Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Wireshark Basics

30,653 views

Published on

Introduction to Wireshark

Published in: Internet
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • 7 Sacred "Sign Posts" From The Universe Revealed. Discover the "secret language" the Universes uses to send us guided messages and watch as your greatest desires manifest before your eyes. Claim your free report. ◆◆◆ http://t.cn/AiuvUCDd
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Hidden Messages From The Universe. Free report reveals the secret guidance the Universe wants you to know so you can unlock the magical life you were BORN to live! ♥♥♥ https://bit.ly/30Ju5r6
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download Full EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ACCESS WEBSITE for All Ebooks ......................................................................................................................... Download Full PDF EBOOK here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download EPUB Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... Download doc Ebook here { https://tinyurl.com/yyxo9sk7 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD FULL BOOKS, INTO AVAILABLE FORMAT ......................................................................................................................... ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... 1.DOWNLOAD FULL. PDF EBOOK here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... 1.DOWNLOAD FULL. EPUB Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... 1.DOWNLOAD FULL. doc Ebook here { https://tinyurl.com/y6a5rkg5 } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Wireshark Basics

  1. 1. Network analysis Using Wireshark Presented by: Yoram Orzach, NDI
  2. 2. Chapter Content A few words about troubleshooting tools Wireshark – basics Wireshark – advanced features Case studies
  3. 3. Network TS Tools <ul><li>By the end of this lesson, you will be able to understand and use: </li></ul><ul><ul><li>PC tools – Ping, Tracert ,Netstat, ARP ….. </li></ul></ul><ul><ul><li>Access to communication equipments – Switches, Routers …. </li></ul></ul><ul><ul><li>Protocol analyzers – Wireshark (former Ethereal), Sniffer ® ….. </li></ul></ul><ul><ul><li>SNMP tools – SNMPc, Whatsup Gold, HP-OV NNM ….. </li></ul></ul><ul><ul><li>Special tools – Netflow, Solawinds ….. </li></ul></ul><ul><ul><li>Dedicated analyzers – Agilent, Spirent, ….. </li></ul></ul>
  4. 4. 1. PC Tools - Ping, Tracert ,Netstat, ARP ….. <ul><li>End to end basic connectivity </li></ul><ul><li>First “filling” of the network behavior </li></ul>To ISP
  5. 5. 2. Access to communication equipments – Switches, Routers, …. <ul><li>Local data – counters in equipment itself </li></ul><ul><li>For local problem isolation </li></ul>To ISP
  6. 6. 3. Protocol analyzers – Wireshark (former Ethereal), Sniffer ® ….. <ul><li>Local, in-depth, packet-by-packet protocol analysis of network traffic </li></ul><ul><li>Network, hardware and application behavior </li></ul>To ISP
  7. 7. 4. SNMP tools – SNMPc, Whatsup Gold, HP-OV NNM ….. <ul><li>Continues monitoring and mapping </li></ul><ul><li>Events and notifications </li></ul><ul><li>Maps system </li></ul><ul><li>Mostly SNMP based </li></ul>To ISP
  8. 8. 5. Special tools – Netflow, Solawinds ….. <ul><li>Traffic analysis, engineering tools etc … </li></ul>To ISP
  9. 9. 6 . Dedicated analyzers – Agilent, Spirent, ….. <ul><li>Simulators, applications tests etc … </li></ul>To ISP
  10. 10. Were to Locate the Wireshark? To ISP For server monitoring: Connect the laptop to the LAN switch, with port mirror to the monitored server For WAN monitoring: Connect the laptop to the LAN switch, with port mirror to the monitored router For Internet connectivity monitoring: Before or after the Firewall
  11. 11. Chapter Content A few words about troubleshooting tools Wireshark – basics Wireshark – advanced features Case studies
  12. 12. How to Connect to the Network Monitoring port S D S D S D S D Monitored port <ul><li>Test method: </li></ul><ul><ul><li>Port monitor on LAN switch </li></ul></ul><ul><ul><li>In parallel on a hub *if have any </li></ul></ul>
  13. 13. The Interface (Version 1.2.0)
  14. 14. What can we do with it, and what we Cannot? <ul><li>What we can: </li></ul><ul><ul><li>Capture packets </li></ul></ul><ul><ul><li>Watch smart statistics </li></ul></ul><ul><ul><li>Define filters – capture and display </li></ul></ul><ul><ul><li>Analyze problems </li></ul></ul><ul><li>What we cannot: </li></ul><ul><ul><li>It is not and automatic tool </li></ul></ul><ul><ul><li>It is not suitable for long-term monitoring </li></ul></ul><ul><ul><li>It is not a “magic” tool </li></ul></ul>
  15. 15. TCP/IP Protocol Stack - Reminder IP ICMP TCP UDP Telnet SNMP HTTP FTP DNS SMTP ARP OSI Layer 1/2 OSI Layer 3 OSI Layer 4 OSI Layer 5-7 T.R. F.R. Ethernet DialUp ISDN ATM
  16. 16. Data Structure Over- head Data Layer 4 Err (Op.) Data Over- head Layer 3 Err (Op.) Data Layer 1 Over- head Data Layer 2 Err (Op.) Over- head Data Layer 5-7 Err (Op.)
  17. 17. Data Structure
  18. 18. Data Flow Server Router Router Public Data Network Eth. Eth. Host Bit stream OH Data E IP (L3) OH Data E TCP (L4) OH Data E HTTP (L-5/6/7) OH Data E Ethernet (L2) Bit stream OH Data E OH Data E OH Data E OH Data E FR (L2) Bit stream OH Data E OH Data E OH Data E OH Data E
  19. 19. Frame Format – Ethernet II / 802.3 bytes Dest. Address Source Address Type 6 6 2 IP IPX AppleTalk CRC 4 Pad Data PA 8 Ethernet II IEEE 802.3 Dest. Address Source Address Length 6 6 2 CRC 4 Pad Length Data PA SFD 7 1
  20. 20. Ethernet Frame Example
  21. 21. IP Datagram Format H Data E Ethernet (L2) H Data IP (L3) H Data E TCP (L4) H Data E HTTP (L-5/6/7) This is the IP header Bit stream
  22. 22. IP Datagram Format Ver Length 32 bits Data (variable length, typically a TCP or UDP segment) 16-bit identifier Internet checksum Time to live 32 bit source IP address Head. len Type of service flgs Fragment offset Upper layer 32 bit destination IP address Options (if any) IP protocol version number Header Length (in bytes “ Type” of data Total datagram length (in bytes For fragmentation and reassembly Max. no. remaining hops (decremented at each router) Upper layer protocol to which payload is delivered E.g. timestamp, record route taken, specify list of routers to visit
  23. 24. IP Packet Example
  24. 25. UDP Frame Structure <ul><li>There are only four fields in the UDP header: </li></ul><ul><ul><li>Source port </li></ul></ul><ul><ul><li>Destination port </li></ul></ul><ul><ul><li>Message length </li></ul></ul><ul><ul><li>Message checksum </li></ul></ul>source port # dest port # 32 bits Application data (message) UDP segment format length checksum Length, in bytes of UDP segment, including header Frame checksum
  25. 26. TCP Message Structure source port # dest port # 32 bits application data (variable length) sequence number acknowledgement number rcvr window size ptr urgent data checksum F S R P A U head len not used Options (variable length) URG – Urgent data (generally not used ACK: ACK # valid PSH - Push data now RST – Connection RESET Ack numbers to confirm data arrival # of bytes rcvr is willing to accept SYNC – Start session FIN – End session In case of URG pointer, indicates the data location Options Numbering of sent data Port Numbers
  26. 27. TCP Packet Example
  27. 28. Some Problems that Happened …. <ul><li>A heavy load (nearly nothing works), from remote offices to the center </li></ul><ul><li>Very slow connection to an http server farm behind a load balancer </li></ul><ul><li>Slow DB server response </li></ul><ul><li>Slow application </li></ul><ul><li>Is it a problem? </li></ul>Wait and see how they were solved
  28. 29. Choose the Interface and Start the Capture
  29. 30. And You Will Get: Packet List Packet Details Packet Bytes
  30. 31. Or – Define Capture Options Buffer size – in order not to fill your laptop disk Capture all packets on the network Capture filter Capture in multiple files When to automatically stop the capture Display options Name resolution options
  31. 32. And if you want to see some details: Example (W-LAN): Received Signal Strength Indication (RSSI) and Link speed (BW)
  32. 33. Example 1 – HTTP session Opened SYN SYN, ACK ACK
  33. 34. But why bother? Wireshark give it to you! Flow Graph: Is giving us a graphical flow, for better understanding of what we see
  34. 35. Here we go
  35. 36. But What Happened Here ??? Retransmissions, Duplicate Ack, Previous segment loss ….. We will see later ...
  36. 37. Capture Filters <ul><li>Filter examples </li></ul><ul><ul><li>ether host 00:08:15:00:08:15 </li></ul></ul><ul><ul><li>host 192.168.0.1 </li></ul></ul><ul><ul><li>tcp port http </li></ul></ul><ul><ul><li>tcp port 23 and src host 10.0.0.5 </li></ul></ul>Capture  Interfaces  Options:
  37. 39. Example #2– Capture traffic to www.ynet.co.il Capture filter definition: Host www.ynet.co.il
  38. 40. Display Filters
  39. 41. Example #3 – Filter Traffic Between Hosts <ul><li>Port mirror to be configured from the laptop, to </li></ul><ul><ul><li>The Server port or </li></ul></ul><ul><ul><li>The PC port </li></ul></ul>172.16.100.111 172.16.100.12 S D S D S D
  40. 42. Example #3 – Filter Traffic Between Hosts ip.addr == 172.16.100.111 and ip.addr == 172.16.100.12
  41. 43. Example #4 – Filter Traffic Between Hosts <ul><li>Port mirror to be configured from the laptop, to the router port </li></ul>To ISP 192.168.101.253
  42. 44. Example #4 – Filter Traffic Between Hosts ip.addr == 192.168.101.253
  43. 45. Statistics – Protocol Hierarchy
  44. 46. Statistics - Conversations With some manipulation
  45. 47. Statistics – Conversations - What can we do with it? On Layer-2 (Ethernet) – To find and isolate broadcast storms And then to go to the switch, and find the troublemaker
  46. 48. Statistics – Conversations - What can we do with it? On Layer-3/4 (TCP/IP) – To connect in parallel to the Internet router port, and check who is loading the line to the ISP And then to go to him/her, and ask questions ……
  47. 49. Statistics – I/O Graph <ul><li>During an HTTP download, we see the following I/O graph: </li></ul><ul><li>Is it a problem, or just the way it works ??? </li></ul>
  48. 50. Saving and Manipulating Files Save only displayed packets
  49. 51. Saving and Manipulating Files Save to XLS file
  50. 52. And You Will Get: Additional calculation for finding the DELAY
  51. 53. Filtering a Specific TCP Stream
  52. 54. Filtering a Specific TCP Stream
  53. 55. Colorizing Specific Data We want to watch a specific protocol through out the capture file
  54. 56. Colorizing Specific Data
  55. 57. Colorizing Specific Data
  56. 58. Colorizing Specific Data (TLS Connection Establishment)
  57. 59. Chapter Content A few words about troubleshooting tools Wireshark – basics Wireshark – advanced features Case studies
  58. 60. Analyze – Expert Info Composite
  59. 61. What is Retransmission?
  60. 62. Take a pen and paper (colors will help), and try to figure out what happened … 212.143.162.136 192.168.2.100 Frame 555, SEQ 725, ACK 191 Frame 600, SEQ 191, ACK 1349 9.938940 10.137339 Frame 601, SEQ 1643, ACK 1349 10.138715 Frame 602, SEQ 1349, ACK 3095 10.138.757 Frame 603, SEQ 3095, ACK 1349 10.138860 Frame 604, SEQ 1349, ACK 3105 10.138.757 Frame 639, SEQ 191, ACK 1349 10.589888 Retransmission RTO Expires 10.137339-10.589888= 0.4525 Sec Happens when: Lost frame (RTO Expires) Cause: Slow server/PC Errors / Packet loss Sudden increase in delay
  61. 63. What is DupAck (Duplicate Ack)? 212.143.162.136 192.168.2.100 Frame 555, SEQ 725, ACK 191 Frame 600, SEQ 191 , ACK 1349 9.938940 10.137339 Frame 601, SEQ 1643 , ACK 1349 10.138715 Frame 602, SEQ 1349, ACK 3095 10.138.757 Frame 603, SEQ 3095 , ACK 1349 10.138860 Frame 604, SEQ 1349, ACK 3105 10.138.757 Frame 639, SEQ 191 , ACK 1349 10.589888 RTO Expires 10.137339-10.589888= 0.4525 Sec Frame 640, SEQ 2023, ACK 3105 10.589923 Frame 641, SEQ 3095, ACK 1349 10.595574 Frame 642, SEQ 2023, ACK 3105 10.595610 Frame 644, SEQ 3105 , ACK 2023 10.595574 Happens when: Unexpected (not in order) sequence number Cause: Strong delay variations DUPACK DUPACK
  62. 64. Statistics – TCP Stream Graph
  63. 65. Round-Trip Time Graph <ul><li>RTT Vs. Sequence numbers gives us the time that take to Ack every packet. </li></ul><ul><li>In case of variations, it can cause DUPACKs and even Retransmissions </li></ul><ul><li>Usually will happen on communications lines: </li></ul><ul><ul><li>Over the Internet </li></ul></ul><ul><ul><li>Over cellular networks </li></ul></ul>
  64. 66. Time / Sequence Graph (Stevens) (#1) <ul><li>Time / Sequence representes how sequence numbers advances with time </li></ul><ul><li>In a good connection (like in the example), the line will be linear </li></ul><ul><li>The angle of the line indicates the speed of the connection. In this example – fast connection </li></ul>Seq No [B] Time [Sec]
  65. 67. Time / Sequence Graph (Stevens) (#2) <ul><li>In this case, we see a non-contiguous graph </li></ul><ul><li>Can be due to: </li></ul><ul><ul><li>Severe packet loss </li></ul></ul><ul><ul><li>Server response (processing) time </li></ul></ul>Seq No [B] Time [Sec]
  66. 68. Example A - Stable Performance File Transfer
  67. 69. Example A - Stable Performance File Transfer A stable throughput of around 1MB/8Mb per second It is important to test in parallel with SNMP tool for channel capacity
  68. 70. Example B – Non-Stable Performance Mail Transfer
  69. 71. Example B – Non-Stable Performance File Transfer Something happened here (After ~5.25 Seconds)
  70. 72. Example B – Non-Stable Performance File Transfer 5.25 seconds after start of stream, we don’t see any connectivity problems – probably slow server/applications
  71. 73. RTP Connectivity Stable stream BW
  72. 74. Chapter Content A few words about troubleshooting tools Wireshark – basics Wireshark – advanced features Case studies
  73. 75. Case Study #1 – Remote offices become very slow <ul><li>Test methodology: </li></ul><ul><ul><li>With NSMP, measure traffic to center </li></ul></ul><ul><ul><ul><li>Result – heavy traffic </li></ul></ul></ul><ul><ul><li>With Wireshark, test who generates the traffic </li></ul></ul>To ISP 192.168.110.0/24
  74. 76. Case Study #1 – Remote offices become very slow
  75. 77. Case Study #1 – Remote offices become very slow WARM !!!
  76. 78. Case Study #1 – Remote offices become very slow <ul><li>You can see it also in: </li></ul><ul><ul><li>Statistics  Conversations  IPv4 </li></ul></ul>
  77. 79. Case #2 – Slow HTTP Server Response 192.168.200.227 LB 192.168.3.50 192.168.1.58 192.168.1.46 192.168.1….. 192.168.2.138
  78. 80. Case #2 - Client Side
  79. 81. Case #2 - Server Side
  80. 82. Case #3 – Slow DB Response 10.2.1.105 10.1.1.7 Frame Relay Network (Year 2000)
  81. 83. Case #3 – Slow DB Response Connection Establishment
  82. 84. Case #3 – Slow DB Response And more packets (900+ since beginning of connection) …..
  83. 85. Case #3 – Slow DB Response And more packets (2000+ since beginning of connection) ….. 40mS delay between packets 2000Packets * 40mSec = 80Sec application delay !!!
  84. 86. Case #4 – Another Slow Application
  85. 87. Case #4 – Another Slow Application Analyze – Exert Info Composite gives us: Something here stinks …..
  86. 88. Case #4 – Another Slow Application Strong RTT Variations !!! (a problem with client-server)
  87. 89. Case #4 – Another Slow Application
  88. 90. Case #5 - Do we have a Problem ???
  89. 91. Case #5 – and the Throughput Graph Shows … Ooops ….. But, is it really a problem ???
  90. 92. Case #5 – Expert Info Composite shows …. Ooops ….. Nearly no events over here ……..
  91. 93. Case #5 – This is what the application does …. Interactive open/close read/write application This his what it requires from the network ….
  92. 94. Case #6 – FTP over Cellular Connection
  93. 95. Summary

×