Wednesday, November 16, 2022

Pros and Cons of Packet Slicing

 Whenever I’m working with a client on packet analysis, I always ensure that I cover packet slicing concepts. It doesn’t matter if I am teaching, troubleshooting or baselining, I believe that packet slicing is an important part of packet capture.


One school of thought is to slice after the fact, which you can do with Wireshark’s editcap utility and the -s option and now you have the original trace and a sliced one. Unfortunately, depending on the size of the trace, you might find this a bigger job than you think and now you have to ensure you keep track of 2 files.


In this video I cover why, and when, I packet slice. I prefer to slice ahead of time, especially if the captured packets might contain sensitive information. In this video I show you how I configured packet slicing in Wireshark and using the web interface on Network Critical’s SmartNA XL (https://www.networkcritical.com/smartna).


Keep in mind that under specific conditions, some capture devices (laptop and desktops) may drop full sized packets and slicing is a way to mitigate that problem. I would encourage you to test your packet capture laptops and desktops and determine when, or if they drop packets using various frame sizes and rates.

If you need to figure out to determine a specific slice offset, check out my other video “Figuring Out Where To Slice a Packet Using Wireshark” https://www.networkdatapedia.com/post/2018/02/05/Figuring-Out-Where-To-Slice-a-Packet-Using-Wireshark





Monday, November 14, 2022

Creating A IPv4 Filter With Your Packet Broker

 One of the challenges I encounter when capturing packets is the sheer volume of data on todays networks. Most workstations have a minimum of 1 Gb connections and switch trunks are mostly 10 Gb connections.


This results in 2 issues:

- With a high packet rate and using a laptop or desktop to capture packets, you stand a chance of dropping packets.

- Going though gigabytes of data, is incredibly difficult and mostly unusable.


One way to mitigate these issues is to simply use a capture filter to reduce the amount of traffic captured. Unfortunately this technique doesn’t change the amount of packets being received by your capture device.


The other option would be to use a packet broker that can reduce the amount of traffic sent to your capture device. You have to check with your specific make and model to see if it supports this filtering feature.


In this video, I use my Network Critical SmartNA XL www.networkcritical.com packet broker to demonstrate this methodology.




Thursday, November 10, 2022

Connections Are Everything

 

My doctor, my financial planner and my trust attorney all roll their eyes when I tell them I intend to live to 100, but I am dead serious. Although I have yet to become a germophobic vegan gym rat, I am still drawn to click-bait like “10 ways to Live Longer and Better.” Beyond the no-smoking, moderate drinking, green leafy vegetable edicts, one standout is connections – being connected through healthy relationships is essential to longevity. Seventeenth-century Englishman John Donne foretold this with his oft-quoted “No man is an island”, noting that we all rely on others in one way or another.


Whether you believe that the physical world we inhabit was intelligently designed, or that it arose spontaneously through some improbable coincidence, it’s impossible to overlook many of the connections that surround us. A few of them are fairly subtle and call for the discernment of experts.


One such legendary though elusive connection is explained by Dr. Ian Malcolm.


“It simply deals with unpredictability in complex systems,” says Dr. M. “The shorthand is ‘the butterfly effect.’ A butterfly can flap its wings in Peking, and in Central Park, you get rain instead of sunshine.”


Dr. Malcolm’s credentials are well-established - he is the character played by actor Jeff Goldblum in the movie Jurassic Park. Whether or not a fly can produce the same effect by flapping its wings is left unsaid.


The technical term for this connection is Chaos Theory, which is based on the sensitivity of complex deterministic non-linear systems to small changes in initial conditions. Some of the confusion with respect to winged insects can be traced to the ad hoc father of Chaos Theory, meteorologist Ed Lorenz. For the record, Ed actually said something to the effect that even if we could account for every single butterfly, we still couldn’t predict the weather. If the flap of a butterfly wing in the Amazon really does cause a tornado in Texas, we will probably never know.


The world is full of connections that are very real, but that took some time to unravel. A familiar classic is the Tacoma Narrows Bridge which opened on July 1, 1940, in Pierce County, Washington. Construction workers noted how the bridge moved around on windy days, giving it the nickname “Galloping Gertie.” Engineers and consultants tried unsuccessfully to stop the motion until, on November 7, 1940, the structure collapsed in high winds. It was a decade later that the symbiotic connection between wind and bridge, now known as aeroelastic flutter, was established and the bridge was reopened.


If you are one of those people like me who sometimes plays music on your computer while working, don’t – that is, if your computer’s local files are stored on an ancient relic known as a hard drive. In 2005, a major manufacturer of HDDs for laptops noticed, in their testing lab, that Janet Jackson’s 1989 hit “Rhythm Nation” would crash the hard drive in the computer playing it. The song was so catchy that even nearby drives would sometimes fail as well. This connection was issued an official Denial Of Service identifier (CVE-2022-38392) by the U.S. government agency responsible for tracking security vulnerabilities. Ms. Jackson, the alleged hacker, was never charged.


In retrospect - considering all that physics stuff about sound, vibration, and resonant frequencies – the Rhythm Nation connection seems unsurprising and avoidable. After all, isn’t that the reason marching soldiers break cadence when crossing a bridge? But crashing a disk drive isn’t the only concern, and data center disk arrays are carefully engineered such that a frantic search for files on one will not cause data transfer interruptions or delays on adjacent drives. In 2009, Sun Microsystems engineer Brendan Gregg put together a video highlighting the dangers of a similar but little-known connection – yelling at the equipment. Note: this is a PSA for those network data professionals who occasionally shout and verbally threaten the hardware only to wonder why latency is spiking. You know who you are.


The famously inquisitive Leonardo da Vinci had this advice –


“Learn how to see. Realize that everything connects to everything else.”


Connections are everything for humans, machines, and combinations thereof. Discernment is key - not all humans, or computers, share your taste in music. Shouting at your human connections, or your data center hardware, can lead to poor performance or even catastrophic failure.


And perhaps most importantly, realize that not all connections are real – sometimes you are just flapping your wings.



Author Profile - Paul W. Smith - leader, educator, technologist, writer - has a lifelong interest in the countless ways that technology changes the course of our journey through life. In addition to being a regular contributor to NetworkDataPedia, he maintains the website Technology for the Journey and occasionally writes for Blogcritics. Paul has over 40 years of experience in research and advanced development for companies ranging from small startups to industry leaders. His other passion is teaching - he is a former Adjunct Professor of Mechanical Engineering at the Colorado School of Mines. Paul holds a doctorate in Applied Mechanics from the California Institute of Technology, as well as Bachelor’s and Master’s Degrees in Mechanical Engineering from the University of California, Santa Barbara.


Popular post