Statistics and troubleshooting with them is basically
Wireshark takes a whole bunch of information,
provides it to you in a way in summaries or gives you tools so that you can do baselines.
You can get general information about everything that's going on
so that you can make some, some decisions on what you're seeing and
how that is going to affect your troubleshooting process.
So, some of the most helpful ones which we we've already touched on
and as we were going through the other modules,
and we will continue to touch on through future modules
and hopefully, you get into the habit of using if you do not do so already
is these summaries and these conversation summaries to show you specifically
what's on your network, what's speaking and where, what it's speaking to.
What's communicating with what and what direction?
And other important pieces of information such as what protocols are running,
what is, what was captured, helps you build out your filters.
Helps you to come to some conclusions about what may be running on your network.
There is a whole subset of servers' response time graphs which allows you to plot
specific things, like how, if you're using an application, how it's actually being seen
as a roundtrip or something of that nature.
And it's plotted on a graph. You can find this in statistics.
And you can use your I/O graph where you can add more filters.
And you can use flowgraphs so that you can see traffic flow,
traffic flow patterns and this is extremely helpful
when looking at TCP's, specifically the TCP handshake.
So, we briefly touched on it before as we were talking about filters
because I thought that it might be relevant to helping you build filters but
this is really where we're going to go into this menu and talk about
what you can find here.
So, on this menu, you could select from about a dozen tools
which will allow you to do some statistical analysis with Wireshark.
And one of the key things here is that
some of the tools that we already talked about
are found on this, in this menu as well as some others
which we'll, we will get into in our future modules as we troubleshoot some specific problems.
For example, if we're looking at some wireless LAN problems,
we will use the wireless LAN traffic option to see specific SSID's as an example.
But regardless, it should be something that you do get in a habit of using.
Something that you're comfortable with and something that you, you test with
so that you can see specific options that are available.
So what I'll do is I will show you some of the things here that we can do.
So let me clear out my filter from before.
And the first thing I want to do is I want to look at the summary.
So this is my capture summary. It's everything that's in the capture.
As you can see here, what's helpful is the, the name and location
of the file or the capture itself,
how big the capture is, the file format which is pcapng.
We will talk about file formats in the last module.
But what's very important about that module is that there's different formats you can save in
and if you save in the older format such as pcap, as an example
this capture file comments or packet comments will not
translate over so you may miss some information.
It will tell you date and time again as we've talk about in the future.
I'm sorry, in a, we talked about in the past module.
This is critically important to make sure that the
timing on your system is accurate, maybe use NTP.
Otherwise, you're going to have incorrect time.
How long the capture was, where it was caught, and so on.
So there's a lot of information here that you can glean
specifically the amount of packets and this is a good one right here,
between first and last packet, your average time in seconds.
Now, where is this playing to being helpful is that if you're just
capturing a simple conversation that you were running
a pre-capture filter on and you knew that you're isolating
that conversation, you might be able to find right there
that that entire conversation took X amount of seconds.
So, there's some things that you could do in, to get the information in here more accurate.
And this could be very helpful in determining some high level causes of an issue.
So also, there's some comments summary, so if you made comments in the packet,
you will be able to pull them there and it's nice because you can either save it as or
copy and save as. You can save this information,
paste it into a report.
You could show address resolution, the protocol hierarchy which we already covered
in a previous module. It'll show you your top talking information,
your data on your network and what protocols were in use.
You can see your conversations. This was critically important
for us to figure out where to apply a conversation filter.
As we mentioned before, we can filter directly on, ok?
Other important statistics is the end point list.
You can find what end points are in here.
You can search and find what your packet links are.
One of the helpful things in here, sorry open on the wrong screen,
is that when you search for packet links, why this could be helpful to you,
is that we essentially would not want a ton of tiny packets on our network.
It just makes everything work harder. It inundates buffers.
What we would rather have is something in a correct MTU size
and or jumbo frames if you have everything enabled across your network.
So it all comes in one conversation and it's not inundated with, you know,
packets to increase I/O. And as you can see, in this summary,
there's actually a lot of little packets.
So that might be something that you want to look at as you're troubleshooting.
You may want to say, well you know what,
maybe poor performances because there's a lot of small packets.
You can build an I/O graph. This will show you some specific things.
We do a module on this so I don't want to go too deeply into it here.
But you can filter specifically on some traffic,
so I believe there's some HTP in here and I can see in here some spiking.
So it allows me to, to do things with it so that I can really see
what's going on and I can change the way I see it.
But you can get these, these very quickly from your statistics menu.
You can do a compare. You can pull up specific HTTP information.
The requests as an example, you can do your TCP
or your UDP streams, graphs from here.
One thing to mention is if you're highlighting a packet
in your packets list pane, and it happens to be
a packet that is TCP, it will be grade out and you will not be able to see it.
So that may be something that you want to take heed of.
Or if it's UDP, it will allow to pull up a graph of the actual traffic.
And you can do some statistical analysis on this.
The flow graph, this is very helpful.
We'll just look at all packets at TCP flow.
Well we'll also have another module on this so we won't get very deep into it but
where this is helpful, it will let you know from what particular IP to another particular IP.
Packet by packet, specifically showing you the time deltas, exactly what's taking place.
So you can see, for example, a large amount of resets
if that's something that was problematic.
Or you may see duplicate acts if that,
you believe that it shouldn't be re-transmitting as much.
So there's a lot of information that you can glean from in here.
And so on and so forth. So, we don't want to go deeply into each one of those tools
because we have a separate module on them but
it was something where we wanted to show you that yes, you can, in fact
pull up some key data and statistics from here.
And you can look at your, your capture as a whole.
And that's essentially what we really want out of, out of this menu, is the tools.
We want to say, ok well, as a whole what does this capture look like
in the realm of protocols, in the realm of errors,
in the realm of objects, in the realm of whatever it is that you want to see
as a menu option, what does it look like as a whole.
And then we can actually drill down from there into key areas of it which is extremely helpful.
It's actually, this is very helpful for when you run a capture for the first time.
A lot of times it would be, it would be suggested that you open this menu up.
And you really take a deep dive into the overall of what's going on.
So that you can then decide how you want to drill down.
This is very helpful for large captures that you may not know exactly what the issue is.
You may not, not even know what's running on the network
because you may not be familiar with it
or you may just not know that it's there.
So, Wireshark will allow you to do statistics,
statistical analysis from the data we find it through the statistics menu.
And some of the very helpful, very helpful things
we can glean from this menu and it's options and it's tools,
is what protocols are running on your network that Wireshark has captured from that segment.
What are the top talkers, who's talking the most
and from whom to whom, and is it a one to many or
many to one type conversation?
Is it a unicast, what type of conversation is it?
And we have some tools in there that we will get into
in more detail but we have specific tools
that will allow us to gather more information about the capture that we just took.
2 notes - remember, things may be grade out.
They'll be grade out if they're not in option so if you don not have any wireless traffic
do you, wireless LAN or WLAN traffic tool will not be available to you so
be wary that if it's grade out it's for a reason, it's because it's not relevant to that capture.
And make sure that as you're going through your capture you're making notes.
You can paste a lot of this stuff into a report or, or export it into a report
to give you an overall baseline of your, your network
operating under good conditions and
if operating at a performance degradation, you can look at both reports
and or both captures and figure out statistically what the differences are.
And lastly, just remember, one of the key aspects of using this tool -
let's find out what's running on our network, what we're capturing.
So that we can then further drill down into it.
If we're not seeing, for example, SNMP as you do not see in this particular statistics.
Capture - you may not want to start worrying about how to build filters for it
because it's likely that it's not there in the capture to search for.
So, hopefully that through this module, these tools and learning about them
has made it easier and more efficient for you to use Wireshark.
Alright, so one of the questions in the chat are
do we have scenarios of issues to go through and how we use Wireshark
to come to the conclusion of a problem?
So, if you look at the syllabus, tomorrow is pretty much all that.
We're going to go through voice, HTTP,
FTP, wireless, each module is a problem.
And we'll look at Wireshark and figure out how to solve that problem.
So yes, today I'm prepping that in as we talk about the tools themselves.
So as an example, we did bring up a DNS issue where the client could not communicate.
It was in a large capture full of data.
So we filtered out all the data that we did not need to see
and we isolated the communication adn showed the actual failure
of the client being able to resolve DNS.
So, yes, we do have scenarios.
Today will be scenarios that are put in to the modules.
Whereas tomorrow's, the modules each one of them is a scenario.
So I hope that helps answer your question.
Packet loss is a little tricky to capture.
Wireshark will give you clues.
One of the things that we're going to talk about in the next module is using the flow graph
which actaully the timing of that question is perfect
because the flow graph is going to be able to show you
specifically when you pick the TCP flow, how well it's perform
your application is performing. So for example, if you're trying to
send a request to pull a webpage
and you see in capture that the data keeps re-transmitting
or you're getting duplicate acts or
you're seeing a lot of re-transmissions,
it's likely that, that something may be getting dropped somewhere.
It could be something else but there's a way to, to isolate that
and the clue that, the clues that you're going to get
may be from Wireshark's flow graph.
So, we're going to get into that in the next section
but just real quick,
when you go to the statistics menu, when you pull up flow graph,
you can take a look at either all or displayed packets, the TCP flow,
and it will show you a very detailed view
of exactly what's going on from source to destination.
There's actually multiple IP's up here, source to destination.
That's what the arrow is showing you.
And it will show all the TCP communication.
Here I have a bunch of resets which could be an issue.
If you see a ton of resets coming back, there's obviously something wrong there.
If I see constant duplications of an act that may be something's getting dropped
and it has to resend it. So, there's some granular filters
you can look, put in which we covered in another Q&A section.
Or you can use something such as the flow graph
to try to figure out what's going on from one IP to another IP.
And see if that gives you a hint.
You can also go to the analyze menu and look at the Expert
where it may tell you, as an example
that you have duplicate acknowledgements.
And you have many of them.
They may be coming from the same IP, source to destination.
We have tons of suspected re-transmissions, that may be an issue.
We can have windowing problems where buffers are overloaded.
So, all of these things basically could relate to packet loss.
And the more that you dig in to the tool and figure out specifically from one IP to another
where you may think there's a performance issue
by isolating re-transmissions, duplicated acknowledgements,
windowing problems. If you see all these stuff from something that's performing poorly
it's likely that you may have some, some packet loss.