Packets In The Tcp Dump Format example essay topic

Introduction If you " ve ever been a network administrator, the call you dread the most might be one you receive in the middle of the night by some panicked employee stating that a portion of your critical network has gone down. What troubleshooting options are available to provide answers to your network problem? Besides having a proactive help desk that can "read" the mind of your network, an important part of troubleshooting involves using a network protocol analyzer. If you " ve done your research, you realize that there are many choices on the market today that may satisfy your needs but make a dent your company's pocket book.

Plus, you have to factor in training your help desk on how to use this new tool and if it will provide some type of return on investment (ROI). After conducting a thorough research of tools to analyze and troubleshoot a network, we decided to use Ethereal. Many versions such a Sniffer (R) Portable by Network General and Observer (R) by Network Instruments provided more options but were only available in "demo" versions and didn't provide full functionality. Since we wanted to use Tcpdump as one of the tools in our network troubleshooting arsenal, it made sense to run Ethereal since it supports this type of filter. So, what is Ethereal? Ethereal is a network analyzer.

It has the ability to read packets from a network, decipher them, and then display the results with a very intuitive GUI. According to the book Ethereal Packet Sniffing, "the most important aspects of Ethereal are as follows: that it is open source, actively maintained, and free". After conducting thorough research, Ethereal also supports Tcp Dump format capture filters, supports over 700 protocols (new ones are added on a regular basis), and the tool can capture data from Ethernet, Token Ring, 802.11 Wireless, etc. For anyone interested in a command line interface (CLI) interface for Ethereal, you " re in luck since there is a CLI available called t ethereal. History of Ethereal Ethereal is a fairly mature networking tool that was developed by Gerald Combs back in 1997, but has only been available to users since 1998.

Something unique to this tool is the numerous dissectors that are available. If you " re like me, you may ask yourself, what are dissectors? According to Brockmeier, they "are what allow Ethereal to decode individual protocols and present them in readable format". Since the code is open source, you will notice every few months that the list of supported protocols has increased due to individual contributions to Ethereal. As you can see from the Linux open source software, continued support will only improve the features and overall usability of any open source tool. Using Ethereal in Your Network According to Brockmeier, network placement is critical for proper analysis and troubleshooting.

If you find yourself working at a large corporation, it's inevitable that you will be working in multiple building, across campuses, throughout the country, and perhaps overseas. It's vital when troubleshooting devices, to verify that you are on the correct segment of the network. This will not only save time, but money since you can use your resources more efficiently. It makes sense to have a laptop computer (with some type of network analyzer installed) for troubleshooting network related issues, since not all network related problems occur on the same sub net of your network. Figure 1 depicts a basic network setup where you could use Ethereal to view protocol activity from router to server, etc. Figure 1 Compliments of Ethereal Packet Sniffing, 2004 What is TcpDump To troubleshoot the network we also used a tool called Tcp Dump.

Tcp Dump is a network utility that listens to and records traffic on a network. Tcp Dump helps in solving problems that can be found in the packet or frame level. By default, it puts the network interface into promiscuous mode to capture every packet going across the wire. The user can specify a large number of variables to help filter the data that is being captured. Tcp Dump will automatically print the header information of each packet in a text format. There are several tools that have been created to utilize Tcp Dump formatted documents.

O'Rielly's Network Troubleshooting Tools book lists several of these tools, ", xp lot, tcp trace, tcp show, tcp slice, tcp-reduce, tcp flow, , and sanitize". The author also says this about the tools", One reason for using tcp dump is the wide variety of support tools that are available for use with tcp dump or files created with tcp dump. There are tools for sanitizing the data, tools for reformatting the data, and tools for presenting and analyzing the data". (web 2 need / t shoot/) The p cap library is used to read or write data in the raw format. Thus, it is easy to write a program to read or write packets in the Tcp Dump format. For our needs we used the p cap library that comes with Ethereal to analyze all the packets we captured. Examples using Tcp Dump As mentioned above there are many variables that the user can put into action to filter and concentrate the data.

Illustrated in Figure 2 is a basic Tcp Dump command line the -s specifies the size of each packet to be recorded, the -c specifies the amount of packets captured, and the -w tells it to write the packet information to a file. After executing the command and message is displayed after the capture is over with packets captured, packets dropped, and packets captured by the filter. Figure 2 This basic command line function works great when the user just needs to look at anything out of the usual or the user needs to look at every packet moving across the network. To filter the data to a more accurate level so the user doesn't have to sift through packets that are of no concern, more filtering variables must be put into place. In Figure 3, I have filtered the packets using several simple variables. The -e will print the link layer header with every packet, the not-vs. is a verbose command which will simply print more data with each packet such as time to live and type of service, the -tt prints a time stamp with every packet.

Figure 3 These are just a few examples of the power of Tcp Dump in network troubleshooting. Tcp Dump alone is very useful if you know what you are looking for and you can filter down the packets enough to get a clean view of the data. Using this tool in coordination with other utilities will provide any network administrator with the power and ability to solve problems that originate on the packet and frame level. negress. count 415 Network Issues: We began the troubleshooting portion of our project by running packet captures via Ethereal and Tcp Dumps of various lengths at different times of the day looking for any trouble that we could use for this project. We found that most of the issues with the network were with the SNMP traffic, although there were various other issues, none of them were neither large nor deemed to be within the scope of this project. The first issue we found was an SNMP authentication error trap from the A 2501 Atlanta router, IP 10.41. 5.4. We ascertained the symptoms by observing "Authentication error" trap traffic being sent to the NTlinnux box at IP 10.41.

5.100. We defined the issue as likely one involving some type of mis-configuration of the SNMP community name. We analyzed the issue by observing the same SNMP traffic via Ethereal captures and Tcp Dumps, from the NTlinnux box. We didn't need to isolate the issue as the nature of the problem was specific to this single device and therefore proceeded to step 6 accordingly. We identified the issue as being a mis-configuration of the SNMP settings. While the community name was correct it appeared that the traps had not been "enabled".

We proceeded to solve the issue by "enabling" the traps and verified that the issue had been solved by running an ethereal capture and then a Tcp Dump for good measure. Figure 5 Figure 6 Figure 7 The second issue found was another authentication failure trap from the A 3024 Atlanta Dell switch, IP 10.41. 5.30. This issue proved a bit more time consuming.

After confirming the correct configuration of the community name and table we were still seeing trap traffic from this device. Realizing that we could not verify that the issue had been solved, we went back to step 5 to "Identify and test the cause of the issue". After several cycles of returning to step 5, one of us remembered that we had seen something similar to this issue in the past. We deleted the entire row holding the configuration in the community table and added a new entry below.

This apparently was the fix as we stopped seeing trap traffic. While we are not sure exactly what anomaly in the Dell software cased this issue it was deemed out of the parameters of this report. We used Ethereal, Tcp Dump, and ran a Perl script to confirm that the trap traffic had ceased and we considered the issue resolved.