Wireshark logiciel d'analyse de réseau Manuel utilisateur

PDF

Documento

369

NDEX

!= warnings, 51

ACKed Unseen Segment. See also TCP

cause of, 191 defined in tcp-packet.c file, 192 filter for, 193 in Expert Infos window, 193 overview, 191 warning before analyzing, 192

Acknowledgment Number column, 159, See also TCP address resolution

host names, 42 problems, 100

Address Resolution Protocol. See ARP

Advanced IO Graphs. See also graphs

define impact of packet loss (tcp.analysis filters), 295 determine throughput (tcp.len), 271 identify general delays

(frame.time_delta_displayed), 118 identify TCP delays (tcp.time_delta), 132 overview of Calc functions, 270

Window Size problems, 291, 293

AirPcap adapter, 83, 353, 367, See also capture

Allow subdissector to reassemble TCP streams, 62, See also protocol preferences annotations

definition of, 353, 362

Expert Infos Packet Comments, 56 file annotation button versions, 305 recommendations for using, 319

application

causing Zero Window conditions, 212 keep alives, 108 service refusals, 3 slow DHCP responses, 285 slow DNS responses, 137 slow HTTP server responses, 143 slow SMB/SMB2 responses, 145 symptoms of slow applications, 18 symptoms of slow servers, 4

Apply as Filter. See also display filters

ARP

description of protocol, 353

Request, 97 resolution problem, 100

ask.wireshark.org, 329, 334, See also web sites asterisk on Title Bar, 306 asymmetric routing, 191

definition of, 353 overview of problems, 9

background traffic, definition of, 353

Bad TCP

button, 161 coloring rule, 161 the "Golden Graph", 280

Bae, Hansang, 12, 110 bandwidth throttling, 11 baselines, 14, 331

Bongertz, Jasper, 26, 330

Bootstrap Protocol (BOOTP), definition of, 354

BPF (Berkeley Packet Filtering) syntax, 353 broadcasts

capturing from switches, 78 definition of, 354 storms, 13

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

370 Index

browser timeout, 103 butt-ugly coloring rule, 70

Bytes in Flight, 6

adding column for, 212 definition of, 354 detect "stuck" application, 212

Calculate conversation timestamps setting.

See also protocol preferences

Calculated window size field. See also TCP

Capinfos

description of, 354 for trace file details, 315 use before Editcap, 81

capture

802.11 header, 83 aggregating taps, 80

AirPcap adapters, 83 capture filters, 88

Capture Options window, 85 dropped packets, 81 dumpcap, 81 half-duplex hubs, 80 high traffic rate links, 81 location tips, 24, 77, 81 maximum file size, 81 monitor port, 79 on target machine, 78 oversubscribed switch, 79 possible problems, 95 switched network options, 78 tcpdump or dumpcap, 24 to file sets, 85 using a tap, 79

WLAN options, 82

capture devices

AirPcap adapters, 26 hubs, 80

Shark Appliance, 81 taps, 80

Capture Engine, description of, 354 capture filters

description of, 354 dropping desired traffic, 95

MAC address, 88 use sparingly, 88

capture interface, description of, 354

Cascade Pilot

description of, 354 detecting suspect traffic, 318 favorite Views, 317 open large trace files, 316 recommended tool, 26 sample network analysis report, 318

TCP Flags Distribution View, 320

Chanalyzer software, 328

Checksum Errors. See also Ethernet, TCP, and IP

cause of, 229 caused by task offloading, 229 defined in tcp-packet.c file, 230 description of, 355 in Expert Infos window, 231 overview, 229

checksum validation

disabling, 339 settings, 229

CIDR (Classless Interdomain Routing), definition of, 355 colorfilters file. See coloring rules coloring rules

background color, 71 colorfilters file, 69 disabling, 73

DNS Error, 72 order of, 72

columns

adding, 35 change column name, 115 create delta time column, 114 displaying, 38 hiding, 38

HTTP response time, 37, 141

preferences file location, 38 renaming, 37 resizing, 115

SMB response time, 145 stream index, 101

TCP Sequence Number field, 159

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

comparison operators, description of, 355 connection refusals. See TCP conversations

Conversations window, 65 display filter, 65 filtering on a UDP conversation, 112 graphing, 263 statistics, 120

core engine, description of, 355

CSV (Comma-Separated Value) format, description of, 355

default gateway, 97

Degioanni, Loris, 26, 354, 367 delayed ACKs

description of, 355

Hansang Bae presentation about, 12 problems related to, 110 problems with Nagle algorithm, 6 timers, 110

delays. See also DHCP, DNS, HTTP, SMB, TCP

affect on Duplicate ACK count, 57 before FIN/RST packets, 108 before Keep Alives, 108 before Window Updates, 110 between SYN and SYN/ACK, 10, 109 between SYN/ACK and ACK, 10, 109 caused by delayed ACK, 110 caused by lousy routing paths, 11 checklist for detecting client issues, 28 checklist for measuring, 28 create a delta time column, 114 create a displayed delta time column, 116 delayed ACK issues, 6, 12, 110 in the middle of a data stream, 110 in UDP communications, 112 measuring path latency, 39 measuring round trip time (RTT), 128 measuring with the TCP handshake, 132 measuring with the Time column, 39 normal and acceptable, 107 path latency problems, 10, 109 preceding application Keep Alives, 108

Index 371 preceding client requests, 108 preceding DNS queries, 107 preceding FIN/RST packets, 108 preceding server responses, 109 preceding TCP Keep Alives, 108 preceding TLSv1 Encrypted Alerts, 108 preceding Window Update, 110 queuing along a path, 174, 277

TCP Delay button, 125 tips for measuring, 323 tracking TCP conversation timestamps, 120

delta time (frame time)

column, 117 description of, 355

delta time (TCP). See also TCP

description of, 356

dfilters file. See display filters

DHCP (Dynamic Host Configuration

Protocol)

definition of, 356 relation to BOOTP, 354

Differentiated Services Code Point (DSCP), definition of, 356 display filters

!= warning, 71 application name, 46

Apply as Filter, 353 bootp, 354 conversation, 44 definition of, 356

dfilters file, 322, 356

DNS, 99 exclusion filter, 51 field existence, 47 field value, 47 from the Conversation window, 65 in Tshark (-Y parameter), 249 inclusion filter, 359

IPv4 address, 95

IPv4 subnet, 43

IPv6 address, 95

MAC address, 95 port number, 45

Prepare a Filter, 363 remove DNS and DHCP, 52

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

372 Index

TCP handshake first two packets, 129

TCP handshake second packet, 130

TCP handshake’s last two packets, 130

TCP Stream Index, 122

dissectors

definition of, 356

packet-dns.c file, 237

packet-http.c file, 241

packet-smb.c file, 245

packet-smb2.c file, 245

packet-tcp.c file, 56, 153, 157

DNS

"DNS Errors" filter expression button, 238 definition of, 356 delta time, 136 detecting delays, 112, 135 display filter, 99 dns.flags.rcode > 0 filter, 47, 71, 237 dns.flags.rcode > 0 filter expression button, 308 dns.time field, 41, 112 dns.time filter, 135 error responses, 47, 69 graph delays, 138 name errors, 237

No Such Name response, 99 overview of traffic, 135

Query Name column, 239

Reply Code field, 70

Reply Codes, 237 response time, 41 server error example, 240 server failures, 237 traffic overview, 237

Transaction ID field, 69

DoS attack captured, 81

Dropbox traffic, 52 dumpcap

definition of, 356 for high traffic rate networks, 25 location of, 81 used by Wireshark, 81

Duplicate ACKs. See also TCP

cause of, 57, 167 containing SACK Left Edge/Right Edge details, 171 defined in Acknowledgment Number field, 166 defined in tcp-packet.c file, 168 filter for, 169 high number of, 57 in Expert Infos window, 170 overview, 166

Editcap, 81

definition of, 357 splitting trace files into a file set, 315

EKG pattern in IO Graph, 12 error responses

DNS, 47, 237

FTP, 255

HTTP, 241

SIP, 250

SMB/SMB2, 245

Ethereal, 357

Ethernet

definition of, 357 header, 357 trailer, 357

Validate the Ethernet checksum if possible preference, 233

exclusion filter. See also display filters

definition of, 357 example, 51

Expert Infos, 357, See also TCP

Chats tab, 56

Checksum Errors, 56, 231

Comments tab, 56

Count column, 58

Details tab, 56

Errors tab, 56

Fast Retransmissions, 184

Notes tab, 56

Out-of-Order Packets, 179 overview, 56

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

Previous Segment not Captured, 162

Reused Ports, 225

Warnings tab, 56

Window Update, 220

Zero Window Probe, 217

Zero Window Probe ACK, 217

export

columns to CSV format, 301 objects, preference settings for, 63 packet details, 309 packets, 27 packets to .txt format, 308 trace file and packet comments, 305

Fast Recovery process, 156, See also TCP

Fast Retransmissions. See also TCP

20 ms arrival time, 181 also marked as Retransmissions, 183 cause of, 181 defined in tcp-packet.c file, 181 filter for, 183 in Expert Infos window, 184 overview, 180 vs. Out-of-Order packet, 167

file sets, 85

File Transfer Protocol. See FTP filter expression buttons

Bad TCP, 161

DNS delays, 137

DNS Errors, 69, 238 editing, 54

HTTP Errors, 243

HTTP response time, 143 overview, 53 removing GET from TCP delay button, 127

SIP Errors, 253

SMB/SMB2 Errors, 248

TCP delays, 126

TCP handshake, 130

firewall blocking TCP connection, 4, 101 flat-line graph appearance, 293

Follow TCP Stream, 243 frame, 357 frame.time_delta, 112

Index 373

frame.time_delta_displayed, 112, 115, 117

Franklin, Benjamin, 105

FTP

command channel, 45 data channel, 45 definition of, 358 download, 45

FTP Errors filter, 255 ftp.response.code > 399, 257 ftp.response.code >= 400, 257

PASV command, 45 predefined Response Codes, 255

GIMP graphical toolkit, 358

Go To First Packet function, 115

Golden Graph. See graphs graphs

basic function, 67

Calc COUNT FRAMES(*), 270

Calc LOAD(*), 270

Calc MIN, AVG and MAX(*), 270

Calc SUM(*), 270 compare HTTP and FTP downloads, 268 conversations, 264

DHCP Offer packets, 285

DNS delays, 138 exported data in Excel, 304 flat-line ceiling, 293

Golden Graph, 280 graph line ordering, 287 high delta times of a TCP-based application, 286 high delta times of a UDP-based application, 285

HTTP response time, 144 logarithmic scale, 269 low throughput, 275 name resolution, 267 packet loss, 295 packet loss in multicast stream, 279 queuing delays in multicast streams, 277 single application traffic, 267

SMB response times, 149

TCP delta time, 132

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

374 Index

TCP payload only, 271

TCP window size problems, 291 tcp.analysis.duplicate_ack, 295 tcp.analysis.lost_segment, 295 tcp.analysis.retransmission, 295 tcp.analysis.window_full, 291 tcp.analysis.window_update, 291 tcp.analysis.zero_window, 291 tcp.time_delta, 286

Time-Sequence Graph (tcptrace), 297

UDP traffic, 117 using to navigate, 68

Window Scaling Graph, 294 with port-based filters, 267

hardware address resolution problems, 15 heuristic dissector, description of, 358 hexadecimal, 358 hosts file, 97, 358

HP OfficeJet traffic analysis, 210

HTTP

"HTTP Errors" filter expression button, 243

3xx Redirection, 5, 241

4xx Client Errors, 241

5xx Server Errors, 241 conversation analysis, 103 delay before response, 109 detect delays, 139

GET Request Method, 47 http.request.method filter, 47, 133 http.response.code > 399 filter, 241 http.response.code >= 400 filter, 241 http.time column, 37, 141 http.time field, 59 http.time filter, 139, 143 incorrect response time, 61

POST Request Method, 47 reassembling objects, 63

Response Code on wrong packet, 59

Response Codes (Status Codes), 241 response packet hyperlink, 60 response time column, 141 response time measurement, 59, 139

TCP preference setting effect on http.time results, 139 traffic overview, 139, 241

HTTPS

definition of, 358 sample trace file, 275

TCP preferences recommendation, 141

Hypertext Transfer Protocol Secure. See HTTPS

IANA (Internet Assigned Numbers Authority),

358

ICMP

definition of, 359

Neighbor Solicitation, 100

Redirect, 13

Router Advertisements, 98

Router Solicitation, 98, 100

Type 3/Code 3 (Destination

Unreachable/Port Unreachable), 3

ifconfig, 88 inclusion filter, 359, See also display filters

Internet Control Messaging Protocol.

See ICMP

Internet Protocol. See IP

addresses, definition of, 359 definition of (IPv4/v6), 359

IP address filter, 359

IP header, 356 ip.checksum_bad==1 filter, 229

IPv4 Validate the IPv4 checksum if

possible, 231

ipconfig, 88

Keep Alive ACKs (TCP). See also TCP

defined in tcp-packet.c file, 196 filter for, 197 in Expert Infos window, 198 overview, 195

Keep Alive Probe packets. See Keep Alives

(TCP)

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

Keep Alives (TCP)

cause of, 195 defined in tcp-packet.c file, 196 filter for, 197 in Expert Infos window, 198 overview, 195 used in Window Zero situations, 199

key hosts, 359

latency. See also delays

definition of, 359

libpcap, definition of, 359 link-layer driver, definition of, 359 location resolution, 97 logical operators, description of, 359 lost packets. See Previous Segment Not

Captured low Maximum Segment Size (MSS) problems, 275 low window size, 7, See also window size

Lyon, Gordon (Nmap Founder), 361

MAC address

capture filter, 88 definition of, 360 resolution, 97

malware symptoms, 14 manuf file, 360

Maximum Segment Size (MSS), definition of, 360

Maximum Transmission Unit (MTU), definition of, 360

Mergecap, definition of, 360 metadata, 360

Microsoft Open Specification, 145

Monitor Mode, 83 multicasts

capturing from switches, 78 definition of, 360 delayed by queuing, 277 packet loss detection, 279 storms, 13

Packet Bytes pane

definition of, 362

SACK missing fields, 172

Index 375

Nagle algorithm, 6, 110 name resolution. See also DNS

definition of, 361

hosts file, 358 in Conversations window, 112 overview, 97 problems, 14, 47, 98 resolution flow chart, 96 transport name resolution, 361

Wireshark function, 361

Netgroup Packet Filter, 229 network address resolution. See name resolution

Network Address Translation (NAT), 361

Network Basic Input/Output System

(NetBIOS), 361 network interface card (NIC), 361

Next Sequence Number

field. See TCP, Next Sequence Number

nextseq value, 154

Nmap, 361

Out-of-Order packets. See also TCP

3 ms arrival time, 176 cause of, 174 defined in tcp-packet.c file, 175 filter for, 178 in Expert Infos window, 57, 179 overview, 174 vs. Retransmissions and Fast

Retransmissions, 175

overloaded router, 12 oversubscribed switches

ACKed Unseen Segments, 27 definition of, 361

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

376 Index

packet comments. See annotations

Packet Details pane

definition of, 362 expanding sections, 36

Frame section metadata definition, 360 packet comments, 353

Packet List pane

add custom columns, 36 default columns, 35 definition of, 362 export column data, 301

packet loss. See also TCP, Previous Segment Not

Captured

calculating missing byte count, 160 cause of, 155 detection by Wireshark, 155 find location of, 163 move downstream, 164 move upstream, 164

packet size

example of low throughput due to, 275 finding average, 276 graphing issues with, 275

Length column, 28 low MTU size issues, 17 tcp.len field, 276

packet, definition of, 361 pcap, definition of, 362 pcapng, definition of, 362

Per-Packet Interface (PPI), definition of, 363 personal configuration folder, 69 pkt_comment filter, 353 port number reused. See Reused Ports port resolution, 97 port spanning, definition of, 362 port-based filters, 45, 267

PPI header, 325 preference settings. See protocol preferences

Prepare a Filter, 47

Previous Segment not Captured. See also TCP

cause of, 155 defined in tcp-packet.c file, 157 filter for, 158 in Expert Infos window, 57, 162 overview, 154

printing, analyzing "ink drying" problem, 213 prioritize troubleshooting tasks, 67 profiles

classic option, 34 creating new, 33

Default, 33 definition of, 363 import Laura’s Troubleshooting Profile, 337 step-by-step instructions, 339

Protection Against Wrapped Sequence

Numbers (PAWS), 48

Protocol Data Unit (PDU), definition of, 363

Protocol Hierarchy, definition of, 363 protocol preferences

Allow subdissector to reassemble TCP streams,

59, 61, 139, 140, 339

Calculate conversation timestamps, 119, 120,

123, 339, 356 definition of, 363

preferences file, 363

Relative sequence numbers, 226 right-click method for setting, 64 set using Edit menu item, 141 set using the Edit Preferences button, 141

TCP reassembly, 59

Validate the Ethernet checksum if

possible, 233, 339

Validate the IPv4 checksum if

possible, 57, 231, 233, 339

Validate the TCP checksum if

possible, 231, 233, 339

Validate the UDP checksum if

possible, 231, 233, 339

proxy devices

definition of, 363 mismatched parameters across, 8

Quality of Service (QoS), 363 queuing along a path, 12, 174, 277

Radio Frequency (RF), definition of, 364

Radiotap header

example of, 326 prepending, 325

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

recommendations

analyzing TCP-based applications, 323 ask for help, 334

Cascade Pilot, 316 create baselines, 331 intermittent problem analysis, 324 learn TCP/IP well, 332 maximum file size, 315 naming trace files, 319 quickly build the Golden Graph with a Bad

TCP display filter, 321 sanitize trace files, 329 trace file log book, 319 use a ring buffer, 324 use annotations, 319

WLAN capture, 325

redirection

definition of, 364

HTTP 3xx responses, 5 route, 13

relative start (Rel.Start), 364 responses, lack of, 103

Retransmission Time Out (RTO). See

Retransmissions

Retransmissions. See also TCP

cause of, 186 defined in tcp-packet.c file, 187 definition of, 364 filter for, 188 in Expert Infos window, 189 overview, 186

Retransmission Time Out (RTO), 186

Retransmission Timeout (RTO) timer, 157 vs. original packet, 165 vs. Out-of-Order packet, 167

Reused Ports. See also TCP

cause of, 223 defined in tcp-packet.c file, 223 filter for, 224 in Expert Infos window, 225 overview, 222

RFCs

RFC 1122, “Requirements for Internet Hosts --

Communication Layers”, 12, 355

RFC 1323, “TCP Extensions for High

Performance”, 16, 48, 202

Index 377

RFC 2018, “TCP Selective Acknowledgment

Options”, 16

RFC 5681, “TCP Congestion Control”, 166

RFC 793, “Transmission Control

Protocol”, 104

ring buffer, 324 round trip time (RTT)

causes for high RTT, 41 example measuring, 333 graphing, 132 measuring, 39, 40, 131 measuring with TCP handshake, 109, 128

RTO timer use of, 186 tips for using, 323

route resolution, 97 routing loops, 9 routing path problems, 11

sanitize trace files

using a hex editor, 329 using TraceWrangler, 330

Selective ACK

in Duplicate ACKs, 172 missing in Duplicate ACKs, 7 missing in handshake, 53

Unsupported, 16

Selective Acknowledgment (SACK). See

Selective ACK

Sequence Number field. See TCP, Sequence

Number server

application fault, 5

DNS error messages, 69

HTTP error messages, 241

Server Message Block (SMB). See SMB

Server Message Block Version 2. See SMB2 service request, no response to, 103

Service Response Time (SRT) statistics, 148 services file, 97, 364

Session Initiation Protocol (SIP). See SIP

Set Time Reference

bug in resetting Time column, 207 measuring delay impact, 189 measuring Zero Window delays, 206

Shark Appliance (Cascade), 81

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

378 Index

Sharkfest conference

demonstration of TraceWrangler, 26

DoS attack during, 81 information about, v

Jasper Bongertz, 330

Simple Network Management Protocol

(SNMP), definition of, 364

SIP

"SIP Errors" filter expression button, 253

3xx Redirection, 5, 250

4xx Client Error, 250

5xx Server Error, 250

6xx Global Failure, 250 sip.Status-Code > 299 && sip.Status-Code < 400, 5

Status Codes (Response Codes), 250 traffic overview, 250

slow server response. See delays

SMB

"SMB Errors" filter expression button, 248 definition of, 364 detecting delays, 145

Negotiate Protocol response, 248

NT Status codes, 245 reassembling objects, 63

Service Response Time, 145, 148 smb.nt_status > 0 || smb2.nt_status > 0, 245 smb.time, 145 traffic overview, 145, 245 version 2, 145

SMB2

"SMB2 Errors" filter expression button, 248 smb2.time, 145 traffic overview, 245

Snort, definition of, 365 spanning. See switches

Spanning Tree Protocol (STP), definition of, 365

Status Bar

active profile, 33 annotation button versions, 305 current profile, 363 displayed packet count, 43

Stream index, definition of, 365 stream reassembly, definition of, 365 subdissector, definition of, 365 subnet filter, 43 subnet, definition of, 365

Summary statistics, 276 suspicious traffic, 14 switches

loop problems, 13 oversubscription description, 361 oversubscription symptom, 191 port spanning, 79

SYN bit. See TCP, SYN bit

TAP ("Test Access Port")

definition of, 365 recommendation, 79

task offloading

checksum errors symptom, 229 definition of, 365 disable checksum validation, 233

TCP

Acknowledgments, definition of, 353 attributes altered along path, 7

Bytes in Flight column, 6, 212 connection refusal, 3, 101

Conversations window, 65 delays before FIN/RST packets, 108 before final handshake packet, 109 before Keep Alives, 108 before SYN/ACKs, 109 before TLS Encrypted Alerts, 108 before Window Updates, 110 delayed ACK issues, 6, 12, 110

Expert Infos filters tcp.analysis.ack_lost_segment, 191 tcp.analysis.duplicate_ack, 166, 169 tcp.analysis.fast_retransmission, 180 tcp.analysis.flags, 161 tcp.analysis.flags &&

!tcp.analysis.window_update, 280 tcp.analysis.keep_alive, 195 tcp.analysis.keep_alive_ack, 195 tcp.analysis.lost_segment, 154, 155, 158 tcp.analysis.out_of_order, 174, 178 tcp.analysis.retransmission, 186

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

tcp.analysis.reused_ports, 222 tcp.analysis.window_full, 208 tcp.analysis.window_update, 161, 218 tcp.analysis.zero_window, 201 tcp.analysis.zero_window_probe, 215 tcp.analysis.zero_window_probe_ack,

215

FIN acceptable delays preceding, 108

FIN (Finish) bit, definition of, 357

WAIT states, 103 graphs

TCP delta time, 132 tcp.analysis.duplicate_ack, 295 tcp.analysis.lost_segment, 295 tcp.analysis.retransmission, 295 tcp.analysis.window_full, 291 tcp.analysis.window_update, 291 tcp.analysis.zero_window, 291 tcp.time_delta, 286

Window Size problems, 291 handshake analysis missing SACK, 53 missing Window Scaling, 53 tips, 323 illogical flags set, 320 low Window Size problems, 48 multiple simultaneous connections, 102

Next Sequence Number column, 159

Duplicate ACK detection, 166 field definition, 154

nextseq in packet-tcp.c, 154, 157 packet loss, 58, 154 preference settings

Calculate conversation timestamps, 119 reassembly preference setting, 59

Track Number of Bytes in Flight, 212

Validate the TCP checksum if possible, 231 receive buffer full, 6 relative sequence numbers, 226

RST acceptable delays preceding, 108

RST (Reset) flag, definition of, 364

Sequence Number column, 159 field, 154

Index 379

Stream Index column, 123 field, 101 filter, 122

SYN

SYN (Synchronize Sequence Numbers) flag, definition of, 365

SYN bit filter, 53

SYN retransmissions, 102 tcp.ack filter, 131 tcp.checksum_bad==1 filter, 229 tcp.flags.ack filter, 131 tcp.flags.fin filter, 131 tcp.flags.syn filter, 131 tcp.len > 0 filter, 131, 276 tcp.len value, 271 tcp.options.sack_perm filter, 53 tcp.options.wscale.multiplier filter, 53 tcp.port==80 filter, 267 tcp.seq filter, 131 tcp.stream field, 119 tcp.stream filter, 122 tcp.time_delta column, 123 tcp.time_delta field, 120 tcp.time_delta filter, 128 tcp.time_relative field, 120 tcp.window_size filter, 48

Time-Sequence Graph (tcptrace), 297 unsuccessful connections, 124

Window Scaling missing in handshake, 53

Zero Window conditions, 199, 201, 204, 206,

208

Zero Window Probes, 200, 215

Zero Window Updates, 200

TCP handshake. See TCP, handshake analysis tcpdump, 25, 81 throughput

definition of, 366 graphing, 264 measuring, 67

time. See delays

Time column

default, 114 measure delays, 68 precision, 40 settings, 39

time stamps, 39

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

380 Index

Time to Live (TTL) field, description of, 366

TLS

Close Encrypted Alert, 108 delays before TLSv1 Encrypted Alerts, 108

Encrypted Alerts, 108

top talkers, 65 trace files

description of, 366

integrity, 25, 27 on www.wiresharkbook.com, 345 referenced in this book, 347

TraceWrangler, 26, 330, 366

Transmission Control Protocol. See TCP

Transmission Control Protocol/Internet

Protocol (TCP/IP), definition of, 366

Transport Layer Security (TLS), description of, 366

Trivial File Transfer Protocol (TFTP), definition of, 366 troubleshooting checklist, 27 troubleshooting profile, 33

Troubleshooting_Book_Profile.zip, 337

Tshark

creating trace file subsets, 315 definition of, 366 display filters in, 249

UDP

conversation delays, 112 definition of, 366 graphing delays, 117 header format, 112 most active conversation, 112 udp.checksum_bad==1 filter, 229

Validate the UDP checksum if possible, 231

Uniform Resource Indicator (URI), definition of, 367 unknown hardware address, 78

User Datagram Protocol. See UDP

virus symptoms, 14

weak signal, 9 web sites

bit.ly/delayedack, 110

wiki.wireshark.org/CaptureFilters, 90

wiki.wireshark.org/CaptureSetup/WLAN, 83

wiki.wireshark.org/Development/PcapNg, 362

www.insecure.org, 240

www.lovemytool.com, 330

www.metageek.net, 328

www.nmap.org, 240

www.riverbed.com, 26, 318

www.snort.org, 365

www.tracewrangler.com, 26

www.wiresharkbook.com/resources.html, 26,

334

www.wiresharkbook.com/troubleshooting.html,

318

Window Full. See also TCP

cause of, 208 defined in tcp-packet.c file, 209 example of, 213 filter for, 210 in Expert Infos window, 211 overview, 208

Window Scaling. See also TCP

graph, 294

Shift Count, 202 unsupported, 16, 53

window size. See also TCP

above 65,535 bytes, 53 window size low, 48

Window Size Value field, 202

Window Update. See also TCP

cause of, 218 defined in tcp-packet.c file, 218 delays preceding, 50 example of, 206, 220 excluded from, 218 filter for, 219 in Expert Infos window, 220 near a delay, 68 overview, 218

Window zero. See Zero Window

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

WinPcap, 229, 359

definition of, 367

Wireless Local Area Network (WLAN), definition of, 367

Wireless Toolbar, 84

Wiretap library, definition of, 367

Wi-Spy adapter, 328

WLAN

malformed frames, 327

Management, Control and Data frames, 82

Monitor Mode, 83 native adapter capture, 82 native adapter problems, 325

PPI header, 83

Radiotap header, 83

Retries, 9, 326

SSI (Signal Strength Indication) Signal

(dBm) value, 326 weak signal, 9 wlan.fc.retry == 1, 326

X-Slogan detection, 89

Index 381

Zero Window. See also TCP

cause of, 201 defined in tcp-packet.c file, 203 example of, 204 filter for, 203 graphing recovery from, 291 in Expert Infos window, 204 measure delays, 206 overview, 201 preceded by Window Full, 205

Zero Window Probe. See also TCP

analyzing with a Bytes in Flight column, 217 cause of, 215 defined in tcp-packet.c file, 215 filter for, 216 in Expert Infos window, 217 overview, 215

Zero Window Probe ACK. See also TCP

cause of, 215 defined in tcp-packet.c file, 215 filter for, 216 in Expert Infos window, 217 overview, 215

Troubleshooting with Wireshark

: Locate the Source of Performance Problems à

www.wiresharkbook.com

Olá! Eu sou um chatbot de IA especificamente treinado para ajudá-lo com o Wireshark logiciel d'analyse de réseau Manual do usuário. Já revisei cuidadosamente o documento e posso ajudá-lo a localizar as informações exatas de que precisa ou explicar o conteúdo de maneira clara e simples. Quer você esteja procurando orientação sobre recursos específicos, etapas de solução de problemas ou uso geral, fique à vontade para fazer suas perguntas. Quanto mais detalhes você fornecer sobre suas preocupações ou necessidades, mais precisamente e eficazmente poderei ajudá-lo!

Assistente digitando

O assistente está fora do teclado. Por favor, tente novamente mais tarde.

Parece que você acessou um documento escrito em vários idiomas, incluindo um que não é seu idioma nativo. Você pode usar os links a seguir para ocultar temporariamente as páginas sem o idioma de sua preferência.