Network analysis Using Wireshark Lesson 12 - bandwidth and delay issues

Network Analysis Using Wireshark Version 2Network Analysis using Wireshark V.2 yoram@ndi-com.com
Network analysis using Wireshark V2 yoram@ndi-com.comPage1
Network analysis Using Wireshark
Lesson 12:
Bandwidth, Delay & Jitter Issues

Network analysis using Wireshark V2 yoram@ndi-com.comPage 2
• By the end of this lesson, the participant will be able to:
▫ Perform bandwidth and throughput tests
▫ Measure applications throughput
▫ Understand the impact of delay and jitter on network applications
Lesson Objectives

yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to:

Network analysis using Wireshark V2 yoram@ndi-com.comPage4
Measuring total bandwidth on a communication link
Packet loss and recovery - UDP and TCP
Previous segment lost and Out-of-Order Segments events
Duplicate ACKs and Fast Retransmissions
TCP Retransmissions and their impact on network performance
Delay/jitter influence on TCP behaviour
Zero window, Window changes and other window problems
Chapter Content
“Discipline is the bridge between goals
and accomplishment.”
Jim Rohn

• How to measure bandwidth / throughput
▫ Per Line/Port
▫ Per user
▫ Per connection
The Problem – Who is Loading the Line
Line/Port
User
Connection

• Tools to be used:
▫ Wireshark with Port mirror to port under test
▫ SNMP software monitoring Switch/Router
• Wireshark tool:
▫ Statistics tools
▫ IO Graphs
Line/Port Bandwidth Measurement

What Is the Bandwidth Distribution

Chapter Content
“Live as if you were to die tomorrow.
Learn as if you were to live forever.”
― Mahatma Gandhi

Per Network / Session Filtering
• In UDP
▫ Lost packets are not recovered
▫ In some cases, the protocol recovers them
• In TCP
▫ A lost packet will be retransmitted but..
▫ Retransmission can be due to packet loss or:
 Slow client or server
 Delays on the line

• Ping the destination (-t)
▫ If we don’t get some replies – increase time wait with –w option
▫ For example: ping –t –w 5000 8.8.8.8
• Check in communications devices and look for CS/CRC errors
▫ Errors: cause the switch/router to drop packets
▫ CPU load: cause switch/router to delay and then drop packets
▫ Traffic policing and WRED: can cause packet losses
• Check capture file:
▫ TCP Retransmissions
▫ Applications that runs over UDP send packets repeatatly
Indications for Packet Losses

Ethernet Frame Losses
First indication
– the Expert
System
Example
12-1

Digging in gives us…
Example
12-1

Exercise 12-2:
Errors and their influence on thrughput
• In the attached file (Exercise 12-1), were does the
errors come from?
• Are they critical? Are they real?
• What can they cause?

• Response to a packet loss is retransmission.
• Retransmission can be due to:
▫ Packet loss
▫ Line delay
▫ Slow end-devices
• We verify a packet loss by elimination:
▫ If it is low and stable delay and ..
▫ There are no TCP window issues and ..
▫ Then it might be packet losses
▫ Go and check network devices
TCP – Is it a Packet Loss?

• IP Identification field (ID) is used to identify the packet,
especially for the case of fragmentation.
• ID can be implemented as (depends on the TCP/IP stack,
RFC 4413):
▫ Sequential jump
▫ Random
▫ Sequential
• In the case of sequential or sequential-jump it gives us
another indication for lost packets.
Another Method..
Looking at the IP Packets IDs
Sequential jump

Chapter Content
“Success is not final, failure is not fatal: it is
the courage to continue that counts.”
― Winston S. Churchill

Previous segment lost and
Out-of-Order Segments events
Example
12-2

Chapter Content
― Mahatma Gandhi

Example 12-3
• Duplicate ACKs are sent when the receiver sees a gap in the
packets it receives.
• Fast retransmissions use a counter for duplicate ACKs to trigger
a retransmission faster than by Retransmission TimeOut (RTO).

What happened?
Example
12-3
• We look at the TCP window
size (in the transfer
direction)
▫ No significant changes so..
▫ It is OK
• We look at the TCP
throughput graph (in the
transfer direction)
▫ There are strong
degradations during 3 time
periods
▫ Something is wrong

• Looks like:
▫ There are no delay variations
▫ No TCP window changes
▫ Degradation in performance is inspected
• Looks like some packet losses
• But:
▫ It is a connection to a server on the Internet
▫ Some packet losses can happen
• And when we look at the IO graph for this connection…
And the answer is….

Oooops…

Delay/Jitter and TCP

Exercise 12-3:
Duplicate ACKs influence on throughput
• In the attached file (Exercise 12-3), what can be the
reason for the DupAKCs?
• What is the meaning of the red lines in the TCP Stream
Graphs (tcptrace) graph?
• What can be the reason for so many DupACKs?

Chapter Content
“Courage is what it takes to stand up and
speak; courage is also what it takes to sit
down and listen.”
Winston Churchill

Flow & Congestion Control - Reminder
• Flow control:
▫ Controls the amount of data sent
by the sender.
▫ Achieved by a "window”
mechanism
• Congestion control:
▫ Try to get to the maximum
throughput of the
communication line
time
CWND
Min = MSS
MAX = RWINRetransmission Retransmission Retransmission

Exercise 12-4:
Network traffic
• In the attached file (Exercise 12-3), the network
becomes very slow. What is the reason for it?
• What is the bandwidth of the Internet connection?

Chapter Content
― Mahatma Gandhi

FTP Download over Slow Cellular Link
Example
12-4

FTP Download over Slow Cellular Link

Chapter Content
“The best argument against democracy is
a five-minute conversation with the
average voter.”
Winston Churchill

Exercise #5:
Zero Window influence on throughput
• In the attached file (Exercise 12-5), what is the reason
for the network slow-down in shown?
• What is the problem?

Summary
• In this lesson we talked about:
▫ How to measure network bandwidth and applications throughput
with Wireshark
▫ How to measure delay and jitter, and their influence on
applications performance

yoram@ndi-com.com
For More lectures, Courses & Keynote Speaking
Contact Me to:

Network analysis Using Wireshark Lesson 12 - bandwidth and delay issues

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a Network analysis Using Wireshark Lesson 12 - bandwidth and delay issues

Semelhante a Network analysis Using Wireshark Lesson 12 - bandwidth and delay issues (20)

Mais de Yoram Orzach

Mais de Yoram Orzach (16)

Último

Último (20)

Network analysis Using Wireshark Lesson 12 - bandwidth and delay issues