In routers and switches, a lot of the data
that you capture with Wireshark
this is the most commonly thing, common
common hardware that you're going
to use with Wireshark.
And one of the most important things
to remember, remember with switches
is that, basically what it's going to do is
keep the information the same
from source to destination.
So, a lot of the data that you're capturing
in the switch segment is going to be
pretty easy to sort through.
There's a lot of information
that can be gathered from the packets -
such as the frame,
information that we talked about.
We can do advanced captures with the switch
so we can send the data to a span port.
But just remember that on a switch segment,
it's basically sending the data
in the, from the source in the switch and then
if that switch knows where to send the data
and it's scan table is going to
send it out the appropriate port
or it's going to send it out all the ports
to find the destination.
So, particularly,
it's going to do that by MAC address.
It's going to keep this table,
it's going to know exactly where to send it
or it's going to send the data at all ports and
hopefully, it will find that
and if it doesn't, then obviously
it's not configured on your network.
But one of most important things
to remember with Wireshark
is the data that you are looking for
is not information that's going to be
going over a routed segment.
It's likely not to be firewalled,
it's going to be easier to
look at and understand.
With the routed segment,
this gets a little different.
So with the routed segment,
the information as it goes into the router
will be sent by it's routing table look up
to the next hop
and or, it will, you know, it's going
it's going to send the data
in a way where it's going to
find with it, send the data and or
it's going to change the information such as
the MAC address as it goes from hop to hop.
So what can get, what can go wrong?
So for this example, we're going to use
a hot stand by routing protocol
and we capture the data
to show exactly
what information can be seen
when you're using this protocol.
So, when you, you would use this protocol
in a way, where you want
resiliency in your network.
So, for example, you have a gateway,
the data knows to go to the gateway,
and what if you wanted to have a way where
if the data was going to be
critical to the, the enterprise -
what if that router went down?
What if there was an issue with that router?
Well, if you configure HSRP
and you have a VIP to send to,
it's going to know that virtual IP,
and then it's going to have a
primary and secondary behind it
and those will be the 2 routers.
So, essentially,
when you're capturing with Wireshark,
you're going to see that in your capture
as the destination address,
the protocol as HSRP
and it's going to show the hello packets
as a state of standby or active.
So, this maybe tricky 'cause
if you don't understand what that means -
you're going to capture this data and
not really know what you're looking at.
But in this example,
you can see that particularly,
with HSRP, you're going to be able to
troubleshoot problems such as
ok, well the active is down,
it's going to specifically
the wrong broadcast address.
It's not functioning, but
what you're going to have to do is
you're also going to have to look
inside the router. So as we mentioned last time,
one of the key aspects of using this tool is
to not simply use this tool
in it's entirety or in an isolated fashion.
What you're going to also want to do
is you're going to also want to
log into the routers,
you're going to want to check the logs
you're going to want to see which one's active,
you're going to want to see which one's standby,
and if you have problems there as well.
As you can see from this segment,
one of the key aspects of using
Wireshark on this network is
one of the things we did
was set up a span port
and we captured the data as close
to the routers as, as possible.
So one of the things that's important with
using Wireshark is,
when you're troubleshooting something
and you want to get as close to
as the problem as you can.
And or send the data directly from
what you think is the target problem
to Wireshark.
If you install Wireshark,
for example, on a segment
where that traffic doesn't exist
or is blocked, you're not going to be able
to see that there's an actual problem there.
So in this example where you have
2 routers on a segment,
if you had set up
Wireshark, for example
on the server and it wasn't
able to see that data and
you weren't able to capture that data
then you won't be able to look at actual data
to find out about the problem.
So, some of the information
captured may point to
or reveal problems such as
incorrect gateway assignment,
an incorrect path.
Again, you're going to be looking
at the data from the source
to the destination.
So you're going to want to see that your client's
configured with the correct gateway.
It's going to the correct VIP
and when you capture and isolate that data
you may be able to find
what the root cause of that issue is,
or the underlying problem.
Again, you're going to want to look at
the actual encapsulated data.
You're going to want to look at the headers,
you're going to want to analyze the protocol,
or you're going to want to look at the traffic flow
from source to destination,
you're going to want not just
use Wireshark with other tools
such as the router logs,
maybe send a trace
to see exactly where it's ending up.
And after the data is captured,
you can analyze it,
look at all applicable layers
or the under the hood details
and try to solve the problem.
Again, as you can see,
we can drill down into the data
so we selected one HSRP packet,
we drilled down into it
and we could find things such as
the destination. We could see that's a multicast.
We could see that it's a 20 bytes header.
We could see specific things that will allow us
to solve the issue, for example, the source
to the destination,
the destination being 224.0.0.2.
These are the things that we can look at
specifically within Wireshark
to try to gain more information
so that we can dig deeper into it
and try to solve the issue.
When we capture the data,
we'll be able to inspect it,
we'll be able to look at that data,
see what the types of problem are
if there are any problems.
In future modules, we'll talk about the Expert.
This is a helping hand
to give you some more insight into the tool
to allow you to look at the data a little closer -
the ability to protocol analysis.
Again, what's most important about
understanding protocols, you know,
how does that actually work inside the protocol.
What is it doing?
Wireshark will allow you to open this data
so that you can look at the specific data
to try to summarize what the problem is.
And it will help you to see things that
you would not be able to see
if you had not captured the data.
And again, traffic analysis
maybe there's a reason why
this data cannot use HSRP
or the clients cannot get there.
You can do traffic analysis
to try to dig in deeper
to see what the issues may be.