sniffer university 4-1 analyzing network issues. sniffer university 4-2 troubleshooting flowchart...
TRANSCRIPT
Sn
iffe
r U
niv
ersi
ty
4
-1
Analyzing Network Issues
Sn
iffe
r U
niv
ersi
ty
4
-2Troubleshooting Flowchart
Monitor Apps
• Dashboard
• Host Table
• Matrix
• ART
• History Samples
• Protocol Distribution
• Global Statistics
Alarms
Capture Frames
Expert Analysis
Expert Options
Filters
Triggers
Display Frames
• Summary
• Detail
• Hex
Navigation
Select Frames
Find Frames
Filters
Display Setup
Address Book
Packet
User Tools
• Ping
• Trace Route
• DNS lookup
• Finger
• Who Is
• Scripts
Monitor Decode ManageTroubleshoo
t
Generator
Sn
iffe
r U
niv
ersi
ty
4
-3Section Objectives
After completing this section, you will be able to:
•Use the Summary, Detail, and Hex views of the Decode window to examine frames for potential errors or activity of interest
•Find and select frames in the trace•Set display and capture filters•Work with Filtered (x) window•Use the Address Book•Use Sniffer Portable windows and
functions to do practical measurements
Sn
iffe
r U
niv
ersi
ty
4
-4Displaying Captured Data
You can view and analyze the decoded frames stored in:
– The capture buffer
OR– A capture (trace) file
Stop and display capture
Sn
iffe
r U
niv
ersi
ty
4
-5Post-Analysis Tabs
Sn
iffe
r U
niv
ersi
ty
4
-6Matrix
Sn
iffe
r U
niv
ersi
ty
4
-7Host Table
Sn
iffe
r U
niv
ersi
ty
4
-8Protocol Distribution
Sn
iffe
r U
niv
ersi
ty
4
-9Statistics
Trace StatisticsTrace Statistics
Network StatisticsNetwork Statistics
DLC StatisticsDLC Statistics
TCP/IP StatisticsTCP/IP Statistics
NetWare StatisticsNetWare Statistics
Sn
iffe
r U
niv
ersi
ty
4
-10
Decode Window
Sn
iffe
r U
niv
ersi
ty
4
-11
Decode Window
SummarySummaryViewView
DetailDetailViewView
HexHexViewView
Sn
iffe
r U
niv
ersi
ty
4
-12Summary View
Frame Length
Summary
Destination Address
Status
Source Address
Frame Number
Sn
iffe
r U
niv
ersi
ty
4
-13Status Flags
Flag DescriptionM Marked frame (a bookmark)# Packet has an associated symptom or
diagnosisT Packet is an event filter triggerA Packet was captured from Port A on the pod
or adapter cardB Packet was captured from Port B on the pod
or adapter card[x] x is the number of the wireless LAN channel
from which the packet was capturedCRC CRC error packet with normal packet size
Sn
iffe
r U
niv
ersi
ty
4
-14
Summary View Options
•The Summary View can be tailored to meet your needs:– Change the order of the columns– Add/remove columns– Display DLC or Network Layer addresses– Show Expert symptom/diagnosis– Summarize one or all layers of the frame– Time options– Byte counts
Sn
iffe
r U
niv
ersi
ty
4
-15
Summary View: Addresses
Network Layer addresses (default)
Data Link (MAC) addresses
Sn
iffe
r U
niv
ersi
ty
4
-16
Summary View: All Layers
Provides a summary of the key fields found in every protocol header in the frame
Sn
iffe
r U
niv
ersi
ty
4
-17
Summary View: Time Options
• Relative time– Interval between the marked frame and current frame
• Delta time– Time between frames
• Absolute time– Time of day frame was received
Sn
iffe
r U
niv
ersi
ty
4
-18
Uses for Time Options
• Relative Time– The time interval between the marked frame and the
current frame– You can find the time span over a number of frames in
order to make response time and throughput measurements
• Delta Time– The time interval (S.000.000) between adjacent displayed
frames– Useful for determining how quickly nodes are transmitting
between frames and for seeing a server’s turnaround time
• Absolute Time– The time of day (HH:MM:SS.0000) at which each
frame was captured– Used when the actual time of day is required
(be sure the correct DATE and TIME are set)
Sn
iffe
r U
niv
ersi
ty
4
-19
Practical Application:Response Time Measurement
To find workstation-to-server response time:1. Collect traffic between a workstation and a
server2. Find the first frame of a command sequence in
the Summary view and mark it3. Find the last frame in the command sequence4. Look at the relative time (this indicates how
much time has elapsed since the command that you marked)
5. Record the relative timeWhen you suspect problems, try this procedure again and see if the response time has changed significantly
Sn
iffe
r U
niv
ersi
ty
4
-20Exercise 4-1
Response Time Measurement
Sn
iffe
r U
niv
ersi
ty
4
-21
Summary View:Packet Size Options
• Frame Length– Total number of bytes captured in a specific frame
• Cumulative Bytes– Total number of bytes between marked frame and
displayed frame
Sn
iffe
r U
niv
ersi
ty
4
-22
Uses for Packet Size Options
• Frame Length (Bytes)– Shows the number of bytes for each frame– Useful for general information and when looking for
packet size efficiency of the protocol or network
• Cumulative Bytes– Mark a frame and display the total amount of data
transmitted between the marked frame and some specific frame
– Useful for determining how many byteswere used to accomplish a givenprocedure or operation by filteringon a communications sessionbetween two stations
Sn
iffe
r U
niv
ersi
ty
4
-23
Practical Application:Application Efficiency
To calculate the overhead an application generates:1. Collect traffic between the stations exchanging data
with the application you wish to evaluate2. Identify the beginning of a command that indicates
the transfer of data and mark it3. Note the amount of actual user data being
transferred4. Turn on Cumulative bytes5. Find the final acknowledgment in the Summary View6. Look at the cumulative bytes in the final
acknowledgment7. Record the cumulative bytes8. Cumulative Bytes (C) - User Data (D) = Overhead (O)
O / C = Percent of Overhead
Sn
iffe
r U
niv
ersi
ty
4
-24Exercise 4-2
Application Efficiency
Sn
iffe
r U
niv
ersi
ty
4
-25
Two-Station Format
This optional display format places the summary of the conversation side-by-side for easier viewing
– Commonly used after applying a filter on two stations
Sn
iffe
r U
niv
ersi
ty
4
-26
Detail View
The Detail View provides a complete decode of each field in the transmitted frame
– Headers may be compressed or expanded:
Sn
iffe
r U
niv
ersi
ty
4
-27
Vendor Codes andFunctional Address Files
•Manufacturer’s IDs are in the .BET files – SNIFFER.BET for Ethernet– SNIFFER.BTR for Token Ring– You can edit them to add more - follow the
format•Broadcast and Functional Addresses are
in SNIFFER.xxM files– SNIFFER.ETM for Ethernet– SNIFFER.TRM for Token Ring
•All are in the Program directory under Sniffer Portable’s directory
Sn
iffe
r U
niv
ersi
ty
4
-28
Investigating Addressing Problems
Q: Is the DLC destination address the correct address for a router that can reach network 128.82?
Q: Is the DLC destination address the correct address for a router that can reach network 128.82?
Source node is on network 128.104Destination node is on network 128.82
Source node is on network 128.104Destination node is on network 128.82
Sn
iffe
r U
niv
ersi
ty
4
-29
Hex View
• Protocol layers or fields highlighted in the Detail View will automatically highlight in the Hex View
• Conversely, clicking on bytes in the Hex View will highlight the associated field in the Detail View
Sn
iffe
r U
niv
ersi
ty
4
-30
Hex View Offset
Q: What is the word that starts at offset 4A?
0 1 2 3 4 5 6 7 8 9 A B C D E F
ASCII or EBCDIC decode
ASCII or EBCDIC decode
Offset 004AOffset 004A
Sn
iffe
r U
niv
ersi
ty
4
-31
Decode Window Navigation Tips
• Keyboard Shortcuts:– Tab to move between the Summary, Detail, and Hex views– Use the F4 key to zoom in or out of a particular view– Use the Home and End keys to go to the top or bottom of
the view– Use F7 to go to the previous frame, F8 to go to the next
frame in the trace– Use F2 to go to the next selected frame, Shift-F2 to go
back
• Click the square box next to a frame to select it for further analysis
• Right-click over the Summary view for short cut to menu options
Sn
iffe
r U
niv
ersi
ty
4
-32
Display Options
•Right-click on any Decode view to do the following:– Find Frames– Go to Frame– Mark Current Frame– Select Frames– Display Setup– Display Filters– Send Current Frame or Buffer
•These capabilities are also available from the main Display menu
Sn
iffe
r U
niv
ersi
ty
4
-33Find Frames
• Choose Find Frame… from the Display menu or press Alt + F3
• Use the tabs to find frames based on text, data, status, or Expert symptom or diagnosis string
Sn
iffe
r U
niv
ersi
ty
4
-34Go To Frame
• Choose Display from the Menu bar, then Go To Frame…
• Right-clicking in the Decode window will also give you this option
Sn
iffe
r U
niv
ersi
ty
4
-35
Mark Current Frame
The Mark provides a reference point in the trace and controls the Cumulative Bytes and Relative Time displays
Sn
iffe
r U
niv
ersi
ty
4
-36Select Frames
Sniffer Portable lets you select individual frames, or a group of frames, in the Summary view of the Decode window, and then optionally save them into a separate decode window
Sn
iffe
r U
niv
ersi
ty
4
-37Select Range
1. Select a range of frames by choosing Display from the Menu bar, then Select Range…
2.Then choose the Display menu and either– Save the selected
frames OR– Go to the
next orpreviousselectedframe
Sn
iffe
r U
niv
ersi
ty
4
-38Display Setup
•Display Setup allows you to customize the Summary Display, Protocol Color, Protocol Expansion, and the font for protocoldecodes
•From the Menu bar choose Display > Display Setup...
Sn
iffe
r U
niv
ersi
ty
4
-39
Display Setup: Summary Display
Optional Fields:Optional Fields:
Sn
iffe
r U
niv
ersi
ty
4
-40
Using Display Filtersto Narrow the View
Sn
iffe
r U
niv
ersi
ty
4
-41Display Filters
•Use display filters to eliminate frames from view or to isolate a specific conversation
•When you apply a display filter, Sniffer Portable will default to create a Filtered (x) window attached to the original trace– There are 3 options to create a separate
filtered window•You may apply display filters using
– Filter profiles (named filters)– Automatic filters– “Quick” filters
Sn
iffe
r U
niv
ersi
ty
4
-42
Display Filter Profiles
To define a display filter profile, select Display > Define Filter from the menu bar
Sn
iffe
r U
niv
ersi
ty
4
-43
Selecting Display Filters
Display > Select Filter from the Menu Bar allows you to select either a display or capture filter for display filtering
Sn
iffe
r U
niv
ersi
ty
4
-44
Automatic Filters:Expert Display Filter
In the Expert, you can filter on any Object, Symptom, or Diagnosis by highlighting the item and clicking on the Expert Display Filter icon
Sn
iffe
r U
niv
ersi
ty
4
-45
Automatic Filters:Matrix Visual Filter
In the Matrix, you can select station addresses and filter on them by clicking on the Matrix Visual Filter icon
Sn
iffe
r U
niv
ersi
ty
4
-46“Quick” Filter
You can quickly define a filter for use when viewing captured data:
1. Display > Define Filter…
2. Select the “Default” filter
3. Click the Reset button to put options back to original setting
4. Modify options with appropriate selection criteria
5. Click OK when done
6. Right-click and choose Select Filter...
Sn
iffe
r U
niv
ersi
ty
4
-47
Filtered (x) Tab
When you apply a display filter, Sniffer Portable, by default, attaches the window to the original trace as Filtered (x)
Sn
iffe
r U
niv
ersi
ty
4
-48
Filtered Window Frame Numbers
The frames in a filtered window retain their original frame numbers
– This makes it easy to go back to the original trace and see where the problem occurred
Sn
iffe
r U
niv
ersi
ty
4
-49
Viewing Sequential Frame Numbersin a Filtered Window
1. Reduce the box column to nothing by dragging it to the left
2. Double click the left most line next to the heading
3. The sequential number column will appear
Sn
iffe
r U
niv
ersi
ty
4
-50
Filtered Window Analysis 1
Expert analysis for this filtered window is not available
– Expert tab shows the original trace file analysis
Sn
iffe
r U
niv
ersi
ty
4
-51
There are three options to separate the filtered window and provide Expert analysis:
1. Right click over the Summary view in the filtered window and select
2. Select File > Save As… to name and save it
A separate window will appear with Expert analysis
3. Select Tools > Options > General and enable Extra Filtered Window
Every time a Display filter is applied, a separate filtered window will be created
Filtered Window Analysis 2
Sn
iffe
r U
niv
ersi
ty
4
-52
Filtered Window Analysis 3
All options will create a filtered window with Expert analysis
– The frame numbers will now be sequenced
Sn
iffe
r U
niv
ersi
ty
4
-53
Separate Filter Window Results
Original trace with Filtered (x) window
Separate filtered window with Expert analysis
Sn
iffe
r U
niv
ersi
ty
4
-54
Closing Filtered (x) Window
Right-click on the Filtered (x) tab to display the Close option and remove the filtered window
Sn
iffe
r U
niv
ersi
ty
4
-55
Dave
Exercise 4-3
Sn
iffe
r U
niv
ersi
ty
4
-56
Data Pattern Filter
• Define a data pattern filter to select frames that match data found in a frame at a specific location
• Create from a single data pattern or from multiple patterns that are connected by AND/OR/NOT Boolean operators
• The Data Pattern is defined by:– A particular sequence of bits– The length of the sequence (max. length = 32 bytes)– The offset position of the data in a frame
• The offset position may be specified relative to the beginning of the frame or the beginning of the first protocol header
Sn
iffe
r U
niv
ersi
ty
4
-57
Data Pattern Tab
Use the Data Pattern tab to set and view the data pattern match configuration
Sn
iffe
r U
niv
ersi
ty
4
-58
Data Pattern Options
Define PatternDefine Pattern
Specify Boolean Logic
Specify Boolean Logic
Test the SyntaxTest the Syntax
Define Negative match
Define Negative match
Sn
iffe
r U
niv
ersi
ty
4
-59
Pattern Match Logic
•AND/OR Boolean logic– If two data patterns are ANDed, both
patterns must be found in the frame to pass– If two patterns are ORed, either pattern can
be found in the frame to pass
•NOT Boolean logic– If the pattern criteria is met, the matched
frame(s) will be excluded from the display
Sn
iffe
r U
niv
ersi
ty
4
-60
Pattern Match Logic (cont.)
Note: Add NOT before adding pattern
Sn
iffe
r U
niv
ersi
ty
4
-61
Edit Data Pattern
Highlight a packet in the Summary window and use the Set Data button to automatically paste data above
Frame DataFrame Data
Pattern ValuePattern Value
Packet NumberPacket Number
Sn
iffe
r U
niv
ersi
ty
4
-62
Determines from which point the offset is calculated
– From: Packet calculates the offset from the beginning of the frame
– From: Protocol calculates the offset backwards to the beginning of the Layer 3 header
(*Usually used when there is routing information in the frames)
MAC Header RI NW hdr Transport hdr Data CRC
MAC Header NW hdr Transport hdr Data CRC
Data Offset
Sn
iffe
r U
niv
ersi
ty
4
-63
Pattern Copy and Paste Procedure
To copy and paste a data pattern:1. Identify the frame that contains the desired pattern
2. Select Define Filter…
3. Go to the Data Pattern tab
4. Select the Add Pattern option
5. Select the data Format (Hex, Binary, ASCII, EBCIDIC)
6. Scroll through the data display and find the desired pattern
7. Press Set Data to paste the pattern into the data area
8. Click OK
Set up logical operations with additional data patterns as necessary
Sn
iffe
r U
niv
ersi
ty
4
-64
• Binary pattern matches allow you to specify bit patterns for matching
• Select the formatbefore pressingSet Data
• For best results, combine binary pattern matches with a protocol filter
Binary Pattern Match
Sn
iffe
r U
niv
ersi
ty
4
-65
Isolating a Subnet
Exercise 4-4
Sn
iffe
r U
niv
ersi
ty
4
-66
Address Book
Sn
iffe
r U
niv
ersi
ty
4
-67
Managing Names
• In an effort to make the analyzer screens more “readable,” names associated with captured addresses are displayed in place of Network Layer or DLC addresses
• The names are discovered automatically by Sniffer Portable during monitor, capture, and display of data
• The name information is stored in a temporary table for display purposes and may be transferred to the Address Book for permanent storage
• Names may be imported into the Address Book, providing a more complete online reference for a network
Sn
iffe
r U
niv
ersi
ty
4
-68Address Book
Lets you assign familiar, recognizable names for nodes on your network
Sn
iffe
r U
niv
ersi
ty
4
-69
Address Book Toolbar
New Address
Sort by Medium
Export
Delete All Addresses
Autodiscovery
Delete Address
Undo
Edit Address
Redo
Sn
iffe
r U
niv
ersi
ty
4
-70
Entering Names Manually
Add your own addresses or update existing entries
Device Types:
Workstation
Server
File Server
Printer Server
Router
Bridge
Hub
Device Types:
Workstation
Server
File Server
Printer Server
Router
Bridge
Hub
Sn
iffe
r U
niv
ersi
ty
4
-71
Importing Address Tables
Sn
iffe
r U
niv
ersi
ty
4
-72Autodiscovery
• Actively search for IP addressed devices
OR • Passively watch for
names and addresses
• Names can be automatically added to the Address Book when found
ActiveActive
PassivePassive
Sn
iffe
r U
niv
ersi
ty
4
-73
Discovered Addresses
Sn
iffe
r U
niv
ersi
ty
4
-74
Exercise 4-6
Managing Names
Sn
iffe
r U
niv
ersi
ty
4
-75
In this section, you learned how to use Sniffer Portable to:
Summary
•Use the Summary, Detail, and Hex views of the Decode window to examine frames for potential errors or activity of interest
•Find and select frames in the trace•Set display and capture filters•Work with Filtered (x) window•Use the Address Book•Use Sniffer Portable windows and
functions to do practical measurements
Sn
iffe
r U
niv
ersi
ty
4
-76
Group Discussion
•What kind of information do the Summary, Detail, and Hex views in the Decode window provide?
•Describe how Absolute Time can be useful when troubleshooting network problems
•What is the difference betweena Capture and Display filter?
•Why would you selectframes?
•Can you view multiplecaptures simultaneously?
Sn
iffe
r U
niv
ersi
ty
4
-77