle or not.

当代理或防火墙设备终止连接时,将不会通知客户端,并且尝试使用 Outlook Online 意味着客户端计算机将在 revive 连接之前尝试进行新的连接,然后再创建一个新的连接。When connections are terminated by proxy or firewall devices, the client is not informed, and an attempt to use Outlook Online will mean a client computer will try, repeatedly, to revive the connection before making a new one. 在页面加载时,您可能会看到产品挂起、提示或降低性能。You may see hangs in the product, prompts, or slow performance on page load.

工具Tools

  • NetmonNetmon
  • WiresharkWireshark

要查找的内容What to look for

在 Netmon 中,查看往返行程的 "时间偏移量" 字段。In Netmon, look at the Time Offset field for a round-trip. 往返行程是客户端向服务器发送请求并接收响应的时间。A round-trip is the time between client sending a request to the server and receiving a response back. 在客户端和传出点之间进行检查(例如Check between the Client and the egress point (ex. 客户端-> -代理)或客户端到 Office 365 (客户端-> ---------office 365)。Client --> Proxy), or the Client to Office 365 (Client --> Office 365). 您可以在多种类型的数据包中看到此情况。You can see this in many types of packets.

例如,Netmon 中的筛选器可能如下所示.Protocol.IPv4.Address == 10.102.14.112 AND .Protocol.IPv4.Address == 10.201.114.12,或在 Wireshark 中ip.addr == 10.102.14.112 &amp;&amp; ip.addr == 10.201.114.12As an example, the filter in Netmon may look like .Protocol.IPv4.Address == 10.102.14.112 AND .Protocol.IPv4.Address == 10.201.114.12, or, in Wireshark, ip.addr == 10.102.14.112 &amp;&amp; ip.addr == 10.201.114.12.

提示

不知道跟踪中的 IP 地址是否属于您的 DNS 服务器?Don't know if the IP address in your trace belongs to your DNS server? 请尝试在命令行上进行查找。Try looking it up at the command line. 单击 "开始 > 运行 > " 并键入cmd,或按Windows 键 >并键入cmdClick Start > Run > and type cmd, or press Windows Key > and type cmd. 在提示符处,键入nslookup <the IP address from the network trace>At the prompt, type nslookup <the IP address from the network trace>. 若要进行测试,请对自己的计算机的 IP 地址使用 nslookup。To test, use nslookup against your own computer's IP address. > 若要查看 Microsoft IP 范围的列表,请参阅Office 365 url 和 IP 地址范围> To see a list of Microsoft's IP ranges, see Office 365 URLs and IP address ranges.

如果出现问题,则预计会出现长时间偏移,在此示例中(Outlook Online),尤其是在 TLS:显示应用程序数据的这一阶段的 TLS 数据包(例如,在 Netmon 中,可以通过.Protocol.TLS AND Description == "TLS:TLS Rec Layer-1 SSL Application Data")查找应用程序数据。If there is a problem, expect long Time Offsets to appear, in this case (Outlook Online), particularly in TLS:TLS packets that show the passage of Application Data (for example, in Netmon you can find application data packets via .Protocol.TLS AND Description == "TLS:TLS Rec Layer-1 SSL Application Data"). 您应该会在会话过程中看到进展顺利。You should see a smooth progression in the time across the session. 如果您在刷新 Outlook Online 时看到长时间延迟,则可能是由于发送的重置次数过高而导致的。If you see long delays when refreshing your Outlook Online, this could be caused by a high degree of resets being sent.

延迟/往返时间Latency/Round Trip Time

延迟是一种可根据许多变量(如升级老化设备、向网络中添加大量用户以及网络连接上的其他任务消耗的总体带宽百分比)来更改大量的度量。Latency is a measure that can change a lot depending on many variables, such upgrading aging devices, adding a large number of users to a network, and the percentage of overall bandwidth consumed by other tasks on a network connection.

在此网络规划和 "office 365 的性能调整" 页面中,有适用于 office 365 的带宽计算器。There are bandwidth calculators for Office 365 available from this Network planning and performance tuning for Office 365 page.

需要衡量你的连接速度,还是你的 ISP 连接的带宽?Need to measure the speed of your connection, or your ISP connection's bandwidth? 尝试此网站(或网站,如网站): Speedtest 官方网站,或查询短语速度测试的您喜爱的搜索引擎。Try this site (or sites like it): Speedtest Official Site, or query your favorite search engine for the phrase speed test.

工具Tools

  • PingPing
  • PsPingPsPing
  • NetmonNetmon
  • WiresharkWireshark

要查找的内容What to look for

若要跟踪跟踪中的延迟,您将受益于在 Office 365 中记录了客户端计算机 IP 地址和 DNS 服务器的 IP 地址。To track latency in a trace, you will benefit from having recorded the client computer IP address and the IP address of the DNS server in Office 365. 这旨在简化跟踪筛选的目的。This is for the purpose of easier trace filtering. 如果通过代理连接,将需要客户端计算机 IP 地址、代理/传出 IP 地址和 Office 365 DNS IP 地址,以使工作更容易。If you connect through a proxy, you will need your client computer IP address, the proxy/egress IP address, and the Office 365 DNS IP address, to make the work easier.

发送到 outlook.office365.com 的 ping 请求将告知您接收请求的数据中心的名称,即使 ping可能无法连接以发送商标连续 ICMP 数据包。A ping request sent to outlook.office365.com will tell you the name of the datacenter receiving the request, even if ping may not be able to connect to send the trademark consecutive ICMP packets. 如果使用 PsPing (用于下载的免费工具),并且特定端口(443),并且可能使用 IPv4 (-4),则会为发送的数据包获取平均往返时间。If you use PsPing (a free tool for download), and specific the port (443) and perhaps to use IPv4 (-4) you will get an average round-trip-time for packets sent. 这将对 Office 365 服务中的其他 Url (如psping -4 yourSite.sharepoint.com:443)执行此操作。This will work this for other URLs in the Office 365 services, like psping -4 yourSite.sharepoint.com:443. 事实上,您可以指定多个 ping 以获取更大的采样示例,请尝试类似psping -4 -n 20 yourSite-my.sharepoint.com:443的操作。In fact, you can specify a number of pings to get a larger sample for your average, try something like psping -4 -n 20 yourSite-my.sharepoint.com:443.

备注

PsPing 不发送 ICMP 数据包。PsPing doesn't send ICMP packets. 通过特定端口对 TCP 数据包执行 ping 操作,以便您可以使用任何已知的打开方式。It pings with TCP packets over a specific port, so you can use any one you know to be open. 在使用 SSL/TLS 的 Office 365 中,尝试将端口:443附加到你的 PsPing。In Office 365, which uses SSL/TLS, try attaching port :443 to your PsPing.

显示 ping 解析 outlook.office365.com 的屏幕截图和443的 PSPing 执行相同的操作,同时还报告6.5 毫秒平均 RTT。

如果在执行网络跟踪时已加载 "执行速度较慢的 Office 365" 页面,则应筛选 Netmon 或DNSWireshark 跟踪。If you loaded the slow performing Office 365 page while doing a network trace, you should filter a Netmon or Wireshark trace for DNS. 这是我们要查找的 IPs 之一。This is one of the IPs we're looking for.

下面是筛选 Netmon 以获取 IP 地址的步骤(并查看 DNS 延迟)。Here are the steps to take to filter your Netmon to get the IP address (and take a look at DNS Latency). 此示例使用 outlook.office365.com,但也可以使用 SharePoint Online 租户的 URL (例如,hithere.sharepoint.com)。This example uses outlook.office365.com, but may also use the URL of a SharePoint Online tenant (hithere.sharepoint.com for example).

  1. Ping URL ping outlook.office365.com ,并在结果中记录向其发送 ping 请求的 DNS 服务器的名称和 IP 地址。Ping the URL ping outlook.office365.com and, in the results, record the name and IP address of the DNS server the ping request was sent to.
  2. 网络跟踪打开页面,或执行性能问题的操作,或者,如果你在 ping 上看到过高的延迟,它本身就是网络跟踪。Network trace opening the page, or doing the action that gives you the performance problem, or, if you see a high latency on the ping, itself, network trace it.
  3. 在 Netmon 中打开跟踪并筛选 DNS (此筛选器也适用于 Wireshark,但区分大小写-- dns)。Open the trace in Netmon and filter for DNS (this filter also works in Wireshark, but is sensitive to case -- dns). 由于你知道你的 ping 中的 DNS 服务器的名称,因此你也可以在 Netmon 中筛选更多DNS AND ContainsBin(FrameData, ASCII, "namnorthwest")的 speedily,如下所示:,在 Wireshark DNS 中和 frame 包含 "namnorthwest" 这种情况下。Since you know the name of the DNS server from your ping you may also filter more speedily in Netmon like this: DNS AND ContainsBin(FrameData, ASCII, "namnorthwest"), which looks like this in Wireshark dns and frame contains "namnorthwest".
    打开响应数据包,并在 "Netmon帧详细信息" 窗口中,单击 " DNS " 以展开以获取详细信息。Open the response packet and, in the Netmon Frame Details window, click DNS to expand for more information. 在 DNS 信息中,您将找到在 Office 365 中请求进入的 DNS 服务器的 IP 地址。In the DNS information you'll find the IP address of the DNS server the request went to in Office 365. 下一步(PsPing 工具)将需要此 IP 地址。You'll need this IP address for the next step (the PsPing tool). 删除筛选器,请右键单击 Netmon 中的 dns 响应(帧摘要 > "查找对话 > DNS")以查看 DNS 查询和响应并行。Remove the filter, right-click on the DNS Response in Netmon (Frame Summary > Find Conversations > DNS) to see the DNS Query and Response side-by-side.
  4. 在 Netmon 中,还请注意 DNS 请求和响应之间的时间偏移列。In Netmon, also note the Time Offset column between the DNS Request and Response. 在下一步中,易于安装和使用的PsPing工具非常方便,这是因为 ICMP 通常在防火墙上被阻止,并且 PsPing elegantly 跟踪延迟(以毫秒为单位)。In the next step, the easy-to-install and use PsPing tool comes in very handy, both because ICMP is often blocked on Firewalls, and because PsPing elegantly tracks latency in milliseconds. PsPing 完成到地址和端口的 TCP 连接(在我们的示例中,打开端口443)。PsPing completes a TCP connection to an address and port (in our case open port 443).
  5. 安装 PsPing。Install PsPing.
  6. 打开命令提示符(启动> "运行>类型 Cmd" 或 "Windows >键类型 cmd"),并将目录更改为您在其中安装 PsPing 的目录以运行 PsPing 命令。Open a command prompt (Start > Run > type cmd, or Windows Key > type cmd) and change directory to the directory where you installed PsPing to run the PsPing command. 在我的示例中,您可以看到我在 C 的根目录上建立了 ' Perf ' 文件夹。您可以进行相同的快速访问。In my examples you can see I made a 'Perf' folder on the root of C. You can do the same for quick access.
  7. 键入命令,以便您可以根据早期 Netmon 跟踪(包括端口号)对 Office 365 DNS 服务器的 IP 地址进行 PsPing psping -n 20 132.245.24.82:445Type the command so that you're making your PsPing against the IP address of the Office 365 DNS server from your earlier Netmon trace, including the port number, like psping -n 20 132.245.24.82:445. 这将为您提供20个 ping 采样和平均延迟在 PsPing 停止时的采样。This will give you a sampling of 20 pings and average the latency when PsPing stops.

如果通过代理服务器转到 Office 365,则步骤略有不同。If you're going to Office 365 through a proxy server, the steps are a little different. 您将首先 PsPing 代理服务器,以毫秒为单位获取代理/传出和回退的平均延迟值,然后在代理上运行 PsPing,或者在具有直接 Internet 连接的计算机上运行以获取缺少的值(即 Office 365 和后端)。You would first PsPing to your proxy server to get an average latency value in milliseconds to proxy/egress and back, and then either run PsPing on the proxy, or on a computer with a direct Internet connection to get the missing value (the one to Office 365 and back).

如果您选择从代理运行 PsPing,则会有两个毫秒的值:客户端计算机到代理服务器或传出点,以及代理服务器到 Office 365。If you choose to run PsPing from the proxy, you'll have two millisecond values: Client computer to proxy server or egress point, and proxy server to Office 365. 你已经完成了!And you're done! 当然,仍应记录值。Well, recording values, anyway.

如果在连接到 Internet 的直接连接的另一台客户端计算机上运行 PsPing (即,没有代理),则会有两个毫秒的值:客户端计算机到代理服务器或传出点,以及客户端计算机到 Office 365。If you run PsPing on another client computer that has a direct connection to the Internet, that is, without a proxy, you will have two millisecond values: Client computer to proxy server or egress point, and client computer to Office 365. 在这种情况下,将客户端计算机的值从客户端365计算机的值中减去到代理服务器或传出点,并将 RTT 编号从客户端计算机到代理服务器或传出点,以及从代理服务器或传出点到 Office 365。In this case, subtract the value of client computer to proxy server or egress point from the value of client computer to Office 365, and you will have the RTT numbers from your client computer to the proxy server or egress point, and from proxy server or egress point to Office 365.

但是,如果您可以在受影响的直接连接位置找到客户端计算机,或者绕过代理,您可以选择是否在此处重现问题,以开始使用,并在此后进行测试。However, if you can find a client computer in the impacted location that is directly connected, or bypasses the proxy, you may choose to see if the issue reproduces there to begin with, and test using it thereafter.

延迟(如 Netmon 跟踪中所示),如果任何给定会话中有足够的时间,则这些额外的毫秒数可能会增加。Latency, as seen in a Netmon trace, those extra milliseconds can add up, if there are enough of them in any given session.

Netmon 中的常规延迟,其中包括添加到“帧摘要”的 Netmon 默认“时间差”列。

备注

你的 IP 地址可能与此处显示的 IPs 不同,例如,你的 ping 可能会返回更像 157.56.0.0/16 或类似范围的内容。Your IP address may be different than the IPs shown here, for example, your ping may return something more like 157.56.0.0/16 or a similar range. 有关 Office 365 使用的范围列表,请查看office 365 url 和 IP 地址范围For a list of ranges used by Office 365, check out Office 365 URLs and IP address ranges.

如果要搜索,请记住展开所有节点(顶部有一个按钮),例如,132.245。Remember to expand all the nodes (there's a button at the top for this) if you want to search for, for example, 132.245.

代理身份验证Proxy Authentication

这仅适用于您正在通过代理服务器的情况。This only applies to you if you're going through a proxy server. 如果不是,则可以跳过这些步骤。If not, you can skip these steps. 正常工作时,代理身份验证应以毫秒为单位持续进行。When working properly, proxy authentication should take place in milliseconds, consistently. 在高峰使用时段内不应看到间歇性的坏性能(例如)。You shouldn't see intermittent bad performance during peak usage periods (for example).

如果启用了代理身份验证,则每次建立到 Office 365 的新 TCP 连接以获取信息时,您需要通过幕后的身份验证过程进行传递。If Proxy authentication is on, each time you make a new TCP connection to Office 365 to get information, you need to pass through an authentication process behind the scenes. 因此,例如,当从 Outlook Online 中的 "日历" 切换到 "邮件" 时,您将进行身份验证。So, for example, when switching from Calendar to Mail in Outlook Online, you will authenticate. 在 SharePoint Online 中,如果页面显示来自多个网站或位置的媒体或数据,则将针对呈现数据所需的每个不同 TCP 连接进行身份验证。And in SharePoint Online, if a page displays media or data from multiple sites or locations, you will authenticate for each different TCP connection that is needed in order to render the data.

在 Outlook Online 中,只要您在 "日历" 和 "邮箱" 之间切换或在 SharePoint Online 中缓慢页面加载,就可能会遇到负载缓慢的情况。In Outlook Online, you may experience slow load times whenever you switch between Calendar and your mailbox, or slow page loads in SharePoint Online. 但是,还有其他一些症状未在此处列出。However, there are other symptoms not listed here.

代理身份验证是您的出口代理服务器上的一项设置。Proxy authentication is a setting on your egress proxy server. 如果它导致 Office 365 出现性能问题,则必须咨询网络团队。If it is causing a performance issue with Office 365, you must consult your networking team.

工具Tools

  • NetmonNetmon
  • WiresharkWireshark

要查找的内容What to look for

无论何时新的 TCP 会话都必须旋转(通常是从服务器请求文件或信息)或提供信息,都会发生代理身份验证。Proxy authentication takes place whenever a new TCP session must be spun up, commonly to request files or info from the server, or to supply info. 例如,您可能会看到有关 HTTP GET 或 HTTP POST 请求的代理身份验证。For example, you may see proxy authentication around HTTP GET or HTTP POST requests. 如果要查看在跟踪中对请求进行身份验证的帧,请将 "NTLMSSP 摘要" 列添加到 Netmon 并筛选.property.NTLMSSPSummaryIf you want to see the frames where you are authenticating requests in your trace, add the 'NTLMSSP Summary' column to Netmon and filter for .property.NTLMSSPSummary. 若要查看身份验证所花费的时间,请添加时间增量列。To see how long the authentication is taking, add the Time Delta column.

将列添加到 Netmon:To add a column to Netmon:

  1. 右键单击某个列,如 "说明"。Right-click on a column such as Description.
  2. 单击 "选择列"。Click Choose Columns.
  3. 在列表中找到_NTLMSSP Summary_和_Time Delta_ ,然后单击 "添加"。Locate NTLMSSP Summary and Time Delta in the list and click Add.
  4. 将新列移到 "说明" 列之前或之后,以便您可以并排阅读它们。Move the new columns into place before or behind the Description column so you can read them side-by-side.
  5. 单击“确定”。Click OK.

即使不添加列,Netmon 筛选也能正常运行。Even if you don't add the column, the Netmon filter will work. 但是,如果你可以看到你的身份验证阶段,你的故障排除将会大大简化。But your troubleshooting will be much easier if you can see what stage of authentication you're in.

在查找代理身份验证的实例时,请务必研究存在 NTLM 质询的所有帧,或者存在身份验证消息。When looking for instances of Proxy Authentication, be sure to study all frames where there is an NTLM Challenge, or an Authenticate Message is present. 如有必要,请右键单击特定的流量,然后查找 " >对话 TCP"。If necessary, right-click the specific piece of traffic and Find Conversations > TCP. 请注意这些对话中的时间增量值。Be aware of the Time Delta values in these Conversations.

显示按对话筛选的代理身份验证的 Netmon 跟踪。

代理身份验证中的四秒延迟,如 Wireshark 中所示。A four second delay in proxy authentication as seen in Wireshark. 通过在 "帧详细信息" 中右键单击具有相同名称的字段,然后选择 "添加为列",可在以前显示的框架列中进行时间增量。The Time delta from previous displayed frame column was made via right-clicking the field of the same name in the frame details and selecting Add as Column.
在 Wireshark 中,可以通过在 "帧详细信息" 中右键单击具有相同名称的字段,然后选择 "添加为列" 来生成 "上一次显示的帧的时间增量" 列。In Wireshark, the 'Time delta from previous displayed frame' column can be made via right-clicking the field of the same name in the frame details and selecting Add as Column.

DNS 性能DNS Performance

在尽可能接近客户端国家/地区时,名称解析的工作速度最佳。Name resolution works best and most quickly when it takes place as close to the client's country as possible.

如果 DNS 名称解析在海外进行,则可以在页面负载中添加秒数。If DNS name resolution is taking place overseas, it can add seconds to page loads. 理想情况下,名称解析发生在100毫秒下。Ideally, name resolution happens in under 100ms. 如果不是,则应进行进一步调查。If not, you should do further investigation.

提示

不确定客户端连接在 Office 365 中的工作原理是什么?Not sure how Client Connectivity works in Office 365? 请查看此处的客户端连接参考文档。Take a look at the Client Connectivity Reference document here.

工具Tools

  • NetmonNetmon
  • WiresharkWireshark
  • PsPingPsPing

要查找的内容What to look for

分析 DNS 性能通常是网络跟踪的另一个作业。Analyzing DNS performance is typically another job for a network trace. 但是,PsPing 在可能的原因中或可能的原因中也很有帮助。However, PsPing is also helpful in ruling in, or out, a possible cause.

DNS 流量基于 TCP,并且 UDP 请求和响应使用 ID 进行清楚标记,以帮助将特定请求与特定的响应匹配。DNS traffic is based on TCP and UDP requests and responses are clearly marked with an ID that will help to match a specific request with its specific response. 例如,当 SharePoint Online 在网页上使用网络名称或 URL 时,您将看到 DNS 通信。You'll see DNS traffic when, for example, SharePoint Online uses a network name or URL on a web page. 作为经验的规则,除了在传输区域时,通过 UDP 运行之外的大部分流量。As a rule of thumb, most of this traffic, except when transferring Zones, runs over UDP.

在 Netmon 和 Wireshark 中,最基本的筛选器只dns允许您查看 DNS 流量。In both Netmon and Wireshark, the most basic filter that will let you look at DNS traffic is simply dns. 指定筛选器时,请务必使用小写字母。Be sure to use lower case when specifying the filter. 在开始在客户端计算机上重现问题之前,请务必刷新 DNS 解析器缓存。Remember to flush your DNS resolver cache before you begin to reproduce the issue on your client computer. 例如,如果主页的 SharePoint Online 页面加载速度较慢,则应关闭所有浏览器、打开新的浏览器、启动跟踪、刷新 DNS 解析器缓存,然后浏览到 SharePoint Online 网站。For example, if you have a slow SharePoint Online page load for the Home page, you should close all browsers, open a new browser, start tracing, flush your DNS resolver cache, and browse to your SharePoint Online site. 整个页面解析后,应停止并保存该跟踪。Once the entire page resolves, you should stop and save the trace.

在 Netmon 中,DNS 的基本筛选器是 DNS。

您想要查看此处的时间偏移量。You want to look at the time offset here. 将 "时间增量" 列添加到 Netmon 中可能会有所帮助,具体方法是通过完成以下步骤来完成:And it may be helpful to add the Time Delta column to Netmon which you can do by completing these steps:

  1. 右键单击某个列,如 "说明"。Right-click on a column such as Description.
  2. 单击 "选择列"。Click Choose Columns.
  3. 在列表中找到_时间 Delta_ ,然后单击 "添加"。Locate Time Delta in the list and click Add.
  4. 将新列移到 "说明" 列之前或之后,以便您可以并排阅读它们。Move the new column into place before or behind the Description column so you can read them side-by-side.
  5. 单击“确定”。Click OK.

如果找到感兴趣的查询,请考虑将其隔离,具体方法是在 "框架详细信息" 面板中右键单击该查询,然后选择 "查找对话 > DNS"。If you find a query of interest, consider isolating it by right-clicking that query in the frame details panel, choosing Find Conversations > DNS. 请注意,网络对话面板将直接跳转到其 UDP 流量日志中的特定对话。Notice that the Network Conversations panel jumps right to the specific conversation in its log of UDP traffic.

通过 DNS 筛选出的 Outlook Online 负载的 Netmon 跟踪,并使用 "查找对话" DNS 来缩小结果范围。

在 Wireshark 中,可以将列用于 DNS 时间。In Wireshark you can make a column for DNS time. 将跟踪(或打开跟踪)放在 Wireshark 中,然后按dns、或,更 helpfully 的dns.time方式进行筛选。Take your trace (or open a trace) in Wireshark and filter by dns, or, more helpfully, dns.time. 单击任意 DNS 查询,并在显示详细信息的面板中展开Domain Name System (response)详细信息。Click on any DNS query, and, in the panel showing details, expand the Domain Name System (response) details. 你将看到 "时间" 字段(例如," [Time: 0.001111100 seconds]"。You'll see a field for time (for example, [Time: 0.001111100 seconds]. 右键单击此时间并选择 "应用为列"。Right-click this time and select Apply as Column. 这将为您提供一个时间栏,以便更快地对跟踪进行排序。This will give you a Time column for quicker sorting of your trace. 单击 "新建" 列按降序排列值,以查看哪个 DNS 调用所用时间最长。Click on the new column to sort by descending values to see which DNS call took the longest to resolve.

按照 dns.time(小写)在 Wireshark 中筛选的 SharePoint Online 的浏览,其中包含将详细信息插入到某个列以及按升序进行排序的时间。A browse of SharePoint Online filtered in Wireshark by (lowercase) dns.time, with the time from the details made into a column and sorted ascending.

如果要对 DNS 解析时间进行更多调查,请尝试使用 TCP 使用的 DNS 端口的 PsPing (例如, psping <IP address of DNS server>:53)。If you would like to do more investigation of the DNS resolution time, try a PsPing against the DNS port used by TCP (for example, psping <IP address of DNS server>:53) . 您是否仍会看到性能问题?Do you still see a performance issue? 如果这样做,则问题更可能比特定的要解决的 DNS 应用程序的问题更广泛:网络问题更大。If you do, then the problem is more likely to be a broader network issue than an issue of specific the DNS application you're hitting to do resolution. 此外,还值得一提的一点是,ping 到 outlook.office365.com 将告诉你发生 Outlook Online 的 DNS 名称解析的位置(例如,outlook-namnorthwest.office365.com)。It's also worth mentioning, again, that a ping to outlook.office365.com will tell you where DNS name resolution for Outlook Online is taking place (for example, outlook-namnorthwest.office365.com).

如果问题看起来是 DNS 特定的,则可能需要联系 IT 部门以查看 DNS 配置和 DNS 转发器,以便进一步调查此问题。If the issue looks to be DNS specific, it may be necessary to contact your IT department to look at DNS configurations and DNS Forwarders to further investigate this issue.

代理可伸缩性Proxy Scalability

Office 365 中的 Outlook Online 之类的服务向客户端授予多个长期连接。Services like Outlook Online in Office 365 grant clients multiple long-term connections. 因此,每个用户可能会使用需要较长寿命的更多连接。Therefore, each user may use more connections that require a longer life.

工具Tools

数学Math

要查找的内容What to look for

没有特定于此的网络跟踪或故障排除工具。There is no network trace or troubleshooting tool specific to this. 相反,它基于给定限制和其他变量的带宽计算。Instead, it's based upon bandwidth calculations given limitations and other variables.

TCP 最大段大小TCP Max Segment Size

在 SYN-SYN/ACK 中找到。Found in the SYN - SYN/ACK. 在您采取的任何性能网络跟踪中执行此操作,以确保将 TCP 数据包配置为尽可能地携带最大数据量。Do this check in any performance network trace you've taken to ensure that TCP packets are configured to carry the maximum amount of data possible.

目标是查看用于传输数据的 MSS 为1460字节的 MSS。The goal is to see a MSS of 1460 bytes for transmission of data. 如果您使用的是代理,或者您使用的是 NAT,请务必从客户端到代理/传出/NAT 运行此测试,以及从代理/传出/NAT 到 Office 365,以获得最佳结果!If you're behind a proxy, or you are using a NAT, remember to run this test from client to proxy/egress/NAT, and from proxy/egress/NAT to Office 365 for best results! 这些是不同的 TCP 会话。These are different TCP sessions.

工具Tools

NetmonNetmon

要查找的内容What to look for

TCP Max 段大小(MSS)是网络跟踪中的三向握手的另一个参数,这意味着您将在 SYN-SYN/ACK 数据包中找到所需的数据。TCP Max Segment Size (MSS) is another parameter of the three-way handshake in your network trace, that means you'll find the data you need in the SYN - SYN/ACK packet. MSS 实际上相当简单,可以查看。MSS is actually pretty simple to see.

打开您拥有的任何性能网络跟踪,并查找您想要了解的连接,或者演示性能问题。Open any performance network trace you have and find the connection you're curious about, or that demonstrates the performance problem.

备注

如果要查看跟踪,并需要查找与对话相关的流量,请按客户端 IP 或代理服务器或传出点的 IP 或代理服务器或传出点的 IP 进行筛选。If you are looking at a trace and need to find the traffic relevant to your conversation, filter by the IP of the Client, or the IP of the proxy server or egress point, or both. 直接执行此操作,您需要在跟踪中 ping 正在测试的 Office 365 的 IP 地址的 URL,并按其进行筛选。Going directly, you will need to ping the URL that you're testing for the IP address of Office 365 in the trace, and filter by it.

是否要再次查看跟踪?Looking at the trace second-hand? 请尝试使用筛选器来为你的方向定位。Try using filters to orient yourself. 在 Netmon 中,根据 URL 运行搜索,例如Containsbin(framedata, ascii, "sphybridExample"),记下帧编号。In Netmon, run a search based on the URL, such as Containsbin(framedata, ascii, "sphybridExample"), take note of the frame number.

在 Wireshark 中使用类似frame contains "sphybridExample"的内容。In Wireshark use something like frame contains "sphybridExample". 如果您发现已找到远程 Winsock (X-RWS-VERSION)流量(它可能在 Wireshark 中显示为 [PSH,ACK]),请记住,在相关的 SYN-SYN/Ack 之前,可能会看到 X-RWS-VERSION 连接,如前文所述。If you notice that you've found Remote Winsock (RWS) traffic (it may appear as a [PSH, ACK] in Wireshark), remember that RWS connects can be seen shortly before relevant SYN - SYN/ACKs, as discussed earlier.

此时,您可以记录帧编号,删除筛选器,单击 Netmon 中的 "网络对话" 窗口中的 "所有通信" 以查看最接近的 SYN。At this point, you can record the frame number, drop the filter, click All Traffic in the Network Conversations window in Netmon to look at the nearest SYN.

重要的是,如果在跟踪时没有收到任何 IP 地址信息,则在跟踪中查找您的 URL (例如sphybridExample-my.sharepoint.com,部分)将为您提供用于筛选的 ip 地址。Importantly, if you didn't receive any of the IP address information at the time of the trace, finding your URL in the trace (part of sphybridExample-my.sharepoint.com, for example), will give you IP addresses to filter by.

在跟踪中查找您想要查看的连接。Locate the connection in the trace that you're interested in seeing. 为此,可以扫描跟踪、按 IP 地址筛选,或通过 Netmon 中的 "网络对话" 窗口选择特定的对话 Id。You may do this by either scanning the trace, by filtering by IP addresses, or by selecting specific Conversation IDs using the Network Conversations window in Netmon. 在发现 SYN 数据包后,展开 "帧详细信息" 面板中的 "TCP (Netmon)" 或 "传输控制协议(在 Wireshark 中)"。Once you've found the SYN packet, expand TCP (in Netmon), or Transmission Control Protocol (in Wireshark) in the Frame Details panel. 展开 "TCP 选项" 和 "MaxSegmentSize"。Expand TCP Options and MaxSegmentSize. 找到相关的 SYN ACK 帧,并展开 "TCP 选项" 和 "MaxSegmentSize"。Locate the related SYN-ACK frame and Expand TCP Options and MaxSegmentSize. 这两个值中较小的值将成为最大线段大小。The smaller of the two values will be your Maximum Segment Size. 在此图中,我使用了名为 TCP 故障排除的 Netmon 中的内置列。In this picture, I make use of the built-in Column in Netmon called TCP Troubleshoot.

使用内置列在 Netmon 中筛选网络跟踪。

内置列在 "框架详细信息" 面板的顶部。The built-in column is at the top of the Frame Details panel. (若要切换回普通视图,请再次单击 "",然后选择 "时区"。)(To switch back to your normal view, click Columns again, and then choose Time Zone.)

查找“TCP 疑难解答”选项(在“帧摘要”上方)的“列”下拉列表的位置。

以下是 Wireshark 中的已筛选跟踪。Here's a filtered trace in Wireshark. 有一个特定于 MSS 值( tcp.options.mss)的筛选器。There is a filter specific to the MSS value ( tcp.options.mss). SYN、SYN/ACK、ACK 握手的帧在 Wireshark 的底部链接,后者相当于帧详细信息(例如,帧 47 ACK、指向 46 SYN/ACK 的链接、指向 43 SYN 的链接),从而使这种工作更容易。The frames of a SYN, SYN/ACK, ACK handshake are linked at the bottom of the Wireshark equivalent to Frame Details (so frame 47 ACK, links to 46 SYN/ACK, links to 43 SYN) to make this kind of work easier.

在 Wireshark 中筛选的跟踪的 tcp. mss 为最大段大小(MSS)。

如果需要检查选择性确认(此矩阵中的下一个主题),请不要关闭您的跟踪!If you need to check Selective Acknowledgment (next topic in this matrix), don't close your trace!

选择性确认Selective Acknowledgment

在 SYN-SYN/ACK 中找到。Found in the SYN - SYN/ACK. 必须在 SYN 和 SYN/ACK 中都以允许的形式报告。Must be reported as Permitted in both SYN and SYN/ACK. 选择性确认(SACK)允许在缺少数据包或数据包时以更流畅的量传输数据。Selective Acknowledgment (SACK) allows for smoother retransmission of data when a packet or packets go missing. 设备可以禁用此功能,这可能会导致性能问题。Devices can disable this feature, which can lead to performance problems.

如果您使用的是代理,或者您使用的是 NAT,请务必从客户端到代理/传出/NAT 运行此测试,以及从代理/传出/NAT 到 Office 365,以获得最佳结果!If you're behind a proxy, or you are using a NAT, remember to run this test from client to proxy/egress/NAT, and from proxy/egress/NAT to Office 365 for best results! 这些是不同的 TCP 会话。These are different TCP sessions.

工具Tools

NetmonNetmon

要查找的内容What to look for

选择性确认(SACK)是 SYN-SYN/ACK 握手中的另一个参数。Selective Acknowledgment (SACK) is another parameter in the SYN-SYN/ACK handshake. 您可以通过多种方式筛选跟踪的 SYN-SYN/ACK。You can filter your trace for SYN - SYN/ACK many ways.

通过扫描跟踪、按 IP 地址筛选或通过使用 Netmon 中的 "网络对话" 窗口单击会话 ID,找到您想要查看的跟踪中的连接。Locate the connection in the trace that you're interested in seeing either by scanning the trace, filtering by IP addresses, or by clicking a Conversation ID using the Network Conversations window in Netmon. 在发现 SYN 数据包后,展开 Netmon 中的 TCP 或 Wireshark 中的 "帧详细信息" 部分中的 "传输控制协议"。Once you've found the SYN packet, expand TCP in Netmon, or Transmission Control Protocol in Wireshark in the Frame Details section. 展开 "TCP 选项",然后展开 "SACK"。Expand TCP Options and then SACK. 找到相关的 SYN ACK 帧并展开 "TCP 选项" 和 "SACK" 字段。Locate the related SYN-ACK frame and Expand TCP Options and its SACK field. 确保在 SYN 和 SYN/ACK 中都允许使用某些 SACK。Make certain SACK is permitted in both SYN and SYN/ACK. 以下是在 Netmon 和 Wireshark 中看到的 SACK 值。Here are SACK values as seen in both Netmon and Wireshark.

在 Netmon 中由于 tcp. flags = = 1 而选择性的确认(SACK)。

如在 Wireshark 中所见,SACK 含有筛选器 tcp.flags.syn == 1。

DNS 地理位置DNS Geolocation

在世界各地的 Office 365 中,在哪里尝试解析您的 DNS 呼叫会影响您的连接速度。Where in the world Office 365 tries to resolve your DNS call effects your connection speed.

在 Outlook Online 中,在第一次 DNS 查找完成后,将使用该 DNS 的位置连接到最接近的数据中心。In Outlook Online, after the first DNS lookup is completed, the location of that DNS will be used to connect to your nearest datacenter. 你将连接到 Outlook Online CAS 服务器,该服务器将使用中枢网络连接到存储数据的数据中心(dC)。You will be connected to an Outlook Online CAS server, which will use the backbone network to connect to the datacenter (dC) where your data is stored. 这速度更快。This is faster.

在访问 SharePoint Online 时,会将位于国外的用户定向到其活动数据中心--该 dC 的位置基于其 SPO 租户的主址(如果用户基于美国,则为 USA 中的 dC)。When accessing SharePoint Online, a user traveling abroad will be directed to their active datacenter -- that's the dC whose location is based on their SPO tenant's home-base (so, a dC in the USA if the user if USA-based).

Lync online 一次在多个 dC 中具有活动节点。Lync online has active nodes in more than one dC at a time. 当为 Lync online 实例发送请求时,Microsoft 的 DNS 将确定请求来自何处,并返回最近的区域 dC 中的 IP 地址(Lync online 处于活动状态)。When requests are sent for Lync online instances, Microsoft's DNS will determine where in the world the request came from, and return IP addresses from the nearest regional dC where Lync online is active.

提示

需要了解有关客户端如何连接到 Office 365 的详细信息?Need to know more about how clients connect to Office 365? 查看 "客户端连接参考" 一文(及其有用的图形)。Take a look at the Client Connectivity reference article (and its helpful graphics).

工具Tools

  • PingPing
  • PsPingPsPing

要查找的内容What to look for

从客户端的 DNS 服务器到 Microsoft DNS 服务器进行名称解析的请求应在大多数情况下导致 Microsoft DNS 返回区域数据中心(dC)的 IP 地址。Requests for name resolution from the client's DNS servers to Microsoft's DNS servers should in most cases result in Microsoft DNS returning the IP address of a regional datacenter (dC). 这对你意味着什么?What does this mean for you? 如果你的总部在 Bangalore、印度,但你在美国出差,当浏览器发出 Outlook Online 请求时,Microsoft 的 DNS 服务器应将你的 IP 地址交给美国的数据中心--区域数据中心。If your headquarters are in Bangalore, India, but you are traveling in the United States, when your browser makes a request for Outlook Online, Microsoft's DNS servers should hand you IP addresses to datacenters in the United States -- a regional datacenter. 如果需要来自 Outlook 的邮件,则该数据将在数据中心之间跨 Microsoft 的快速主干网络传输。If mail is needed from Outlook, that data will travel across Microsoft's quick backbone network between the datacenters.

当名称解析在尽可能接近用户位置时,DNS 工作速度最快。DNS works fastest when name resolution is done as close to the user location as possible. 如果你在欧洲,你想要转到欧洲的 Microsoft DNS,并(理想)处理欧洲的数据中心。If you're in Europe, you want to go to a Microsoft DNS in Europe, and (ideally) deal with a datacenter in Europe. 在欧洲的客户端转到 DNS 和北美的数据中心的性能将会降低。Performance from a client in Europe going to DNS and a datacenter in America will be slower.

对 outlook.office365.com 运行 Ping 工具,以确定您的 DNS 请求在全球的路由。Run the Ping tool against outlook.office365.com to determine where in the world your DNS request is being routed. 如果你在欧洲,你应该会看到类似 outlook-emeawest.office365.com 的答复。If you are in Europe, you should see a reply from something like outlook-emeawest.office365.com. 在美洲,期待的类似 outlook-namnorthwest.office365.com。In the Americas, expect something like outlook-namnorthwest.office365.com.

在客户端计算机上打开命令提示符(通过 " >开始>运行 Cmd" 或> "Windows 键类型" cmd)。Open the command prompt on the client computer (via Start > Run > cmd or Windows key > type cmd). 键入 ping outlook.office365.com,然后按 ENTER。Type ping outlook.office365.com and press ENTER. 请记住,若要通过 IPv4 指定 ping,请指定-4。Remember, to specify -4 if you want to specify to ping via IPv4. 您可能无法从 ICMP 数据包中获取答复,但应该会看到向其路由请求的 DNS 的名称。You may fail to get a reply from the ICMP packets, but you should see the name of the DNS to which the request was routed. 如果要查看此连接的延迟号码,请尝试 PsPing 到 ping 返回的服务器的 IP 地址。If you want to see the latency numbers for this connection try PsPing to the IP address of the server that is returned by ping.

显示 Outlook-namnorthwest 中的解决方案的 outlook.office365.com 的 Ping。

PSPing 到由 ping 返回到 outlook.office365.com 的 IP 地址,显示平均28毫秒延迟。

Office 365 应用程序故障排除Office 365 Application Troubleshooting

工具Tools

  • NetmonNetmon
  • HTTPWatchHTTPWatch
  • 浏览器中的 F12 控制台F12 Console in the browser

在此特定于网络的文章中,我们不会讨论在特定于应用程序的故障排除中使用的工具。We don't cover tools used in application-specific troubleshooting in this network-specific article. 但你会发现在此页面上使用的资源。But you'll find resources you can use on this page.

管理 Office 365 终结点Managing Office 365 endpoints

Office 365 终结点 FAQOffice 365 endpoints FAQ