Lab Objective:
Learn what performance problems are.
Lab Purpose:
Understand how to detect and troubleshoot performance problems baselining.
Lab Tool:
Wireshark Network Analyzer on PC, Ethernet Switch/Router (cable/Wi-Fi).
Lab Topology:
Please use the following topology to complete this lab exercise (PC equipped with Wireshark connected via wireless to a Network Router that has access to the Internet).
Lab Walkthrough:
Task 1:
One of the most popular troubleshooting methodologies begins at the physical layer and moves up through to the application layer in bottom-up order.
Usually, when we can observe slow application loading time, slow file transfer time, inability to connect to specific services, we have to suspect that some performance issues are occurring.
Some cases that we can encounter during performance analysis are:
DNS problems may prevent a host from obtaining the IP address for a target host
Incorrect subnet mask values may cause a host to perform discovery for a local host that is, in fact, remote
Incorrect route table values or unavailable gateways may isolate a host
A first solution that can immediately spot the source of the problem and solve it is take the baseline of normal network communications and compare to faulty communications to locate differences.
Task 2:
High latency times can be caused by distance, queuing delays along a path, processing delays, etc.
Open Wireshark and capture some minutes of traffic on the active network interface and save the file.
From the Main Menu, select View ➜ Time Display Format ➜ Seconds Since Previous Displayed Packet as displayed in the figure below:
Then click on the column “Time” in the Packet List pane in order to sort this column and note large gaps in time between packets in the trace file as displayed in the figure below where it is possible to note that the maximum gap is 0.97 s:
It is important to remember that, in case the trace file contains numerous conversations, we have to filter on a conversation before sorting the Time column to ensure that we are comparing times within a single conversation.
To do so, just select from the Main Menu the item “Analyze” ➜ “Conversation Filter” as displayed in the figure below:
We can note in this case that the maximum gap is instead 0.99 if we had chosen the TCP conversation:
It is also possible to add a new column through the Preference Window where we can select an additional Delta Time.
Another option is to inspect the Frame content in the Packet Details pane, as displayed in the figure below:
We can see numerous time values inside the Frame section. Although these values are not actual fields in the packet, Wireshark can find packets based on their values.
Packet timestamps are provided by the WinPcap, libpcap, or AirPcap libraries at the time the packet is captured and are saved with the trace file (above mentioned libraries support microsecond resolution).
Task 3:
Another possibility is to filter on the arrival time of packets. The Arrival Time value is based on the system time at the time the packet was captured. For example, we can use the following display filter for filter out packet arrived after 10:11:30 PM of March 26th
“ frame.time > “Mar 26, 2020 22:11:30.000000000” ” as displayed in the figure below:
Notes:
Repeat the previous steps, filtering with timestamp and delta time between packets trying to identify time gaps in the network capture. Get confidence with filtering conversation times and again capture other trace capture files in order to test different approaches based on the arrival time of the packets.
