LoveMyTool - Open Community for Network Management and Monitoring

Under the Hood: Capture Filters, Display Filters - Part 2 (by Ray Tompkins)

Author Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

In this month's issue of Under-the-Hood, we’re continuing the discussion about the importance of filtering when using Wireshark. If you missed part 1 of the discussion, you can find the article “Under the Hood: Capture Filters, Display Filters” on the LoveMyTool website.

One way to improve and organize your Display Filters is to rearrange them into groups. Or better yet, visit gearbit.com for a pre-prepared list. At gearbit, we think like a network analyst, so we've compiled a list of capture filters and organized them by category. All you will need to do is copy the cfilter file containing the 150 filters that are organized by topic.

The compiled cfilters file has various types of filters that can be edited as you use them to meet most of your capture needs. If you find yourself adding additional filters, just follow the instructions listed that will show you how to create and organize your own filters.

Under the Hood: Capture Filters, Display Filters (by Ray Tompkins)

Author Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

Figure 1:1 Wireshark: How to select Display Filters

This month we will discuss the importance of filtering.

When conducting packet analysis, one of the most important tricks of the trade is filtering. The ability to either filter network traffic as you gather data or weed through a trace can save time and effort when analyzing a problem or proving the results.

My tool of choice is Wireshark. It uses two different types of filters, one for capture and the other for displaying data after you’ve captured the packets. Wireshark uses WinPcap, which provides link-layer network access, allowing all network packets to be filtered by the tool. This is done by bypassing the protocol stack which gives access to all the network traffic. It’s commonly used for many open source and commercial network tools. Gearbox’s deep packet capture engine appliance uses libpcap, a Linux version, to capture and filter packets due to its speed and efficiency.

One of the quickest ways to apply filters is to identify a packet and open up the detailed view of the packet (see Figure 1:1). After finding what you want to filter, right click and select Prepare a Filter>Selected. Then apply the newly desired filter now shown in the filter syntax box.

Under the Hood: Nagle Struck Again (by Ray Tompkins)

Author Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

As I imagine most of you are, I’m always looking for performance tuning ideas, something that really helps improves performance, preferably with minimal cost. Recently, while reviewing trace files, I discovered the cause of an issue I was troubleshooting: Nagle’s algorithm had struck again.

Don’t get me wrong, I’m not against Nagle or his algorithm, but I don’t like it when things work against you, like my wife’s car, which has an alarm system that locks all the doors, usually when you least expect it. I like the thought of safety, but lock all the doors but mine. I’ll lock my own door, thank you.

Nagle's Congestion Control in IP/TCP Internetworks (RFC 896) describes what he called the "small packet problem," where an application repeatedly emits data in small chunks, frequently only one byte in size. Since TCP packets have a 40 byte header (20 bytes for TCP, 20 bytes for IP) and Ethernet 18 byte (14 bytes source and destination, type and 4 bytes CRC), this results in a 59 byte packet for one byte of useful information, a huge and usually unnecessary overhead.

Finding the Latency (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

Editor's Note - This session was presented at the 2009 Sharkfest Wireshark Developer and User Conference at Stanford University. Please right click here to download a copy of the PowerPoint presentation in order to follow along with the video.

Continue viewing other latest Sharkfest videos »

OSTU - Wireshark Case Study: Benchmark Test (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

Continue viewing other LoveMyTool "Open Source Tools University (OSTU)" lectures »

OSTU - Wireshark TCP Stream Graphs (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

Continue viewing other LoveMyTool "Open Source Tools University (OSTU)" lectures »

Understanding the Need for Protocol Analysis (by Ray Tompkins)

Author Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

Editor's Note - Hello LoveMyTool Readers ... One of our regular technical contributors and a long time friend, Ray “Mr. GearBit” Tompkins himself will be doing a series of classes in Texas.

The overall goal of his classes is to empower the analysts with advanced troubleshooting techniques. Once you have been through a class with Ray you will never look at packets the same again. This fascinating view through an analyzer reveals how things really are inside the networks that support today’s popular information technology and business applications.

You will learn advanced skills of what’s important and what’s not. You will be able to identify the problem, report the findings to the proper group and have them working on the solution. You will be able to show your vendors if it’s their problem and have them address the issue. You can also show management what and where the problem is and who is working on the solution with confidence, letting the trace file support your findings and conclusions.

Derived from his classes, the following article from Ray, “Understanding the Need for Protocol Analysis”, describes the fundamentals of the need for real analysis techniques with some great analysis stories and their effects on network success.

I hope you enjoy Ray’s article. If you find this article helpful you will find his classes help you even more.

My Best - Oldcommguy™

“Providing support for our 100k+ user network is at times very daunting.  The occasional issue that previously left us scratching our heads now gets looked at with new eyes. Ray's class did definitely improve our skill sets.”

-- Thomas G. Hollister, Senior Network Engineer, CFISD

Network Analysis Training
2 Day class

Houston: Nov 17th and 18th 2008
519 North Sam Houston Pkwy, Suite 600, Houston, TX 77060

San Antonio: Nov 20th and 21th 2008
Residence Inn Marriott, 628 S Santa Rosa Blvd, San Antonio, TX 78204

Austin: Dec 8th and 9th 2008
Courtyard Marriott at 3713 Tudor Blvd. Austin, TX 78759

OSTU - Wireshark Capture Filters (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

View SlideShare presentation or Upload your own. (tags: wireshark ethereal)

Continue viewing other LoveMyTool "Open Source Tools University (OSTU)" lectures »

OSTU - Wireshark Display Filters (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

View SlideShare presentation or Upload your own. (tags: wireshark ethereal)

Continue viewing other LoveMyTool "Open Source Tools University (OSTU)" lectures »

OSTU - Identifying Zero Window with Wireshark (by Ray Tompkins)

Instructor Profile - Ray Tompkins is the Founder and CEO of Gearbit. Ray is a Senior Network Specialist with over 28 years experience in troubleshooting, design, and implementation. His background includes 911 emergency consulting, and identifying the root cause of critical network problems. His knowledge of network protocols (LAN, VoIP, WAN and WLAN) and how they work within the enterprise networks are the key in providing customer service though knowledge transfer and education.

View SlideShare presentation or Upload your own. (tags: wireshark ethereal)

Continue viewing other LoveMyTool "Open Source Tools University (OSTU)" lectures »