Wireshark File Merge

For those of you familiar with my articles, who worked with me, or who attended any of my sessions, you will quickly notice that I am not one for long flowery speeches. In my classes, I don’t start with the history of technology or networking and pretty well dive right in.

WiFi or LAN Traffic?

 I was working with a client on their proposed new laptop build and they brought up the topic of WiFi vs Lan. For those who are not familiar, we were wondering how does the laptop behave if it is connected to the network via WiFi, and then you connect the ethernet port, docking station or similar dongle.

Wireshark Windows Adapter Issue and Fix

I was trying to capture packets from my Network Critical SmartNA packet broker and only saw broadcast packets.

At first, I blamed the packet broker since I assumed I knew my laptop and Wireshark so well. Do you know what they say about the word 'assume'? ;)

Pros and Cons of Packet Slicing

Whenever I’m working with a client on packet analysis, I always ensure that I cover packet slicing concepts. It doesn’t matter if I am teaching, troubleshooting or baselining, I believe that packet slicing is an important part of packet capture.

One school of thought is to slice after the fact, which you can do with Wireshark’s editcap utility and the -s option and now you have the original trace and a sliced one. Unfortunately, depending on the size of the trace, you might find this a bigger job than you think and now you have to ensure you keep track of 2 files.

Creating A IPv4 Filter With Your Packet Broker

One of the challenges I encounter when capturing packets is the sheer volume of data on todays networks. Most workstations have a minimum of 1 Gb connections and switch trunks are mostly 10 Gb connections.

This results in 2 issues:
- With a high packet rate and using a laptop or desktop to capture packets, you stand a chance of dropping packets.
- Going though gigabytes of data, is incredibly difficult and mostly unusable.

One way to mitigate these issues is to simply use a capture filter to reduce the amount of traffic captured. Unfortunately this technique doesn’t change the amount of packets being received by your capture device.