Ethernet networks can run remarkably well for long periods of time, lulling IT admins into a false sense of security. Unfortunately, disaster can strike at anytime, and to the under-equipped, network issues can be downright debilitating.
Some of the most serious network problems can include broadcast storms, in which a defective or misconfigured network device floods the network with traffic. Broadcast storms tend to amplify themselves until they completely shut down your network, which is bad. Another common threat is a malware-infected computer, which can send a barrage of e-mail or attempt to replicate to computers on your LAN or across the internet. An infected computer can slow down internet traffic and put you on bad terms with your ISP.
And sometimes a single user can use so much bandwidth that it affects other users on the network. Perhaps they’re using peer-to-peer file sharing software, consuming excessive streaming audio or video, or just downloading lots of large files.
Fully understanding everything that’s happening on your Ethernet network is truly a herculean task, but with common sense and some practical tools, a jack-of-all-trades IT person can track down these basic problems.
When first launching Wireshark, it’s easy to become intimidated. It’s extremely powerful and offers a myriad of options. However, there are only a few basics that you need to know before you begin.
First, you need to know what traffic you’re actually monitoring. Back in the day when hubs were common, all traffic was transmitted to all ports. As you can imagine, that didn’t scale very well. Switches are a refinement of hubs in that they discover the hardware addresses associated with each port and only transmit relevant traffic between ports. This means if you just plug your computer running Wireshark into any available switch port, you’ll only be able to see traffic to and from your computer and broadcast/multicast traffic; Interesting, but not always useful.
In order to examine traffic on an ethernet port other than the one your computer is plugged into, you need to mirror your ports. Port mirroring is a feature on managed switches that allows traffic from one or more ports to be mirrored onto an alternate port for the purpose of monitoring. Depending on the situation, you may want to mirror all ports on a switch or just one relevant one (like the port your Internet connection is plugged into). You’ll need to consult the documentation for your particular switch, but on my 24-port Netgear switch, I was able to mirror the necessary ports using a simple browser interface.
After installing and launching Wireshark, you’ll want to capture some network traffic. Choose Capture and then Options. Select the correct interface, and click Start. Once you have an idea of what kind of traffic you’re looking for, you can use the filters feature to capture specific packet types or omit specific traffic types. On the Options menu, you can also specify the amount of time or amount of data you want Wireshark to capture before stopping. This is useful since if Wireshark is run for an extended period of time, the file sizes can become unmanageably large. Click Start, and you’ll see traffic flowing in real time. If you haven’t configured an automatic stop, stop Wireshark when you’ve captured as much data as you want.
The challenge now is to figure out what to do with all this data. If you’re looking for something that’s bringing your network to a halt, the key task is to pinpoint the source of traffic. One way to do this is to select Statistics and then Conversations. Click the IPv4 tab, and from here you can sort by a number of things including ‘Bytes’ (which you can use this figure to pinpoint a computer that’s generating an inordinate amount of traffic). If you’re looking for a particular type of traffic, you can choose Analyze and then Enabled protocols, and check only the specific protocols you’re trying to locate.
There’s really a ton you can do with Wireshark. It’s an incredibly flexible and useful tool that can help you locate problems in your network, and also educate you about the kinds of traffic you’ve got traversing your wires. It can be a handful at first, but this tool is worth learning and having at your beck and call.
Michael Scalisi is an IT manager based in Alameda, California.