• By the end of this lesson, the participant will be able to: ▫ Understand IO Graphs ▫ Understand TCP stream graphs

1. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 1
Network analysis Using Wireshark
Lesson 7:
Advanced Statistical Tools

2. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 2
• By the end of this lesson, the participant will be able to:
▫ Understand IO Graphs
▫ Understand TCP stream graphs
Lesson Objectives

3. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 3
yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to:

4. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 4
Creating I/O graphs
Creating TCP graphs
Evaluating service response times
Chapter Content
“In three words I can sum up everything I've
learned about life: it goes on.”
Robert Frost

5. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 5
The "I/O Graphs" window

6. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 6
The "I/O Graphs" window
Drag/Zoom
Time
interval
Time of
Day
Display
filter Y-Axis
Name
Add/Delete
graph
Logarithmic
scale

7. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 7
How to find what it is…
Zoom on peak

8. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 8
All traffic with specific filter (1)

9. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 9
All traffic with specific filter (2)

10. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 10
All traffic with specific filter (3)

11. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 11
Traffic with Specific Connections Filters

12. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 12
What DupACKs Can Cause

13. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 13
What We Measure Line/Port
User
Connection
PC

14. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 14
How to Measure it…
Right-click and
choose a filter

15. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 15
And to the IO Graphs: L3 Statistics

16. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 16
And to the IO Graphs: L3/4 Statistics
Where have all the
packets gone???

17. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 17
And some TCP Analysis (Window-full)…
~50 Window-full
events per second~5 Window-full events
per 0.1 seconds

18. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 18
IO Graphs – Changing the Y-Axis

19. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 19
IO Graphs – Changing the Y-Axis

20. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 20
Create I/O graphs
Create TCP graphs
Evaluate service response times
Chapter Content
“To live is the rarest thing in the world.
Most people exist, that is all.”
Oscar Wilde

21. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 21
TCP Stream Graphs

22. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 22
• There are four types of TCP graphs:
▫ Time-Sequence (Stevens) - TCP sequence numbers versus time
▫ Time-Sequence (tcptrace) - TCP sequence numbers versus time,
ACK values received from the other endpoint and the receive
window advertised from the other endpoint
▫ Round Trip Time – time between packet send and Ack
▫ Throughput – throughput measured by sequence numbers
▫ Window Scaling Graph – receiver window size
TCP Stream Graphs

23. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 23
Sequence Graphs
Click on the stream
(in the direction you
want to check!)
Choose:
Statistics – TCP
Stream Graphs
Choose
graph type Choose graph
direction
Choose stream
number
Zoom/move

24. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 24
Zooming On a stream
What happened
here?
What happened
here?
Change to drags for
choosing event

25. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 25
TcpTrace
Sequence
graph
Free receive
window

26. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 26
TcpTrace (with Focus)
Free receive
window
TCP
Segments
TCP Ack’s
Segment 1 Segment 2
Ack for segments 1+2

27. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 27
Just Another Example

28. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 28
TCP Graphs - Throughput

29. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 29
TCP Graphs - RTT

30. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 30
Create I/O graphs
Create TCP graphs
Evaluate service response times
Chapter Content
“Whenever you find yourself on the side
of the majority, it is time to reform (or
pause and reflect).”
Mark Twain

31. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 31
When applicable, choose Service Response Time from
Statistics menu
How to Evaluate
Use IO Graphs for specific
request/response (for
example DNS)
Use specific web sites, like
https://tools.pingdom.com/

32. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 32
Summary
• In this lesson we talked about:
▫ Wireshark’s IO graphs
▫ Wireshark’s TCP stream graphs
Thanks for your time
Yoram Orzach
yoram@ndi-com.com

33. Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage 33
yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to: