LoveMyTool - Open Community for Network Management and Monitoring

Please Subscribe Our Google+ Page

Please subscribe LoveMyTool+ by adding us to your Google+ circle.

Wireshark, Excel and Pivot Tables (by Tony Fortunato)

Since my Excel Graph tutorial, I have received emails asking if I could whip something up regarding Pivottables.  Well, here you go.

One of the limitations of the Excel Graph Video is that it doesnt illustrate those data points where there aren't any packets.  This pivot table trick will fix this and make the data more manageable.

In my classes and seminars, I constantly tell analysts that you should think of your packets like your vacation photos.  You can show them to people, and they will politely nod, but they have no interest in them.  Along with the security implications and possible misinterpetation, a graph can really drive the point home or show you something new about that puzzling trace.

Enjoy

 

 

Continue reading other LoveMyTool posts by Tony Fortunato »

Getting Started with Riverbed's Pilot (by Tony Fortunato)

I am getting reacquainted with Riverbed's Cascade Pilot and thought it would be a good opportunity to create some short videos covering the product.

In this video I cover one of the most common things I encounter in Wireshark where my network adapters are labeled Microsoft.  

Here I show you how I determined which NIC was my Wifi adapter.  Alternatively you could always guess, but I thought this was more helpful.

Enjoy

 

 

Continue reading other LoveMyTool posts by Tony Fortunato »

How many errors are acceptable on switch and router ports? (by Chris Greer)

Quick answer? Nada, Zero, Zilch! (Sure there are exceptions – but you wanted a quick answer, right?)

I recall reading a whitepaper one time which gave target average utilization and error levels for Ethernet ports. In the report, it mentioned that a target level for traffic should be 40% on average. I was ok with that number, seemed normal to me. The next figure given was for errors (like packet drops, FCS Errors, late collisions, etc…) and the acceptable figure for a healthy network was 1% of port utilization. So according to the whitepaper, if the utilization rate was at 40%, then .4 percent of that traffic could be errors, and all would be ok.

HUH?

So to put some real numbers to that, a 1Gbps network interface with 40% utilization would be 400Mbps. If the average packet size was around 350 bytes, this would mean that for any given second, there would be just over 142,000 packets flying by. So if 1% of these had errors, that would be 1,420 packets per second. As we have discussed on Love My Tool in the past, when a packet has an error, it is dropped by the next switch or router port it crosses. Since Ethernet is not responsible for retransmission (that’s TCP’s job), the switch or router does nothing to report this issue, other than add a counter to its error log. This means that for every packet drop, discard, FCS error, late collision, or long/short frame, we have to wait for TCP to timeout and retransmit, which takes time. These errors have a huge impact on network and application performance, and can really undermine the business.

How can we find them?

To put it simply, look at our routers and switch ports for errors. Does this mean that we have to comb through every router and switch, doing a “show interface” on all ports? If we don’t have a tool to do it for us – yes, we do. That can get a bit tedious, so some tool manufacturers have an SNMP based interface scanner that can comb your whole enterprise for errors, presenting them front and center so you can resolve them. The Fluke Networks OptiView XG is one such tool. It scans all known switches and routers, and if it finds Ethernet Errors, packet discards, or discovers excessive utilization, it will alert the front page, displaying the switch and port number.

Cool huh?
Don’t let errors get you down. Find the little buggers and resolve them, before they impact critical business applications.

Author Profile - Chris Greer is a Network Analyst for Packet Pioneer. Chris has many years of experience in analyzing and troubleshooting networks. He regularly assists companies in tracking down the source of network and application performance problems using a variety of protocol analysis and monitoring tools including Wireshark. When he isn’t hunting down problems at the packet level, he can be found teaching various analysis workshops at Interop and other industry trade shows. Chris also delivers training and develops technical content for several analysis vendors. He can be contacted at chris (at) packetpioneer (dot) com.

Using Wireshark Accelerator Keys (by Tony Fortunato)

Someone dropped me an email the other day asking me to go over some Wireshark basics, like Accelerator (or short cut keys)

I've always been a keyboarder, so I always use keystrokes instead of a mouse or laptop touch pad.

I find I work much quicker and efficiently this way

Enjoy

 

Continue reading other LoveMyTool posts by Tony Fortunato »

Creating Wireshark MAC Filters (by Tony Fortunato)

Just saw a question on ask.wireshark.org from an analyst who is just starting out with Wireshark, asking about the basic MAC filter.   

I enjoy answering these type of questions since it shows me that more and more people are trying out Wireshark.

So after a few postings, I realized there is something basic I am not conveying, so I whipped up a quick video on how to create a Capture and Display MAC Address Filter.

Enjoy

 

 

Continue reading other LoveMyTool posts by Tony Fortunato »