print

Tip of the Month

January 2003

Correlating packets from multiple sides of a router

EtherPeek is the first protocol analyzer to allow for the simultaneous monitoring of two sides of a router through its support for Multiple NICs. In this way, a network administrator can take a unique view of conversations as they enter and exit the router.

The first step towards effective analysis of this traffic is to focus on specific conversations through the use of EtherPeek's powerful and easy-to-use filters and automatic "Select Related" packet extraction features.

Having focused your attention on the most relevant packets, the next step is to begin the comparison between the packets captured from the NICs on either side of the router. Although the two separate buffers may be started at different times, the timestamp for all of the packets will be correlated since they share the same system clock in the computer running EtherPeek. It is therefore possible to line up all of the packets based on the timestamp and the sequence numbers of each transmission. With the packets lined up, analysis can now be done on the packet behavior. Are all of the packets entering the router being effectively forwarded to the other side or is the router dropping packets? Are there specific gaps in communication which could be hampering network performance? It is very easy to then save these packets out for future reference.