Ok, for our next section, we will be discussing
I/O graphs, input/output graphs.
So basically, first let's talk about input and output.
So when we talk about computers or systems or
routers or data, things go in and things go out.
Commonly, CISCO engineers would like to talk about FIFO - first in, first out.
There's a lot of reference to, when you look at disc utilization,
the I/O of the disc, in and out, the speed of the disc.
There's so many references to I/O but in the Wireshark world
I/O is referenced as a way to view statistical data about your network -
the input and output data on your network found in the statistical menu, statistics menu.
The I/O graph is a tool which allows you to view the input and output of data on your network
for the time of capture. So what you captured,
your packets from 1 to however many packets you captured
the I/O graph will show you that entire capture
on an x and y axis, specifically the amount of data
and you can run filters on it to view it in different ways.
So the I/O as seen in the graphic here, I put some basic filters in.
We'll do a live showing of this so that you can get more feel for it but
you can put up to 5 graphs in and you can change
your x and y axis to basically show
the input and output of the entire capture and how it relates to the actual y axis.
So, let's pull up Wireshark where I've already prepped one.
In this capture, I basically had set it up in a way to show
I looked at the protocol hierarchy
and I saw that HTTP was the top talking protocol.
And I looked from specifically in seconds, from 0 out to the end what that looked like
based on the y axis which was packets.
So I'm looking at, and you have to know your x and y axis is
specifically in seconds by packets.
So, to very quickly understand this graph, all you need to do is
put in what it is that you want to see,
and then on the x and y axis configured specifically in this, the x axis -
so I want to see it by 1 second if I wanted to see 10 seconds.
It changes that view.
If I want to see it in 1 minute, it changes that view.
And so on, so I put it back to 1 second.
And or I want to see packets on the y axis, how many? Or bytes.
So again, this just shows me statistically what it is that I want to see.
And it shows me anomalies.
So for example, I see a couple of spikes here at certain time intervals
and that may be very relevant to, let's say, for example, at those particular moments
I had a performance degradation,
I might be able to pull something out of this I/O graph
that shows me specifically
that in 1 second intervals at 60 something seconds,
and when I review it by bytes, I had a major surge of bytes
when using HTTP twice within this time period.
I can change the look and feel. So if, if I'm vision impaired,
or if I want now to distinguish differences between what I see
as HTTP or TCP or anything else, I can now change up what it looks like
per filter so that I can now distinguish what it is that I see.
In this filter, I took the top talkers from the protocol hierarchy.
I selected HTTP, TCP, UDP, IP and net bios.
And I plotted them with these filters on this I/O graph
so I can see how they, how they, how much they occured
within this time period in this capture.
So another point, a very important one actually is
you can't just add this information in and it shows you have to apply it.
So on the left-hand side of where you apply the filter, there is a button, here.
And you can turn this information off so that
you can see one filter over the other or you can see them all at the same time.
Just be aware that if you do not select this, or deselect this, you may add a filter in
and you may wonder why you can't see it or it's not showing up.
And the reason being, because you have not applied it.
So just be aware of that - there is some manual intervention
that needs to take place here.
So again to recap, to use the I/O graph, to use the statistics menu in the capture window,
you select your I/O graph and once you do, you could populate it with filters 1 through 5.
You can select and deselect them. You can change visually what they look like.
And you use this to tell a story.
The story you're going to tell is based on how you adjust your x and y axis.
Specifically, when you go in to adjust your x and y axis,
you can do so by time.
You can do so by unit and there are multiple selections that you can choose from.
So I advise you to go through and figure, that again for example,
if you wanted to see packets versus bytes,
that's something that you can select and choose.
So as we just mentioned, if you're going to customize the graph,
there's 5 different filters you can put in.
You can select different views and you can set the axis
specifically to what it is that you want to see.
And there are advanced statistics that you can do.
And this is a question that has come up in the past.
How do I dump this information?
Obviously, we can do a screen shot, paste it into a report.
Or what you can do, tricks that I've seen in the past,
is that you can dump this CSV into a Excel worksheet.
And then you can run some advanced statistics on the data which can be very helpful.
You can use it to find more anomalies and or baseline the data or
capture it over time and run averages. There's quite a few things that you can do
with an I/O graph. I hope that this tool is helpful for you.
It is just one of many statistical tools that you can use to troubleshoot with.
And just remember there's some more advanced features that you can use
if you take the information out and you use it in Excel.
So the 2 questions that I saw here specifically was
I'm running net full 9 on a Nexus 7k and would like to run a decode on the packets
is it possible to do that with Wireshark?
It is possible, however, it should be noted that I had to research specifically what that was
and the answer was that you have to know the port numbers and you have to use
Wireshark functionality set as decode as. So where I generally use Wireshark,
to translate issues from, you know, application problems and response,
I just wanted to make sure that you had the correct answer from Wireshark directly.
So that is the answer that was pulled from there. And then the other question
was that - can I use I/O graphs to check specific QoS settings, and so on and so forth?
One thing that I wanted to mention was the I/O graph is as limited as
to the filter sets that you can create. So if, and these are a large amounts of filters,
but if you can't create the filter,
then the I/O graph is not going to be able to represent it.
It sounds to me like you want to look at something more like
Mazu or cascade profiler, stream analyzers.
That kind of stuff where it's going to give you a bigger picture of all that data.
So, Wireshark is immensely helpful but it is limited somewhat to what it can do.
And it's limited to the filters that you can build. So I hope that also answers your question.