How to Setup Wireshark for Troubleshooting and Analysis (chris greer)

Getting started with Wireshark can be overwhelming. There are many options, toolbars, menus and settings that can help when analyzing networks and applications, but which ones should we configure first? Which ones can help when getting started with Wireshark?

In this video we will dig into the top settings every analyst should use when packet digging with Wireshark. We will learn how to setup the time column, a new profile, save a filter button, and adjust some coloring rules. These settings can help us when troubleshooting slow networks, analyzing traffic for security forensics, or learning more about the underlying protocols that underpin the systems that drive our business.

Analyzing Microsoft SQL Server performance using Wireshark

Back in 2012 I posted a video that showed how we can use Wireshark and Excel to analyse SQL Server response times. It's the third most popular video I've posted! High time for an update.

Although the procedure I described still works, there is a far quicker way to achieve the same result. To give you a comparison, the 2012 procedure required three 10-minute YouTube videos. The revised procedure is described here in a single 3-minute video.

Top 5 Wireshark Filters for DNS (Betty DuBois)

DNS is one of the first things I check when troubleshooting a network problem. A user may report that a website is slow, an application cannot connect, or a server appears to be offline, but the underlying problem can sometimes be a DNS query that is taking too long or failing altogether. Wireshark makes it possible to see exactly what is happening between the DNS client and server, and display filters can quickly turn a large packet capture into something much easier to analyze. Instead of scrolling through thousands of packets, these five Wireshark DNS filters can help isolate the transactions that are most likely to explain a problem. 

Domain Name System or DNS is one of the most important protocols in your network and out on the Internet. Why is that? Because you can't route a packet through a network using a word. It's just like when you are driving, and your GPS tells you to turn right, or go straight based on your current position. It uses your latitude and longitude, not the name of your current street. In the same way, routers use the numerical address to check their routing tables for the best path to send packets onto their destination. Computers are simply faster when using numbers instead of words.

Tool Behavior Exercise - Netscout Optiview XG

 I’ve been preaching, “pick the right tool for the job” for years. The other day someone had an excellent question and asked me, “How do you know what the right tool is?”.

I explained that many times it can be pretty obvious. For example, reach for the RJ45 crimper when an end is damaged and needs to be replaced, or when you make your own patch cable.

Other times, it gets tricky since many of your tools may overlap with the functionality of your other tools. For example, an Optiview XG can capture packets, generate traffic, test cables, perform device discovery, use SNMP to monitor, etc.

Change is Necessary (M.O’Sullivan)

I applaud entrepreneurs for what they have achieved, through hours of dedicated, hard work, extreme commitment and at times ‘brute force’ to make success happen; however, as the old adage states ‘if you always do what you have always done, you will always get what you have always got’! So the question I often ask myself is “do entrepreneurial owners, presidents, CEO’s, etc. of small-to-medium enterprises (SME’s) readily accept that change is inevitable and necessary”?