1// WSUG Chapter Four 2 3[[Chap04]] 4 5== Troubleshooting with Wireshark 6 7=== An approach to troubleshooting with Wireshark 8 9Wireshark is a very useful tool for network troubleshooting, since it contains a 10number of features that allow you to quickly focus on problems in your network 11for several reasons: 12 13* It allows you to focus in on specific packets and protocols, as you can see a 14 large amount of detail associated with various protocols. 15 16* It supports a large number of protocols, and the list of protocols supported 17 is growing as more people contribute dissectors 18 19* By giving you a visual view of traffic in parts of your network, and providing 20 tools to filter and colorize that information, you can get a better feel for 21 your network traffic, and can understand your network better. 22 23The following general approach is suggested: 24 25* Determine that the problem looks like a networking problem. There is no point 26 in capturing packets if the problem is not networking related. 27 28* Figure out where to capture packets. You will have to capture packets from a 29 part of the network where you can actually get network traffic related to the 30 problem. This is especially important in the presence of switches and routers. 31 See <<Ch04ROUSWI>> for more details. 32+ 33Because Wireshark can read many capture file formats, you can capture using any 34convenient tool. One useful approach is to use _tcpdump_ to capture on remote 35systems and then copy the capture file to your system for later analysis. For 36more details on capturing with _tcpdump_, see <<Ch05tcpdump>>. 37 38* Once you have captured packets that you think relate to the problem, load them 39 into Wireshark and look for your problem. Using Wireshark’s filtering and 40 colorization capabilities, you can quickly narrow down the capture to the area 41 of interest. 42 43* Examine the appropriate fields within the packets where the problem appears to 44 be. These can often help to reveal the problem. 45 46[[Ch04ROUSWI]] 47 48=== Capturing in the presence of switches and routers 49 50In the old days of Ethernet, all network traffic was spread over one “yellow” 51cable through the whole network. Capturing data was easy, as all packets from 52the network could be captured using the “promiscuous mode” at any place in the 53network. The only devices blocking network traffic, were routers. But as routers 54were extremely expensive, they were not widely used. 55 56Then Ethernet wiring using hubs become the state of the art. As the hubs still 57spaded the packets all over the network, things regarding capturing didn’t 58change. 59 60At the next stage, Ethernet switches became widely available. This complicated 61things a lot. When capturing traffic on a computer connected to a switch, 62usually the switch will only forward packets to the computer, which are directed 63to it, or to all computers (broadcasts). It’s much the same like deactivating 64the promiscuous mode of the capturing network card. 65 66There are some ways to circumvent this. 67 68Many vendor’s switches support a feature known as “port spanning” or “port 69mirroring” in which all of the traffic to and from port A are also sent out 70port B. 71 72=== Examples of troubleshooting 73 74Troubleshooting often requires a reasonable knowledge of the protocols in 75question. However, as Wireshark will often give you some good hints, you might 76get an idea of what is going wrong simply by looking in the packets being 77exchanged. 78 79// End of WSUG Chapter 4 80