Simple Guide for analyzing web traffic for troubleshooting purposes
Tags: troubleshoot, networking, trafficinspection, webtraffic
Published: 2023-03-29 01:34:55

There are many tools out there that can help you to troubleshoot from free to paid tools which can help you identify where the problem is an help remediate, some examples are listed below: 

Networking and traffic inspection tools:

**Windows OS:**

- TCPView*
- PsPing v2.1*
*Important: from windows internals tools. Installation is required

**Windows, Unix based, Mac OS:**

1. WireShark
2. IPerf
3. Fiddler
4. Netstat
5. Nslookup 
6. Solarwinds
7. Paessler (PRTG)
8. Much more

Every software and tool has its own pros and cons, and their selection will depend on scope, reason from troubleshooting and budget. In this article I will focus on a few of them that might help to get more concrete information where the problem is, whether you are in a cloud, hybrid and on-prem environment. 

In one of my previous articles I discussed a little bit of the IPerf tool, which I believe is a great tool  for testing connectivity and throughput between two points. Wireshark on the other hand I would say it is a network engineering tool par excellence, and there are many guides, documentation and videos that are super helpful so I decided that I will leave this tool out from my article for now.  But I highly recommend using and getting familiar with both whether you are troubleshooting, learning concepts or only getting used to your service patterns, software or application's web traffic.
Before getting into the topic, I think is important to remind REST API codes (HTTP Status codes),  so please review the reference below:

- https://en.wikipedia.org/wiki/List_of_HTTP_status_codes
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
- https://www.restapitutorial.com/httpstatuscodes.html

So in Summary, any **40X** code is client problem, **50X** code server problem, **30X** redirections and **20X** everything is alright :).

I've been trying different tools from paid to open source, in Linux and Windows environments. In this post, I decided to share some of the tools I've been using recently, which some use cases and examples.

**PRGT:**

While I was looking for a network traffic analyzer,  I found Paessler, it was mentioned on most of the websites where tools are listed, and because I've never used it before I decided to try it. 

1. It was convenient that they offer a trial option when you don't have a windows machine (which was my case), so having a sandbox was really easy and convenient in order to try it for the first time. Something t notice is that the downloadable version for Windows machine gives you a trial for 30 days in comparison with the hosted version which gives you 10 days.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9p5pk4853yf9gn7yv8gb.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m017cps98ls267q52gbw.png)
 
**Netstat:**

This utility is largely used in Linux and Windows systems and will help you determine where the problem might be located  or guide you through the troubleshooting process, some commands that I believe are good to keep under the sleeves are:

-`netstat` the simple command will show the transport protocol (Layer 4) state of the connection (ESTABLISHED, CLOSE_WAIT, FIN_WAIT, etc.)  and foreign address

- `netstat –a –o –p tcp`

-Other useful commands: 

```
- 1. netstat –f –p tcp | findstr ESTABLISHED
- 2. netstat -na –o
- 4. netstat –a| findstr <_e.g. port number_>
- 5. netstat –a -o| findstr <_e.g.port number_>

```
where:
a => active connections
o => PID (Process ID)
p => protocol, ex. UDP, TCP.

**TCPView**

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.
It gives us a graphical interface, easy to understand and manage lightweight, and also can help you to check UDP and TCP traffic


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qs29m01k9fwyko8sfre4.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zn0fe9vw882fw7k16ual.png)
References:

https://learn.microsoft.com/en-us/sysinternals/downloads/tcpview