无法从office365 portal下载安装office软件（Wireshark查找问题）
每台电脑从office365 portal下载安装office软件，都出现以下错误。
使用wireshark抓包
首先，点击坐下角的专家模式进入专家模式
发现大量的RST包，随便选一条，后面的数据流就到了指定包。看一下IP地址就是我们要查询的
查询conversations
找到该IP和我们IP的对话作为filter
然后关闭conversations,得到我们所要分析的数据包
发现TCP三次握手没问题。客户端向服务器发送的HEAD也得到了服务器端的200 OK相应。客户端再向服务器发送GET请求，服务器直接回复 HTTP/1.0 302 Moved Temporarily。然后就FIN关闭连接了。
跟踪TCP Stream
发现了与Host: officecdn.microsoft.com连接的如下情况：
以下是客户端发给服务器端（正常）
HEAD /SG/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.12527.20242/stream.x86.zh-cn.dat HTTP/1.1
Connection: Keep-Alive
Accept: /
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
Host: officecdn.microsoft.com
以下是服务器端发给客户端（正常）
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Connection: keep-alive
Content-Disposition: attachment; filename=stream.x86.zh-cn.dat
Powered-By-ChinaCache: MISS from BGP-GZ-b-3g9
Powered-By-ChinaCache: MISS from CHN-LN-u-D02
Powered-By-ChinaCache: HIT from BGP-YZ-b-3Wn
Powered-By-ChinaCache: HIT from CCT-NC-1-D01
Content-Length: 346547097
Last-Modified: Sun, 01 Mar 2020 03:32:16 GMT
Cache-Control: public, max-age=259200
X-Powered-By: ASP.NET
Expires: Fri, 13 Mar 2020 08:23:50 GMT
X-CID: 6
Server: Microsoft-IIS/10.0
Date: Tue, 10 Mar 2020 08:23:50 GMT
Age: 177929
Accept-Ranges: bytes
CACHE: TCP_MISS
CACHE: TCP_MISS
CACHE: TCP_HIT
X-CC-ServiceID: 446fecab53783a4c70f5b29456716ee7
CC_CACHE: TCP_HIT
以下是客户端发给服务器端（正常）
GET /SG/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/16.0.12527.20242/stream.x86.zh-cn.dat HTTP/1.1
Connection: Keep-Alive
Accept: /
Accept-Encoding: identity
If-Unmodified-Since: Sun, 01 Mar 2020 03:32:16 GMT
Range: bytes=0-7281,8487-11092,12320-31744,33002-68329,73105-83923,123865-149239,150558-216083,220929-232666,273860-312039,315119-433194,442613-466013,530351-575228,578223-695563,704892-728005,792182-12802506,13174909-13547741,13549737-13635345,13642276-13658608,13705396-13739537,13741501-13827320
User-Agent: Microsoft BITS/7.5
Host: officecdn.microsoft.com
以下是服务器端发给客户端（不正常）
HTTP/1.0 302 Moved Temporarily
Location: http://1.1.1.3/disable/disable.htm?url_type=%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7/%E5%A4%9A%E7%BA%BF%E7%A8%8B%E4%B8%8B%E8%BD%BD&plc_name=%E5%BA%94%E7%94%A8%E5%B0%81%E5%A0%B5
Content-Type: text/html;
Content-Length: 14
<h2>Moved</h2>
这才发现是被上网行为管理给屏蔽了。