All Posts by Kary

I was trying to connect my new Windows 10 PC to an old Netgear ReadyNAS Duo (Sparc Linux!) and it was not working. I fired up Wireshark and realized the issue was with the SMB protocol and found a fix. Share this post! Spread the packet gospel!

When application performance is slow, how do you know if it’s the network or the application? PacketBob* is gonna show you how to figure it out. This was a mail migration operation that was taking a long time. A glance over the capture and you might think the network is introducing some delays. If you understand […]

Here’s a case study from email subscriber Peter in troubleshooting slow FTP uploads. Scenario: The video team uploads video files via FTP to The Cloud and after a recent firewall replacement, the performance has dropped off by a large amount Now, Peter had already figured out the issue so kudos to him. He even said […]

Here’s a fun case study on troubleshooting a one-way performance issue. Of course, the root cause for every one-way performance issue won’t be the same as this one, but it’s a bit of experience to add to your bag. It’s very important when analyzing packets to take on the perspective of the host from which you […]

I mean what can I say about this one? Dude had been trying figure out the problem for a month. With a pcap I could see the problem right away. Learn how to do packet analysis, you guys. Share this post! Spread the packet gospel!

The Expert Infos in Wireshark are very helpful, but are they always right? You need to understand how TCP behaves to know if you can trust what Wireshark tells you. Let’s take Fast Retransmissions. Here’s what RFC 2581 says: The TCP sender SHOULD use the “fast retransmit” algorithm to detect and repair loss, based on […]

But more importantly, WHY you should do TCP sequence number analysis. Well, you know all those black and red packets in Wireshark? Sure, you’ve seen them, right? Scary, huh? What if someone says there’s a problem and you see a bunch of those packets in Wireshark. Is that the problem? This video will show an example of […]

There are fancy tools to help find scanning activity, but we talk about Wireshark and packet analysis here, so let’s talk about finding scanning activity if all you have is the command line. When I say “command line” I mean a shell like bash on Linux, Mac, or Cygwin on Windows. Let’s say you have […]

Here’s another real world example of troubleshooting performance problems. An email subscriber, Simon, contacted me about poor Tomcat throughput on Windows 2008R2 – whenever Tomcat served a large file, download speed sucked. To Simon’s credit, he eliminated “the network” by verifying that Apache and IIS did not have the same issue. Here’s where a mediocre network […]

Every case is different and your first steps depend on what the issue is. Let’s say someone complains of a performance issue and gives you a packet capture. That’s all you know. Where do you start? I’d probably try to get more information than spend time looking for something that I don’t know what I’m […]