BI-8 Wireshark Software Case Studies
4:45p – 6:00p Mon June 25 2012

Megumi Takeshita
Founder | ikeriri network service co.,ltd.

SHARKFEST ‘12UC Berkeley
June 24-27, 2012
SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

About Megumi Takeshita 竹下恵• Founder, ikeriri network serviceco.,ltd ← Enterprize solution,
nortel networks ←IS Bay Network• 10+ books about packet capturing,analysis, inspection, and consulting• Reseller of Riverbed Technology( former CACE technologies ) andMetageek, and some in Japan• Packet capturing Otaku ( geek )start at junior school SharpX1(IPL)• from Ethereal, 1st Sharkfest !
SHARKFEST ‘12 | UC Berkeley | June 24–27, 20122

before capturing• Clear DNS C:¥>ipconfig /cleardns• Stop firewalls, anti-spywares and others• Stop service like UPnP(SSID), VPN and many
• C:¥>netstat –a | find
“LISTEN” ; netstat –ab• Check NIC error, discards
C:¥>netstat –e• for /l %i in (1,1,10) do xxx
is also useful
SHARKFEST ‘12 | UC Berkeley | June 24–27, 20123

Setting Wireshark• Adding Wireshark program path into systemvariable ( set Path=%Path%;C:¥Pro… )• Check interface index number ( thark –D )• Add columns according to
the field catching up• To see latency, add fields
tcp.time_delta• Set Time display format
previous displayed packet•
SHARKFEST ‘12 | UC Berkeley | June 24–27, 20124

Fragment
ping a.b.c.d –l 1500 -f• Original frame
EthernetII(14)

IP(20)

ICMP(8)

Message1500• Fragment 1/2 in Ethernet MTU
EthernetII(14)

IP(20)
DF=0 MF＝1
オフセット＝ICMP(8)

Message1472• Fragment 2/2 in Ethernet MTU
EthernetII(14)

IP(20)
DF=0 MF＝0
オフセット＝ICMP(8)SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

Message285Testing packet size
ICMP  ping host –l message size (MTU-28) -f
EthernetII(14)

IP(20)

ICMP(8)

message
MTU=1500->1472

IP(20)

TCP(20)

Segment size
MSS＝1460

IP
(20)

UDP
(8)

Datagram size
MTU=1500->1472

TCP
EthernetII
(14)

UDP
EthernetII
(14)

••
•
•

NTT East MTU 1454Bytes （MSS 1414)
NTT West FTTH MTU 1438Bytes（ MSS 1398）
GRE + IPsec (transport mode)1440
GRE + IPsec (tunneling mode)1420
SHARKFEST ‘12 | UC Berkeley | June 24–27, 20126

Check negotiation of TCP
See first 2 packet of 3way handshake（初期ウインドウサイズはOS等で指定）• Window Size, SACK, MSS, Window Scaling• Some router may rewrite this section via NAPT
• Follow TCP stream and Use coloring and Ctrl+SpaceSHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

7

Using iperf and tfgen (made in Japan)• Throughput ->iperf
assuming packet size
• Traffic ->tfgen
influences about UDPSHARKFEST ‘12 | UC Berkeley | June 24–27, 20128

Overview of troubleshootWiresharkでのトラブルシューティングの基本• Amount, place, time is important !!
ask for the person and know the issue.
• If we know the error obviously,
see defference from OK and NG packet
to see packet in micro range ( field )• No idea of trouble
capture packet at more than 2 location
to see packet in macro range ( statistics )• Expert Info say many things automatically• Think of packet lost -> Ignore（Ctrl+I）
SHARKFEST ‘12 | UC Berkeley | June 24–27, 20129

Expertize IO graph• To see errors and counting the number ofpacket, set Y axis to packet/sec ( histogram )• To see performance and throughput,set Y axis to bit/sec ( line )SHARKFEST ‘12 | UC Berkeley | June 24–27, 201210

No sampling, non-sampling• In old days we use sampling technologies
like SNMP, MRTG, and many flow analysis
such as Cisco NetFlow, sFlow, iFlow
IgnoredIgnoredIgnoredMay be• But small packet ( 64 bytes – 100 bytes ) may beignored. Some small packet is important symptom ofanalysis ( ARP / TCP SYN / HTTP GET and others )SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

Actual capture rate
• Typical Intel’s GigaNIC (e1000),
typical Dell PowerEdge2850 / Xeon 2.8GHz
RAM 1GB (PC3200, DDR2, 400MHz)• Threadshould is 140Mbps in Frame size = 64

SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

Another frame size
• Frame size = 200 , actual rate 400Mbps• Frame size = 1500 , may be ok, no problem.

SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

Ooops in non-sampling• In case of frame size is 1500, there may be somedrops ( it is not non-sampling )• Actually, customer want to see most highest
point of traffic, so if the pcap file do notcontains all packet ( some ignored ) no use.
• Use TurboCaps and other capture designed NIC
based on FPGA ( ikeriri is a reseller !!)• No less than 200MB is good for browse.
• Once get pcap,
then make reportand drop it.
SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

Tradeoff between pcap size
Off course there are many packet aggrigator and datacollection devices such as 19 inch rack mount one orOpenflow packet tracer and we can use additional RAID
harddisks ready for exabytes and more than a year

Time and Cost is important
Small factor PC with SSD andTurboCap or some can do itSome customer has 10 gigabytes in
1. get pcap
2. Add record to RDB a hour, how about making report
3. Drop it
not weekly, daily but hourly
4. Indexing
5. make report

SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

For non-sampling inspection• I experienced “MMMM packets received by theapplication NNNN packets accepted by the filterand dumped to disk ummm” via turboCap API• Optimise I/O access flow using FIFO(queue)
packet -> IRQ -> SVC -> driver -> OS• Use 6 cores Xeon-L5640 and 24GB RAM !
( power resolve things and no page files )• Stop tcpdump and create program using pcap
libraries in C/C++ basically and low level one• Pcap -> standard output -> FIFO -> SQLite• 3 month no problem good
SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012

One more• Using Window Search !! CoolTo add extention of cap and pcap,
set type as clear text search,
We can search pcap/cap files like Google !
off course in multibytes ( in Japanese )• Control panel -> index option / folder option

SHARKFEST ‘12 | UC Berkeley | June 24–27, 201217

Thank you

SHARKFEST ‘12 | UC Berkeley | June 24–27, 2012