Learning how to use a protocol analyzer

Nutter offers advice and resources for a person who wants to get the most out of his protocol analyzer

After making several requests to get a protocol analyzer, we finally got the go-ahead to purchase one. I want to get the best results from the analyzer so the decision to buy it proves to be the right one. How can I do this?

 – Via the Internet

See if the company that makes your analyzer has training available. If the cost or availability is more than your company wants to spend, there are other options. A company I worked for for several years was fortunate to get expert Laura Chappell to come onsite for a day and a half.  That was more valuable than some of the training I could have attended because I saw practical uses of the various tools used in my daily environment. Since that may not be possible, the next best thing is to go to her site. You will see a collection of protocol traces and other goodies that can help you learn how to best use your analyzer.

The key thing to learn with an analyzer is what is normal for your network so you can better spot what isn’t right and work toward a solution. I’ve had an analyzer show me why a network was locking up every 15 to 20 minutes and in another case why a remote e-mail server was rejecting an e-mail when the mail server on the sending end was only reporting a communications problem. That kind of troubleshooting ability will come in time. While you’re working on getting that experience, look at https://project.honeynet.org/scans/index.html. This site has what are called Scans of the Month. You will find some of the scans involve the use of a protocol analyzer to read the provided trace files. You are given a set of questions that will involve going through the captured data to find the answers.

 Learning how to best use your analyzer is something that will come over time. See if there is a listserv either sponsored by the company that makes your analyzer or frequented by those who really know the product. Finding others near you who are using the same product will be a good source of information as well.