Ethernet, fast ethernet, and gigabit ethernet,
and now 10 gigabit ethernet
are some of the most commonly found
protocols on networks today
because that how most,
if not everything single connection is made.
Yes, we have wired and wireless most of it,
everything operates the ethernet today.
Where as in the past,
we had things like Token Ring.
It's generally, none even in existence if unless
it's a mainframe backend connection
connecting to a segment of the network
that may have not been updated as of yet.
We've seen this out in a
when we're troubleshooting
and trying to solve problems, there's this old
ERP system running on an IBM mainframe
that's actually still has it's Token Ring
connections, but today,
99% of what you're going to be troubleshooting
especially when you're capturing with Wireshark
is going to be some version or flavor of ethernet.
So why is ethernet important?
So as we mention this, the most commonly used
layer 2 protocol today, most if not everything
that you capture is going to
you're going to see ethernet and there's a lot
stuff that you can glean from it.
So specifically, the MAC address
or the burn in address, the BIA
of the devices that are sending
the traffic source and or where
it's sending to the destination.
Now, you're going to generally see this
in hexadecimal format.
So here in this example, you can see all f's,
that if you actually dig the translation
to boolean, you'll see that it goes from all f's
to an IP 255.255.255.255
So essentially, what this ethernet 2 frame
is sending this from a specific source of a
a NIC card which is also hexadecimal of
double O colon 19 (00:19) and so forth.
to a destination broadcast of all f's.
So generally, it's common that the burn in
address, the first grouping of numbers in hex
is going to spell out the specific vendor.
So whether it's a Cisco device
or an HP device or a Dell device
these are the types of things that you're going
to see when you're capturing the data.
So be aware that if you're trying to look for
some, some problem on the network
and you see tons of broadcasts, it may be a
a chattering NIC card which is
damaged NIC card. And you may be able to
track it down by just finding this information.
You may find it in the MAC address table
of the switch and you may be able to then
find the port in which it's coming from and
be able to drill down and
find this broadcasting NIC that is potentially
creating havoc on your network.
So this is potentially when we, the things
that you could find when using Wireshark
and you capture the data, you want to know
what, what kind of, what kind of things
can we use Wireshark to do?
This specifically at layer 2, the lowest layer
above layer 1, the physical layer where
you can actually see frame to data.
You could see that it's ethernet and again,
likely it's always going to be
the same frame type. Most commonly,
I should say, and what exactly
are we looking for within this data?
We're looking for things, like we just said,
you can find broadcasting traffic, maybe
find the NIC card that's a problem.
And some other common issues would be,
alright, we may have an encapsulation issue.
Like we said before, that's an ethernet 2 frame.
We might have an incorrect frame type.
We have, may have media problems where,
specifically, the actual device
because it works electronically,
may have take a power hit.
And now it's causing some kind of issue.
We've seen this in the form of corrupt data.
We've seen NIC's that don't operate as
they should or they're, they're altering
the data because they've been damaged.
So, these are the things that you can do
whe you capture the data with Wireshark.
You could find them and captures data,
filter on it and zero in on this types of
problems. So again, with the capturing
of the data and analyzing it, so specifically,
some of the things that you may try to
find with Wireshark is, ok. I think I have
a problem. I think I've isolated to this segment.
It seems to be poor performance
on this particular network segment.
And I think if I span a port
and I start collecting the data here, I might
get a clue as to what's going on.
If I do that and I start capturing data at layer 2
and I see a ton of broadcast traffic,
I may be able to zero in and find specifically
where that traffic is coming from,
the originating source. And either take that note
offline and take a look at the capture again
and see how it's working,
and or isolate it to a single or a group of devices.
So, what does it do for the protocol?
It opens up the protocol for analysis
as we saw in the earlier slide.
It allows you to look at things like -
Is it the incorrect frame type?
Is it an all broadcast traffic?
And then if you're going to try to troubleshoot
what it's doing on the network,
what's the actual impact?
You can use this to see ok, well we have
degraded signals, we have corruption.
There's tons of collisions taking place,
broadcast traffic. So these are, again
some of the things that you can use Wireshark
to do, to help isolate your traffic, and
when you do that, you can potentially
you could save the day.