You may want to log into the router,
you may want to see,
you know, what the process is.
Or you may want to see
if the buffers are getting jammed up.
You may want to look at a lot of
different things because
it's all one big picture.
If you were just looking let's say at a
a very simple segment, then
the amount of detective and analysis work
that you have to do maybe limited.
But when you're troubleshooting
on an enterprise level network,
if you're trying to figure out
something in a CCIE lab,
you're trying to figure out something,
why a production system is completely failing
in a DMZ, there's a lot of things that
you're going to need to look at
and it's not just limited to Wireshark.
Wireshark is just a tool
that will allow you
to perform a deep set of troubleshooting
analytics to allow you to
peer into the data
and get more, more information.
A great example would be
in a MPOS network
you may want to find out
what data is traversing.
You may need to take a look at the labels
that will be very apparent to you
when you capture the data.
Look at it in Wireshark, you sort it
and you can figure it out by filtering
through it and seeing exactly
where things are going and why.
And if it's not going there
perhaps you may need to look at
in the network, a routing problem.
You may need to see if something is
getting dropped somewhere
So those are good examples of why
you would really need to focus
with Wireshark on source to destination,
multiple sources to multiple destinations,
but remember the foundation of
where you're starting from,
and where you're going to,
where you're going to put Wireshark,
how you're going to capture the data...
You want to recreate the problem, right?
You don't want to just install Wireshark
and, and you know, just run it.
You want to run Wireshark
and try to recreate the problem.
Maybe have a baseline of how it operates.
It's normally to compare against.
So these are some of the key elements.
And again with data encapsulation,
what you're going to be looking in Wireshark is
you're going to see the data encapsulated.
So for example, if you're just looking
in a layer 2 problem,
you'll see it encapsulated in ethernet.
Right? So, generally as our profession
moves into the future
you're not going to be looking at
the things with token ring really much anymore
even though you can use tools
to sniff out and find problems with it
but you're mostly going to be, you know
concerned about ethernet,
TCP/IP and that kind of stuff.
But from encapsulation point
when you're capturing data in Wireshark
you're going to be able to see particularly
the header information,
and you're going to be able to see
when you capture it
what's under the hood.
You're going to see details to be able
to solve these problems.
And when you look at the actual data
and this is in the details of a packet,
you'll be able to see
the encapsulation type ethernet.
Ok, well that's really good.
because that's very simple
and it's the first type
of things that we would look at
but more importantly,
we would be able to see things like
what's the frame length, what,
is it having issues, something with FCS.
You'll be able to see these things
as you're digging through your capture
and looking through the network.
Alright, so as we wrap up this first module
some of the things that we want to cover is
when you capture data,
you want to inspect it for issues,
you're going to be doing
some deep protocol analysis
you're going to be looking opening up
after you capture the data
and you're going to inspect it.
We're going to do things such as like
pre-capture filters, display filters;
we'll be able to write expression,
and then we'll be able to really drill down
into the data that we want to see.
But just remember, at a very high level,
we're not going to be able
this stuff without Wireshark.
There's tool you can use for example
on an ASA, you can,
you can run a cap and you see data.
There's other things like fluke,
has some tools that you can capture data with.
But just remember with Wireshark
in particularly,
it's going to open up the captured data
and allow you to see very deeply within it,
filter on it in a GUI and at the command line.
It will also help you do
traffic analysis, network analysis
that you could find key problems
with your network.
Remember, you're not just going to use Wireshark,
your fundamental tools will still apply.
You'll still want to run a ping,
a path ping, a trace route. Look in router logs,
look at router, routing tables, switch logs
firewall logs, the actual system itself.
Run the performance monitor
or run it, look at the processes on the Unix box,
see how healthy those systems are.
All this is going to play
in your overall traffic analysis
and that concludes module 1.
One of the things that we want to do is
we want to make sure
that with everything that we're doing
we look at Wireshark as a tool.
We want to make sure
that everything that we look at is not
in a way where we're going to look at it
Wireshark and say Wireshark
is going to give me the specific
problem that we're seeing,
it's going to tell me what the problem is.
Just remember, it's just a tool,
it's an extention of your experience,
it's an extention of your knowledge,
and you'll always be learning.
So just remember that, learning Wireshark
is a lifetime event as the networks change,
as technologies change,
so that's what you see with Wireshark.