370 posts categorized "Protocol Analysis" Feed

Troubleshooting with Wireshark - Remove Unrelated Protocols (by Chris Greer)

Sometimes packet digging can get tedious. We've all been there. 

It can be hard to set the right filter that lets us hone in on the root cause. In many cases, it is just as helpful to remove protocols from view that are not probably not related to the problem. At least that will give us less to dig through. I call that removing "packet static". 

In this video, we will look at how to create a button in Wireshark that will remove common protocols or conversations that will simplify the trace. 

 

Hope this helps when packet digging! 

Continue reading "Troubleshooting with Wireshark - Remove Unrelated Protocols (by Chris Greer)" »


Troubleshooting with Wireshark - Find Delays in TCP Conversations (by Chris Greer)

The delta time column has always been one of the first things to add when configuring Wireshark. It shows the time between displayed packets, or captured packets, depending on how you set it up. It makes finding delays in conversations much easier to do - that is unless you are dealing with a trace file that has several TCP conversations in tandem. It may be that the time between packets looks good, but that is because the previous packet is a part of a different conversation from the one you are analyzing. 

In this video we will look at how to use the TCP Timestamp information in the TCP header (added by Wireshark) to find delays in conversations, even when multiple connections are overlapping each other. 

This can help us to quickly identify where the hold-ups are in conversations, getting to root cause faster. 

Hope this helps when troubleshooting!

 

 

Troubleshooting with Wireshark - Configuring Long-Term Captures (by Chris Greer)

Got a pesky network problem that always seems to fix itself as soon as you start capturing? 

Intermittent network and application problems are more prevalent nowadays than ever. They appear, and as soon as we are in the right location with the right tools, they disappear! 

These types of problems are a pain to capture with Wireshark. In this video, we will look at how to use the GUI driven ring-buffer configuration to set up a long-term capture. This can especially help to catch an intermittent problem in the act, leaving a digestible-size trace file to dig through, rather than sifting through Gigs upon Gigs of traffic.  

 

Thanks for watching!

 

 


Troubleshooting with Wireshark - Spurious Retransmissions Explained (by Chris Greer)

What is the difference between a regular retransmission and a spurious one? What can I do about them if I find them in a trace file? 

Spurious retransmissions are not uncommon. They find their way into our trace files somewhat often. In this video, we explain the differences in retransmission flavors, as well as examine why they occur and what we can do about them. 

 

Hope this helps when troubleshooting!

 

Continue reading "Troubleshooting with Wireshark - Spurious Retransmissions Explained (by Chris Greer)" »


Network Troubleshooting Tip - Focus on a Single Symptom (by Paul Offord)

When we get to the point in an investigation where we are about to break out Wireshark, the complexity of the packet analysis can seem quite daunting. And yet by covering a few key points can dramatically cut the time needed to analyze any diagnostic data.

In my previous post I covered the need to thoroughly understand a symptom. In this blog we'll look at the dangers looking for a common cause for multiple symptoms.

Imagine you are faced with a situation where users are complaining about three issues:

  • Word documents should open in less than 5 seconds, but intermittently take more than 30 seconds.
  • Excel workbooks should save in less than 15 seconds, but intermittently take more than 60 seconds.
  • Opening an Outlook Inbox should take less than 20 seconds, but sometimes takes more than 3 minutes.

All problems are reported as having started at the same time, and there’s a widespread belief that they are being caused by a network issue. This is the point where alarm bells should start to ring.

  Symptoms1

 

Maybe some of the symptoms are down to the same root cause, but maybe they are not, and starting by assuming they are is likely to lead to a very frustrating time. The choice of a single symptom and ...

Continue reading "Network Troubleshooting Tip - Focus on a Single Symptom (by Paul Offord)" »


Troubleshooting with Wireshark - Analyzing Slow Web Servers (by Chris Greer)

In this video, we will look at how to quickly apply a display filter that will isolate all slow web transactions in a trace file. It is a good button to add to the top of your Wireshark profile, especially when identifying whether slowness is caused by the network or application. 

Enjoy!

 

 

Chris Greer Packet Pioneer Logo

Author Profile - Chris Greer is a Network Analyst for Packet Pioneer LLC and a Certified Wireshark Network Analyst. Chris regularly assists companies in tracking down the source of network and application performance problems using a variety of protocol analysis and monitoring tools including Wireshark. Chris also delivers training and develops technical content for several analysis vendors.