How to use Wireshark to capture a packet trace as part of troubleshooting a network/connectivity issue.
search cancel

How to use Wireshark to capture a packet trace as part of troubleshooting a network/connectivity issue.

book

Article ID: 166538

calendar_today

Updated On:

Products

Mobility Threat Protection SWG VA-100

Issue/Introduction

Performing a packet capture to be used for troubleshooting, How to use Wireshark to capture a packet trace as part of troubleshooting a network/connectivity issue.
How to obtain a packet trace suitable for analysis by Bluecoat Support.

Resolution

Decide on a capture setup

Wireshark is a tool that allows packet traces to be sniffed, captured and analysed. Before Wireshark (or in general, any packet capture tool) is used, careful consideration should be given to where in the network packets are to be captured. Refer to the capture setup pages in the wireshark.org wiki for technical details on various deployment scenarios.

Obtain appropriate Wireshark package

Obtain a Wireshark package or installer for the operating system running on the system which is to be used for packet capture.

 
Start Wireshark
Start Wireshark. On a Linux or Unix environment, select the Wireshark or Ethereal entry in the desktop environment's menu, or run "wireshark" (or "ethereal") from a root shell in a terminal emulator. In a Microsoft Windows environment, launchwireshark.exe from C:\Program Files\Wireshark.
Configure Wireshark
After starting Wireshark, do the following:
  1. Select Capture | Interfaces
  2. Select the interface on which packets need to be captured.
  3. If capture options need to be configured, click the Options button for the chosen interface. Note the following recommendations for traces that are to be analysed by Bluecoat Technical Services:
    • Capture packet in promiscuous mode: This option allows the adapter to capture all traffic not just traffic destined for this workstation. It should be enabled.
    • Limit each packet to: Leave this option unset. Bluecoat Support will always want to see full frames.
    • Filters: Generally, Bluecoat Support prefers an unfiltered trace.
    • Capture file(s): This allows a file to be specified to be used for the packet capture. By default Wireshark will use temporary files and memory to capture traffic. Specify a file for reliability.
    • Use multiple files, Ring buffer with: These options should be used when Wireshark needs to be left running capturing data for a long period of time. The number of files is configurable. When a file fills up, it will wrap to the next file. The file name should be specified if the ring buffer is to be used.
    • Stop capture after xxx packet(s) captured: Bluecoat Technical Support would most likely never use this option. Leave disabled.
    • Stop capture after xxx kilobyte(s) captured: Bluecoat Technical Support would most likely never use this option. Leave disabled.
    • Stop capture after xxx second(s): Bluecoat Technical Support would most likely never use this option. Leave disabled.
    • Update list of packets in real time: Disable this option if the problem that's being investigated is occurring on the same workstation as where Wireshark is running.
    • Automatic scrolling in live capture: Wireshark will scroll the window so that the most current packet is displayed.
    • Hide capture info dialog: Disable this option so that you can view the count of packets being captured for each protocol.
    • Enable MAC name resolution: Wireshark contains a table to resolve MAC addresses to vendors. Leave enabled.
    • Enable network name resolution: Wireshark will issue DNS queries to resolve IP host names. Also will attempt to resolve network names for other protocols. Leave disabled.
    • Enable transport name resolution: Wireshark will attempt to resolve transport names. Leave disabled.
  4. Now click the Start button to start the capture.
  5. Recreate the problem. The capture dialog should show the number of packets increasing. If not, then stop the capture. Examine the interface list and pick the one that is not associated with the WANIP. It will probably be a long alpha-numeric string. If packets are still not being captured, try removing any filters that have been defined.
  6. Once the problem which is to be analysed has been reduced, click on Stop. It might take a few seconds for Wireshark to display the packets captured.

    The Wireshark website has a good FAQ on this subject. Please refer to     http://www.wireshark.org/faq.html#q7.1
  7. Save the packet trace in any supported format. Just click on the File menu option and select Save As. By default Wireshark will save the packet trace in lib pcap format. This is a filename with a.pcap extension. Use this default for files sent to Bluecoat.
  8. Create a trace_info.txt file with the IP and MAC address of the machines that are being traced as well as any pertinent information, such as:
 
1.       What is the problem? (when did it start? steps to reproduce? any other pertinent information)
2.       What steps were traced?
3.       Give names of the servers and files being accessed.
4.       If analysis of the trace has already been attempted, please provide Bluecoat Support with analysis notes.

“For example: Packets 1-30 are boot. Packets 31-500 are login. Packets 501 to 1,000 is my application loading. Packet 1,001 to 1,500 is me saving my file. The error occurred at approximately packet 1,480.”
5.       What is the workstation OS and configuration?
6.       What version of client software is running?
7.       If it works with one version of the client (or a particular server patch), then get a trace of it working, and a trace of it not working.
8.       For Bluecoat Client issues: Are there any client patches loaded?
9.       What patches have been applied?
10.    What is the configuration of the network? Are there routers involved? If so, what kind of routers?
Powered by Wolken Software