1// WSUG Chapter Four
2
3[[Chap04]]
4
5== Troubleshooting with Wireshark
6
7=== An approach to troubleshooting with Wireshark
8
9Wireshark is a very useful tool for network troubleshooting, since it contains a
10number of features that allow you to quickly focus on problems in your network
11for several reasons:
12
13* It allows you to focus in on specific packets and protocols, as you can see a
14  large amount of detail associated with various protocols.
15
16* It supports a large number of protocols, and the list of protocols supported
17  is growing as more people contribute dissectors
18
19* By giving you a visual view of traffic in parts of your network, and providing
20  tools to filter and colorize that information, you can get a better feel for
21  your network traffic, and can understand your network better.
22
23The following general approach is suggested:
24
25* Determine that the problem looks like a networking problem. There is no point
26  in capturing packets if the problem is not networking related.
27
28* Figure out where to capture packets. You will have to capture packets from a
29  part of the network where you can actually get network traffic related to the
30  problem. This is especially important in the presence of switches and routers.
31  See <<Ch04ROUSWI>> for more details.
32+
33Because Wireshark can read many capture file formats, you can capture using any
34convenient tool. One useful approach is to use _tcpdump_ to capture on remote
35systems and then copy the capture file to your system for later analysis. For
36more details on capturing with _tcpdump_, see <<Ch05tcpdump>>.
37
38* Once you have captured packets that you think relate to the problem, load them
39  into Wireshark and look for your problem. Using Wireshark’s filtering and
40  colorization capabilities, you can quickly narrow down the capture to the area
41  of interest.
42
43* Examine the appropriate fields within the packets where the problem appears to
44  be. These can often help to reveal the problem.
45
46[[Ch04ROUSWI]]
47
48=== Capturing in the presence of switches and routers
49
50In the old days of Ethernet, all network traffic was spread over one “yellow”
51cable through the whole network. Capturing data was easy, as all packets from
52the network could be captured using the “promiscuous mode” at any place in the
53network. The only devices blocking network traffic, were routers. But as routers
54were extremely expensive, they were not widely used.
55
56Then Ethernet wiring using hubs become the state of the art. As the hubs still
57spaded the packets all over the network, things regarding capturing didn’t
58change.
59
60At the next stage, Ethernet switches became widely available. This complicated
61things a lot. When capturing traffic on a computer connected to a switch,
62usually the switch will only forward packets to the computer, which are directed
63to it, or to all computers (broadcasts). It’s much the same like deactivating
64the promiscuous mode of the capturing network card.
65
66There are some ways to circumvent this.
67
68Many vendor’s switches support a feature known as “port spanning” or “port
69mirroring” in which all of the traffic to and from port A are also sent out
70port B.
71
72=== Examples of troubleshooting
73
74Troubleshooting often requires a reasonable knowledge of the protocols in
75question. However, as Wireshark will often give you some good hints, you might
76get an idea of what is going wrong simply by looking in the packets being
77exchanged.
78
79// End of WSUG Chapter 4
80