LoveMyTool - Open Community for Network Management and Monitoring

BreakingPoint Stormed My Network (by Betty DuBois)

 

 

One of the hardest parts of my job as a Network Detective is obtaining demonstration trace files.  I'm sure you can imagine the legal ramifications/firestorm, that would brew if I came to your network, captured a few trace files, and then proceeded to share them with the rest of the planet.

In the past, I have set up a small network, configured a few servers, and sniffed my own traffic. Not exactly exciting, but it got the job done. Well all that changed last week when I got to play with a BreakingPoint Storm. For the uninitiated, a BreakingPoint Storm is a box that will fling out any type of traffic onto your network at line rate speeds of either 1 Gbps (what I got to use) or 10 Gbps.  My test unit had four 1Gbps copper ports which could be configured to either send or receive traffic.

Now I've used traffic generators before, but never anything as powerful as this. The Storm sends application data of any and every type. I got to test my own network by configuring the Storm to send user requests via one interface and the server responses via another interface connected through a router.

Network Mystery #2 (by Betty DuBois)

This presentation was recorded at the Sharkfest 2011, Wireshark Developer and User Conference, held at the Stanford University between June 13th and 16th.

" ... In this session, Detective Betty DuBois will review one of the elusive network cases she has solved using Wireshark and Pilot. There will be plenty of forensics evidence provided, and lots of practical information to help you solve your own network mysteries. This session will be a deep dive into the "Case of the Slow Network". Betty will walk the attendees through how the data was captured (tshark & AirPcap), the methods used to isolate the problem (SMTP relay infection), and which users were infected ... "

Betty DuBois has been a networking Instructor and Consultant since 1997. Currently, Betty is a Wireshark University Instructor, and creator of the "Network Mystery" series of videos featured on the wireshark.org site, and network trainer/consultant for hire.

Right click to download the corresponding PowerPoint presentation.

Continue viewing other Sharkfest videos »

Network Mystery #1 (by Betty DuBois)

This presentation was recorded at the Sharkfest 2011, Wireshark Developer and User Conference, held at the Stanford University between June 13th and 16th.

" ... In this session, Detective Betty DuBois will review one of the elusive network cases she has solved using Wireshark and Pilot. There will be plenty of forensics evidence provided, and lots of practical information to help you solve your own network mysteries. This session will be a deep dive into the "Case of the Slow Network". Betty will walk the attendees through how the data was captured (tshark & AirPcap), the methods used to isolate the problem (SMTP relay infection), and which users were infected ... "

Betty DuBois has been a networking Instructor and Consultant since 1997. Currently, Betty is a Wireshark University Instructor, and creator of the "Network Mystery" series of videos featured on the wireshark.org site, and network trainer/consultant for hire.

Right click to download the corresponding PowerPoint presentation.

Continue viewing other Sharkfest videos »

Review of Dualcomm 5-Port Pass-Through Port Mirroring Switch (by Betty DuBois)

Author Profile - Betty Dubois is the Principal Consultant for DuBois Training & Consulting, LLC. She has been analyzing networks since 1997, performing fault isolations, application profiles, and network baselines for a wide variety of clients. As an Instructor for Wireshark University, she is known for her ability to make a dry, complex subject fun and interesting by using both humor and real-world examples. She has presented at Networld+Interop, and is an experienced courseware developer and marketing collateral writer.

Betty’s industry certifications include Certified Wireshark University Instructor, Wireshark Certified Network Analyst, HP ProCurve AIS, and Sniffer Certified Expert.

Review of Dualcomm Technology’s 5-Port 10/100/1000 PoE Pass-Through Port Mirroring $119.95 Switch

One of the benefits of being Wireshark University Instructor is that I get a chance to teach a wide variety of students from a vast range of companies. For years I've been talking about how important it is to capture using a Tap to achieve correct Delta times, but the pushback I've always gotten is the cost. Well thanks to one of my students, Dan Dolan, I have a new solution.

During a Core 1 class in Chicago, I was showing off my different taps and explaining how they worked. Dan wanted one until he found out their retail price. He started Googling, and found Dualcomm who at the time had only a 10/100 Port Mirroring switch. He forwarded me the link and I filed it away in the “gotta get tuit” folder. A few months later, he came to Core 2 in DC with his new switch. He had been using it at the insurance company he works for, and it had already saved him a lot of time and frustration. Now I had to have one. I contacted the company, and their newly released 10/100/1000 switch arrived a few weeks later. It was like Christmas.

SPAN Port or TAP? (by Betty DuBois)

Speaker Profile - Betty Dubois has been a technical trainer for 17 years, training on networking and protocol analysis for the last 14. She has been instructing on ProCurve products for a year. At Networld+Interop, Betty taught the workshop "Troubleshooting Databases from a Network Perspective". She has developed courseware in protocol analysis for Sniffer University, and in security for Internet Security Systems. Her article "What's on my Network?" appeared in the Data Communications Management magazine.

Betty's certifications include ProCurve AIS, Certified Wireshark Instructor, Sniffer Certified Expert, Certified Novell Instructor and Novell Certified Network Expert (expired)

Betty’s goal is to teach course materials in the most relevant and real-world manner as possible, while using humor to keep students engaged. “My classroom is called Bettyland, and it is always better there!”

Editor's Note - This session was presented at the 2009 Sharkfest Wireshark Developer and User Conference at Stanford University. Please right click here to download a copy of the PowerPoint presentation in order to follow along with the video.

For those who are interested in reading more about SPAN, RSPAN and TAP, please read the following two articles by Oldcommguy™.

SPAN Port or TAP? CSO Beware (by Tim O’Neill)

RSPAN … Friend or Foe? (by Tim O’Neill)

Continue reading other LoveMyTool posts by Betty Dubois »