Validating Network Performance with a Throughput Test

The core job of a network is to reliably transport data from one point to another, as quickly as possible. If this is accomplished, end users can experience applications and services without skips, lags, and delays induced by the network.

However, when a problem does strike, engineers want to quickly determine if the blame lies on the network or not. Better yet, they should proactively baseline the network before problems start! One way to do that is to test the network path using tools such as iPerf or the Network Performance Test from NetAlly. Let’s look at both tools and see how they can help us spot network problems quickly. 

Introduction to Artificial Intelligence - (Imanuel)

In 1996 Garry Kasparov loses a chess match to a purpose-built computer system designed to be the first computer “intelligent” enough to defeat a human player in a game of Chess. At that time it was thought that we are still years away from having a computer perform so well, but after delivering a top notch game, and making a number of accidental moves (later described as “bugs”) the computer was able to shake the world class player and begin what Kasparov later described as the replacement of “knowledge workers”. While that happened decades ago, even today AI is still considered a fringe technology to some extent with problems like adversarial attacks and constant progress and setbacks at a startup pace rather than an established industry. The lack of mainstream adoption is especially striking considering the technology has evolved generations since Deep-Blue’s use of alpha-beta pruning algorithm, used in search engines. 

Network Traffic Analysis (NTA) - The First Step in Intrusion Detection! (Andrey Yesyev)

 

Next-generation intrusion detection systems (IDS) are supplanting their legacy predecessors to provide complete security for complex networks. This new breed of security solutions take advantage of intelligent data and machine learning to provide full network traffic analysis (NTA).

NTA actually is a term coined by research firm, Gartner. 

The company defines NTA as a way to separate legacy (mostly layer 3 technology) from next-gen layer 7-based technology – what that means is that NTA analyzes network activities intelligently to provide comprehensive security.

NTA now is inextricably linked with modern IDS solutions, relying on intelligent data and machine learning to offer full visibility of the network. It works in tandem with, or is complementary to, perimeter protection offerings to provide a holistic view of the entire network, within and beyond the network’s edge.

Empathy: A Requiem (Paul Smith)

 

It was the summer of 1977 when I drove with my fiancé’s younger brother to the Hollywood Boulevard Walk-of-Fame. Neither of us was that impressed with the famous names on the sidewalk; we were there to stand in line at Mann’s Chinese Theater for the very first Star Wars movie. These were the days when Hollywood was still a thing, and Mann’s (built in 1927) was a historic place to see a film. It also boasted of the revolutionary new THX sound system. We were blown away before the opening crawl.

That was a long time ago...

Investigating TCP Checksum Issues With Wireshark

Protocol analysis is an ever changing art because of 2 significant variables:

Protocols 

Every time an application gets an update it might affect the way it interacts with protocols.  

Operating system upgrades may change the actual protocols, behavior or drivers.  

Certain applications might come with its own ‘built in protocols’ 

Tools 

Every protocol analyzer will have its own different GUI, protocol dissector/decoder and presentation  

Even when you think you got the hang of the tool, that vendor may decide to remove, add or break some significant features with its latest upgrade. 

In this example I will focus on Wireshark and TCP checksum issues.

Quick review 

A checksum is calculated and included by the sender of the data. The receiver performs the same math, using the same formula and should get the same checksum value. If this is not the case the receiver ‘may’ decide to discard that packet.  I say 'may' because the behavior is based entirely on the vendor and specific protocol in question.

When it comes to TCP I have seen scenarios where a driver miscalculated the checksum and the receiver discarded it. In most cases the receiver will discard the packet if there is a TCP checksum issue.

This is the important bit, if you see TCP checksum errors, take a moment and verify if the corrupted packets have responses, with no retransmissions or large delta times. If that is the case, then the packets are not truly corrupted.

Depending where Wireshark/npcap captured the packet, it is entirely possible that the checksum was not calculated when it was captured and sent. In some cases TCP checksum is enabled on the card which creates the same symptom.

This is yet another reason why I prefer to capture packets after it has left the device.

---

#netscout

Salt Typhoon didn't succeed because they were noisy. They succeeded because they were difficult to distinguish from normal activity.