The Expert Infos in Wireshark are very helpful, but are they always right? You need to understand how TCP behaves to know if you can trust what Wireshark tells you. Let’s take Fast Retransmissions. Here’s what RFC 2581 says: The TCP sender SHOULD use the “fast retransmit” algorithm to detect and repair loss, based on […]
There are fancy tools to help find scanning activity, but we talk about Wireshark and packet analysis here, so let’s talk about finding scanning activity if all you have is the command line. When I say “command line” I mean a shell like bash on Linux, Mac, or Cygwin on Windows. Let’s say you have […]
So you’ve got a problem and you decide to fire up Wireshark and take a capture. When you look at the packets you see a bunch of them that are far larger than the 1500 byte MTU. HOW CAN THIS BE?!?!? There’s something you need to know about taking captures on the host that is […]
Throughput is generally measured in the amount of data sent over time e.g. bits or bytes per second. Sending more bits in a shorter amount of time equals higher throughput. So let’s talk about some of the factors that control how much data can be sent in a given time period. Here’s some data represented […]
(I’ll explain this picture later.) This whole thing started when I posted Why don’t more people know how to do packet analysis? on reddit. Up to that point, I thought maybe it was just me and a few others who valued and dug packet analysis since I hadn’t met many people who could do it […]
If I’m troubleshooting a performance issue, one of the first tools I reach for in Wireshark is under Statistics > TCP StreamGraph > Time-Sequence Graph (tcptrace). At a glance I can tell if this is going to be an easy one to analyze or if I’m gonna have to roll up my sleeves and dive […]