As I’m trying to get my head around the notes I made from last week’s Wireshark webcast by Mike Pennacchi of Network Protocol Specialists, I thought I’d post the highlights here – these are just my notes with very little interpretation or linking out to other sites, so check out the video for more detail:

• Analyser placement is critical to successful network troubleshooting – switched networks provide direct traffic so you can’t just plug in and view everything right away.
• Three common methods for monitoring a switched network are:
  • Spanning/port mirroring – copying ingress and egress traffic between switch ports to form a single data stream – even for an entire VLAN (although it’s likely that would exceed the capabilities of the destination port).
    • Advantages include: configuration requires no interruption to traffic flow; multiple ports can be sent to a single port; remote spanning is possible between switches; some switches can filter packets as part of the spanning.
    • Disadvantages include: configuration requires access to the switch; not all switches fully support spanning; has been known to cause problems.
  • Tap – for monitoring full duplex traffic, including physical errors, passing traffic between devices in a fault tolerant manner.
    • Taps may be fibre or copper-based.
      • Fibre taps require no power and will split the signal using a ratio intended to provide the greatest signal level to the destination and a usable signal for analysis.
      • Most copper taps regenerate the signal (and will pass the signal on directly in the event of power failure).
    • Port aggregation taps can internally combine data streams, allowing a single port to capture full duplex traffic and also to buffer traffic when the combined data rate exceeds the egress data rate for the port. They can be:
      • Passive – dropping inbound packets from the analyser.
      • Allow reset packets – allowing packet injection, e.g. for an intrusion detection system to kill a TCP connection.
    • Advantages include: taps are independent of the switch infrastructure and work out of band.
    • Disadvantages include: the link needs to be broken to insert the tap and, for full duplex taps, the analyser needs to be able to accept two streams and merge them into a single trace file.
  • Hub – an inexpensive solution to copy all traffic to all other ports, including physical errors.
    • Hubs are effectively repeaters.
    • Beware that some hubs are really switches, labelled as hubs.
    • Dual-speed hubs are actually switched between the 10 and 100Mbps networks – so the analysis device will need to operate at the same speed as the devices being monitored otherwise only broadcasts will be detected from devices running at a different speed.
    • Advantages include: low cost, easy to install and readily availble; traffic can be sent to multiple monitoring ports.
    • Disadvantages include: only half duplex; not fault tolerant and require breaking the link for installation.
• Wireshark analysis method (D.I.S.C.A.R.D.):
  • Download Wireshark (free).
  • Install – two components: the Wireshark application and the packet capture driver (for Windows that’s Winpcap).
  • Setup – select the interface (from the Capture menu) and click Prepare. Where present, a generic dialup adapter can be used to capture VPN packets prior to encryption. Ensure that promiscous mode is used to capture all frames seen by the interface (not just those addressed to the analyser). Set capture filters if required (but it may be better to filter post-capture). Tweak the display options to improve performance – turn off real-time packet listing and automatic scrolling.
  • Capture – click start to run a capture. In practice, the maximum capture rate using a built-in NIC before packets begin to drop will be around 230Mbps although cards are available for full duplex 1Gbps network captures (e.g. the Cace TurboCap).
  • Analyse – view frames using the display filter against the packet list, then view the packet detail and, if necessary, the packet bytes. Setting the time display format (on the View menu) as seconds since previous displayed packet will help to identify gaps. Even encrypted traffic will show the deltas. The filter input box turns green when a valid filter is applied – alternatively the Expression option provides a GUI to assist. Some filters are case-sensitive and beware when using booleans with multiple filters (i.e. use or not and to avoid attempting to filter on two protocols at the same time!). Follow TCP Stream can be useful to quickly create a filter based on an IP address pair and particular port numbers.
  • Resolve – after thorough analysis, resolve the issues.
  • Document the solution.
• Pilot is a companion tool for Wireshark (chargable) and offers deep packet analysis.
• Example captures are available at Packetlife.net