Chapter 4. Troubleshooting with Ethereal

An approach to troubleshooting with Ethereal

Ethereal is a very useful tool for network troubleshooting, since it contains a number of features that allow you to quickly focus on problems in your networkfor several reasons:

•It allows you to focus in on specific packets and protocols, as you can see a large amount of detail associated with various protocols.

•It supports a large number of protocols, and the list of protocols supported is growing as more people contribute dissectors

•By giving you a visual view of traffic in parts of your network, and providing tools to filter and colorize that information, you can get a better feel for your network traffic, and can understand your network better.

The following general approach is suggested:

•Determine that the problem looks like a networking problem. There is no point in capturing packets if the problem is not networking related.

•Figure out where to capture packets. You will have to capture packets from a part of the network where you can actually get network traffic related to the problem. This is especially important in the presence of switches and routers. See the section called Capturing in the presence of switches and routers for more details.

Because Ethereal can read many capture file formats, you can capture using any conventient tool. One useful approach is to use tcpdump to capture on remote systems and then copy the capture file to your system for later analysis. For more details on capturing with tcpdump, see the section called Capturing with tcpdump for viewing with Ethereal in Chapter 5.

•Once you have captured packets that you think relate to the problem, load them into Ethereal and look for your problem. Using Ethereal’s filtering and colorization capabilities, you can quickly narrow down the capture to the area of interest.

•Examine the appropriate fields within the packets where the problem appears to be. These can often help to reveal the problem.

Capturing in the presence of switches and routers

Many vendor’s switches support a feature known as "port spanning" or "port mirroring" in which all of the traffic to and from port A are also sent out port B. An excellent reference on the "port spanning" feature of Cisco switches can be found at Configuring the Catalyst Switched Port Analyzer (SPAN) Feature 1

91

Chapter 4. Troubleshooting with Ethereal

Examples of troubleshooting

Troubleshooting often requires a reasonable knowledge of the protocols in question, however, you can often get a good idea of what might be going wrong simply by looking in the packets being exchanged.

Notes

1. http://www.cisco.com/warp/public/473/41.html

92