WildPackets' network analysis tips of the month are written by Network Engineers and Technical Instructors with WildPackets' Professional Services Team. http://www.wildpackets.com/support/additional_resources/tip_month Documentation! Reports! Paperwork, Paperwork, Paperwork! Enough already. Your boss keeps asking for them, but you don’t even have time to do your primary job, and they want reports of the network. And what do they want in the reports? Pictures, not words! Graphs! http://www.wildpackets.com/support/additional_resources/2008_05 Thu, 01 May 2008 08:00:01 PST One thing the WildPackets instructor corps enjoys most about teaching is that we always learn at least as much as we teach. In one of our recent analysis classes, Brian Cantor from Nationwide Insurance provided us with a great tip that we want to share with you! During the class, we were building filters to find various types of TCP packets based on the TCP Flags field. http://www.wildpackets.com/support/additional_resources/2008_04 Tue, 01 Apr 2008 08:00:01 PST Sometimes, you may find that you want to save files that match the timeframe of the statistics output you are doing. Omni 5 added a new capture feature that will allow you to save files based on a specific time interval. It will allow you to save a new file every ‘x’ amount of time. The benefit of this is that now you can save statistics output at the same interval as your file save interval, which will make them directly correlate for future reference. http://www.wildpackets.com/support/additional_resources/2008_03 Sat, 01 Mar 2008 08:00:01 PST Application performance – are they simple words, or are they really your two-word job description? Whether you write software, maintain servers, or manage the network infrastructure, application performance is really the bottom line of your professional existence! If the applications don’t work so that users can be productive, then you’re in the doghouse! http://www.wildpackets.com/support/additional_resources/2008_02 Fri, 01 Feb 2008 08:00:01 PST So, you have determined that you need to scan for and locate any Rogue WLAN devices in your environment. First, you need to determine if you have any rogues. Then comes the fun part, you need to physically locate them. Let OmniPeek help you take a lot of the effort out of both these steps. All you need is OmniPeek and a supported WLAN card with the proper drivers. http://www.wildpackets.com/support/additional_resources/2008_01 Tue, 01 Jan 2008 08:00:01 PST More and more companies are finally deciding to retire their aged phone systems in favor of Voice over IP, so don’t be surprised if the boss puts a VoIP project under your IT tree this year. While VoIP does offer many economic and operational advantages over traditional telephone technology, it also comes bearing gifts of latency, packet loss, and jitter. Some folks like to get puzzles as gifts, but I’m not sure these are the types of brainteasers you really want to battle for fun! When jitter bells start ringing in your network, rely on the new features in OmniPeek version 5.1 to help you isolate and solve the problem. http://www.wildpackets.com/support/additional_resources/2007_12 Mon, 03 Dec 2007 08:00:01 PST Performance is an area of interest to everyone. What performance should you expect? The answer to that is very difficult as it depends on many bits of information including utilization, packet sizes, and what options are turned on. http://www.wildpackets.com/support/additional_resources/2007_11 Thu, 01 Nov 2007 08:00:01 PST So it has happened again – a user has called to complain about a server taking forever to fulfill a request. You need a quick way to evaluate that server’s traffic to determine how busy it is, and to see what types of traffic are consuming its time. The Peer Map has always been a very useful way to get a “satellite” view of traffic patterns on the network. This feature has been a part of all of the Peek products for quite some time, and has proven its worth time and time again as an indispensable part of our analysis arsenal. http://www.wildpackets.com/support/additional_resources/2007_10 Mon, 01 Oct 2007 08:00:01 PST If you have upgraded to Omni 5.0, which was recently released, you have probably noticed the new Filter Bar. This bar may completely change the way you make and apply filters. The really nice part about the Bar is that you can now manipulate filters using operators, and create expressions, to give you unlimited options when dealing with filters. It is also very handy for quickly applying expressions or filters simply by typing in what you want. http://www.wildpackets.com/support/additional_resources/2007_09 Sat, 01 Sep 2007 08:00:01 PST It’s an age old problem with network analysis and troubleshooting – the problem never occurs when you’re there to see it! Fortunately, Peek analyzers facilitate the automation of captures so that they can start and/or stop even when you’re not there. In this tip, we’ll focus on a little-known and rarely-used automation feature of the Peek products. http://www.wildpackets.com/support/additional_resources/2007_08 Wed, 01 Aug 2007 08:00:01 PST So, you ask, what does a plug-in do within the Peek products? And that’s my cue to tell you in order to fully answer that question, you must go to http://wpdn.wildpackets.com. There you will find not only the plug-ins that currently exist (over 30), but also the directions and tools that are helpful if you wish to write your own plug-in or custom decode to analyze that proprietary protocol you have running on that legacy application. http://www.wildpackets.com/support/additional_resources/2007_07 Sun, 01 Jul 2007 08:00:01 PST This month’s tip is based on a question that has been repeatedly asked by our customers over the last few months. Several members of our technical team have provided individual responses to the question, but we wanted to spread the word with this tip. The question is: When the Peek analyzer examines a conversation, how does it determine who is the client and who is the server? http://www.wildpackets.com/support/additional_resources/2007_06 Fri, 01 Jun 2007 08:00:01 PST So, what if I told you I could show you how to get your baselines with less than 30 seconds of effort? And yes, you could do multiple baselines at one time to save even more time. Well, I’m sure you would be hesitant to believe me, but read on and I’ll tell you how to do it and show you just how easy it is. http://www.wildpackets.com/support/additional_resources/2007_05 Tue, 01 May 2007 08:00:01 PST The Peek analyzer’s Peer Map is an often-overlooked feature that can be very powerful when used to its full potential. Unfortunately, many Peek users simply go to the Peer map, glance at the traffic diagram, and then move on to other views provided by the analyzer. A quick look at the following Peer Map sample reveals an immediate problem. http://www.wildpackets.com/support/additional_resources/2007_04 Sun, 01 Apr 2007 08:00:01 PST Your network infrastructure is at the core of your entire network. And with all the talk about threats and security breaches, you would think we would do more to validate that our infrastructures are working the way we expect them to. http://www.wildpackets.com/support/additional_resources/2007_03 Thu, 01 Feb 2007 08:00:01 PST This month's tip is all about casting off the lines of the traditional Peek Analyzer GUI, and setting sail into new waters of analysis bliss. OK, so maybe this tip really won't change your life in a profound way, but it's still really good stuff! It's all about a new Peek feature that enhances your ability to multitask. So raise the main sail and put to sea! http://www.wildpackets.com/support/additional_resources/2007_02 Thu, 01 Feb 2007 08:00:01 PST This month's tip is about real estate, but probably not the type you are thinking of. No, we are not trying to sell you land. If you have been reading our tips over the past many months and years, you are probably having a problem doing all the things that we have shown you. Why? Because you don't have enough real estate... 'display' real estate that is. http://www.wildpackets.com/support/additional_resources/2007_01 Mon, 01 Jan 2007 08:00:01 PST If you have used WildPackets Peek analyzers for any period of time, you have probably become very familiar with, and fond of, the Select Related feature, which enables you to isolate packets based on node addresses, protocols, ports, conversations, and other criteria. http://www.wildpackets.com/support/additional_resources/2006_12 Fri, 01 Dec 2006 08:00:01 PST You have seen many tips in the past about using the 'right-click' capabilities in the Peeks to help you maneuver and make selections, and here is another one. This tip is more specific to wireless captures, and is very powerful and extremely helpful. http://www.wildpackets.com/support/additional_resources/2006_11 Wed, 01 Nov 2006 08:00:01 PST The latest edition of the Omni Analysis Platform contains several new features that provide you with this satellite view of network traffic. One of these new and powerful views is the Expert's Application view. http://www.wildpackets.com/support/additional_resources/2006_10 Sun, 01 Oct 2006 08:00:01 PST Those of you who have heard me speak in various locations around the country know just how passionate I am about not using the Peeks merely as a troubleshooting tool. http://www.wildpackets.com/support/additional_resources/2006_09 Fri, 01 Sep 2006 08:00:01 PST Getting statistical data about our networks is usually not the problem. An almost endless variety of network management tools can provide more numbers than we can logically devour. So how do we make sense of it all? http://www.wildpackets.com/support/additional_resources/2006_08 Tue, 01 Aug 2006 08:00:01 PST You've heard of the Peer Map, but what about the Peers column? One of the new features in Omni 4 is something called the Peers column. Its purpose is to show the number of peers that any particular node has. http://www.wildpackets.com/support/additional_resources/2006_07 Sat, 01 Jul 2006 08:00:01 PST TCP retransmissions are pesky! Although all "normal" networks will experience a few of these, more than one retransmission per megabyte of data is usually, in technical terms, a really bad thing. TCP retransmissions can have a variety of causes, but the most frequent culprits are physical layer issues, such as cable, connector, and port faults, or electromagnetic interference of some sort. Anything that could corrupt a packet and cause it to be discarded can cause a TCP retransmission. The packet is never received at its intended destination, the recipient never sends a TCP ACK, so whoever transmitted the packet is obligated to try again. http://www.wildpackets.com/support/additional_resources/2006_06 Thu, 01 Jun 2006 08:00:01 PST This story is long, but the tip is short! That is the bottom line of this forensic mining expedition. Have you ever found yourself on the research side of a forensic investigation where your job was to look through the logs, trace files, and other historical data? If so, you know just how hard it can be. But now, there is a solution (at least for the trace files). http://www.wildpackets.com/support/additional_resources/2006_05 Mon, 01 May 2006 08:00:01 PST This month, we're going to extend this discussion. An age-old question among network architects is "What if...?" http://www.wildpackets.com/support/additional_resources/2006_04 Sat, 01 Apr 2006 08:00:01 PST Ever worked on an extensive advanced filter, and then realize that you need to insert an advanced object to the front of your filter string? Dead end. http://www.wildpackets.com/support/additional_resources/2006_03 Wed, 01 Mar 2006 08:00:01 PST So you've made up your mind. You've decided to extend existing LAN services to one or more remote locations over WAN links. The question is: Will those WAN circuits handle the traffic that has traditionally been isolated to high-speed LAN segments? http://www.wildpackets.com/support/additional_resources/2006_02 Wed, 01 Feb 2006 08:00:01 PST I know, and you do too. A protocol analyzer is a troubleshooting tool. Right? Well of course it is, but there is so much more that the tool can help with on a daily basis. http://www.wildpackets.com/support/additional_resources/2006_01 Sun, 01 Jan 2006 08:00:01 PST A video tip on setting up port range filters http://www.wildpackets.com/support/additional_resources/2005_12 Forget about making those complex filters for a second. Leave "Select Related" behind. Forget the "CTRL+F" combination to look for something quick. It's all about the three double clicks. http://www.wildpackets.com/support/additional_resources/2005_11 Ever wanted to look at a certain value in all packets? Ever wanted to compare packets based on a certain value/flag/bit? Find it painful to go through decodes and look for a certain value? http://www.wildpackets.com/support/additional_resources/2005_10 A quick analysis of the sign-on process revealed that Google Talk's infrastructure runs on Jabber (IETF's formalization calls it Extensible Messaging and Presence Protocol - XMPP ( http://www.xmpp.org/specs/). http://www.wildpackets.com/support/additional_resources/2005_09 Utilization percentage is a configurable alarm. You can configure "current utilization percentage" and/or "average utilization". http://www.wildpackets.com/support/additional_resources/2005_08 Usually the Expert is very good at figuring out which node is the client and which node is the server, but there are some situations when it can become confused, and can lead to messages from the Expert reporting false alarms such as "Slow Server Response Time". http://www.wildpackets.com/support/additional_resources/2005_07 It's always a good idea to know the topology of the network where you capture packets and perform your protocol analysis. This would not only help you identify rogue devices on your network but also help you with coming up with a more accurate baseline that you can use to compare with a trace when your network is overheating. http://www.wildpackets.com/support/additional_resources/2005_06 I've always found the process of exploring through the Start menu -> Programs -> Administrative Tools -> Services to be an over assumption of a user's familiarity with Windows navigation menus and clicking abilities to arrive at another menu just to start or stop a Windows Service. http://www.wildpackets.com/support/additional_resources/2005_05 When you start capturing packets on a high utilization network with the default configuration in capture options you will notice that the buffer sizes are limited to 16 MB only filling up the capture real quick. You can increase the default buffer size (displayed in kilobytes) from the capture options dialogue while keeping in mind two important things: http://www.wildpackets.com/support/additional_resources/2005_04 WildPackets' analysis software products are loaded with time-saving keystroke short cuts that in some cases, even provide unique functionality not available via menus, such as starting multiple captures at precisely the same time. We have compiled a list here for you to explore next time you run WildPackets' network analyzers and fault analysis tools. http://www.wildpackets.com/support/additional_resources/2005_03 If you are like me, you did not leave your notebook behind this holiday season! You were sitting at the terminal gate capturing packets before boarding your flight, in the hotel lobby or even on the subway while trying to get to Times Square. Maybe not on the subway but everywhere else, you can learn so much about the different protocols that you might not ever see during your daily network analysis drills. http://www.wildpackets.com/support/additional_resources/2005_02 When we examine fields in the packet headers, most of these are one or more bytes in length. However, some fields, such as various flags, are only 1 bit in length. So there are occasions when we need to filter based on the value of a single bit or a combination of two or more bits. We can do this with a Value filter. http://www.wildpackets.com/support/additional_resources/2005_01 Archived Tips of the Month from 2004 http://www.wildpackets.com/support/additional_resources/tips_2004 Archived Tips of the Month from 2003 http://www.wildpackets.com/support/additional_resources/tips_2003 Archived Tips of the Month from 2002 http://www.wildpackets.com/support/additional_resources/tips_2002 Archived Tips of the Month from 2001 http://www.wildpackets.com/support/additional_resources/tips_2001 Archived Tips of the Month from 2000 http://www.wildpackets.com/support/additional_resources/tips_2000 Archived Tips of the Month from 1998-1999 http://www.wildpackets.com/support/additional_resources/1999