We’ve all heard that old saying “garbage in, garbage out” but what about “no data, no chance”?
When I present or teach, I try to instill some basic concepts and methodologies to help attendees regardless of their role or what tools they may have.
The first suggestion is pretty simple "get out of your chair”. When possible, visit the site, or client to get a proper perspective of the issue, see the equipment and site and gather first-hand information. In this day of video calling, and the ability to easily record video or take photos from your phone, you can ask the client to ‘show you the issue’ or have them them 'walk you around the site". The other day I found a hidden access point with the help of a Zoom call.The second suggestion is to document EVERYTHING! Things like:
- tools used,
- methodology
- equipment make/model
- device ip addresses
- application and device port numbers
- application version number
- operating systems
- date and time of testing
- client contact, etc
For example, I get many requests to help with new device builds, application or device baselines. The first thing I ask is "Do you have a preferred way to baseline? " I ask because there are many tools or utilities clients may have, or prefer to use. Why reinvent the wheel by introducing a new tool if their current ones work just fine. And no, the tools don't have to be brand spanking new. Just make sure you are comfortable with whatever tools you have.
When I started working with packet analyzers, I would practice by capturing packets while on hold or any opportunity so I can get comfortable with the tool and interpreting the results BEFORE I take it out in the field. Then I would intentionally misconfigure something see how the tool reported it. I learned about the device configuration and protocols along the way; win, win!!
The critical part of performing packet captures is to ensure you note if you used a span port, hub, tap, directly from the device to capture your packets. The most common techniques I see out there is a span port or tap.
When it comes to taps, they are not all built the same, or have the same features. Make sure you get the one that fits your needs, for example; is your switch port mirror good enough, do you have a tap or a packet broker, does your online tool pass POE, what interface does it use to connect to your computer (USB Ethernet, proprietary adapter), how user friendly is the software, etc..
In this short video, I show you how I used a Profitap Profishark inline to capture a phone’s bootup for baselining, troubleshooting and baselining.
Cheers
