With the Wireshark network analyzer, networking pros can address a wide range of monitoring for functions that range from bandwidth optimization and application analysis to troubleshooting and network security. Wireshark is an open source network monitoring tool, so networking pros can tailor the tool to their exact needs. And those needs can range from basic traffic transmission testing to intrusion prevention, analysis of bandwidth usage, application security testing and identification of faulty configurations.
In "Wireshark Network Analysis: The Official Wireshark Certified Network Analyst Guide," Wireshark expert Laura Chappell explores various traffic types, as well as application-specific monitoring and analysis on a WLAN.
In "The World of Network Analysis," chapter 1 of Wireshark Network Analysis, Chappell explains how to launch an analysis session and understand traffic flows and runs over a list of technologies that affect packet flow, offering up some Wireshark network analyzer case studies. In the excerpt below, Chappell offers a checklist of must-do analysis tasks, all of which can be completed with the Wireshark network analyzer as an open source monitoring tool. You can also read all of the "The World of Network Analysis."
Review a checklist of analysis tasks
Analysis tasks can be considered preventive or reactive. Preventive methods include base-lining network communications to learn the current status of the network and application performance. Preventive analysis can also be used to spot network problems before they are felt by the network users. For example, identifying the cause of packet loss before it becomes excessive and affects network communications helps avoid problems before they are even noticed.
Reactive analysis techniques are employed after a complaint about network performance has been reported or when network problems are suspected. Sadly, reactive analysis is more common.
The following are some of the analysis tasks that can be performed using Wireshark:
- Find the top talkers on the network.
- Identify the protocols and applications in use.
- Determine the average packets per second rate and bytes per second rate of an application or all network traffic on a link.
- List all hosts communicating.
- Learn the packet lengths used by a data transfer application.
- Recognize the most common connection problems.
- Spot delays between client requests due to slow processing.
- Locate misconfigured hosts.
- Detect network or host congestion that is slowing down file transfers.
- Identify asynchronous traffic prioritization.
- Graph HTTP flows to examine website referral rates.
- Identify unusual scanning traffic on the network.
- Quickly identify HTTP error responses indicating client and server problems.
- Quickly identify VoIP error responses indicating client, server or global errors.
- Build graphs to compare traffic behavior.
- Graph application throughput and compare with overall link traffic seen.
- Identify applications that do not encrypt traffic.
- Play back VoIP conversations to hear the effects of various network problems on network traffic.
- Perform passive operating system and application use detection.
- Spot unusual protocols and unrecognized port number usage on the network.
- Examine the start-up process of hosts and applications on the network.
- Identify average and unacceptable service response times (SRT).
- Graph intervals of periodic packet generation applications or protocols.
Networks vary greatly in the traffic they see. The number and type of network analysis tasks you can perform depends on your network traffic characteristics.
You can read all of this chapter, "The World of Network Analysis," or learn more about the book Wireshark Network Analysis.
To learn how to use Wireshark to sniff network traffic, read this Wireshark tutorial.
This was first published in May 2010