USG2110-F original DPI file version is 188.8.131.52, test is after configured the IM blocking, QQ and MSN meet demands can’t be used, and RTX can still be used, which also normal meets the demands, now updated DPI file version to 184.108.40.206, found that QQ, MSN, RTX all can’t be used.
1.2 fault phenomenon description
(1) The customer original has a USG2210 equipment, version is V100R005C00SPC500, customer upgraded the equipment version software to V100R005C00SPC700, then found automatically imported the DPI file whose version is 220.127.116.11 in equipment’s hda1, after the client completed related P2P speed limit, IM blocked test, everything is normal, and the RTX can be normal used too. After the customer upgraded the USG2110-F version from V100R005C00SPC500 to V100R005C00SPC700, found the equipment hasn’t automatically imported DPI file, but configured automatic download, sot the equipment automatically from HuaweiSymantec security platform center downloaded the DPI file whose version is 18.104.22.168, customer also completed the relevant configuration operations and then test, found that QQ and MSN still cannot meet the using demand, but RTX also cannot be used
Known the relevant situation, first suggest customer remove the IM blocking and then test, QQ, MSN, RTX can be normal used, it proves the cause that the current RTX cannot use is because the equipment configured IM blocking, then recommends the customers degrade the present DPI version 22.214.171.124 to version 126.96.36.199 and then test, QQ and MSN can't use, but RTX can still normal use, it proves that characteristics fields of the new version DPI version matched the protocol used by RTX, but in IM blocking category division didn’t find the categories of RTX. Call the research and development, let them build related environment, then personally test use RTX and capture packets analysis, the final analysis the protocol used by RTX is the same as the protocol used by QQ Wireless. Because the customer masked off the QQ Wireless when configuring IM blocking, leading to RTX was also masked off, suggest the customer to cancel the QQ Wireless limit, after customers personally tests confirm that the problem is solved.
After build the using environment of RTX, and capture the message when using RTX, through analysis and confirm known that the protocol RTX used is the same as the QQ Wireless protocol, which is used by the mobile phone QQ. Namely that the RTX chat software uses the same protocol with mobile phone version QQ to communicate, and equipment configured the QQ Wireless blocking, leading to RTX was also blocked.
We should adopt simple method to confirm fault node according to the fault phenomenon as soon as possible, and then through repeated test analysis to find the root cause of the fault, at last according to the root cause of the failure to provide reasonable and feasible solutions.