print

Tip of the Month

Network Analysis Tip of the Month – October 2005

Faster Analysis, without looking at the decodes!

Author – Saurabh Bhasin

• Ever wanted to look at a certain value in all packets?
• Ever wanted to compare packets based on a certain value/flag/bit?
• Find it painful to go through decodes and look for a certain value?

Let's take the TTL field for example. A very easy and quick way to tell how many hops did the packet cross before you took the capture. Looking at the TTL in packets can give us a good idea as to where the capture was taken, next to the client or the server. Typical TTL values are 255 or 64 so if you saw a packet with a TTL set to 59, it's likely that the packet crossed 5 hops before it got to the capture location. Similarly, if you captured a packet with TTL set to 252, it's likely that the packet crossed 3 hops.

It's important to verify the TTL values to determine issues such as:

• Routing Loops
• Routing misconfiguration

You can turn the decode column on, and highlight the TTL field in one of the packet decodes to quickly see the TTL value for each packet, without ever looking at the decode itself. A quick "scan" through the packet list will tell you a lot about the path taken, roles played and misconfiguration, if any in inbound and outbound routes.

Screenshot  - Click on thumbnail for larger view