This week we attended SHARKFEST, the first conference for developers and users of the Wireshark open source protocol analyzer (formerly called Ethereal). Organized by CACE Technologies and Wireshark University, the conference was well attended by the cream of the network analyst crop. Wireshark is very popular, with conference organizers claiming it has surpassed the 300,000 download per month mark.
Many sessions were standing room only – particularly the practical “how to” sessions presented by Laura Chappell, who can make even the most complicated packet trace files interesting and fun to figure out. Sessions covered everything from protocol analysis 101 to advanced tips and hints – and attendees shared insights from the trenches about how to diagnose problems and get the most from Wireshark. Plans are already in the works to make this an annual event – stay tuned to the Wireshark community to lean more.
In the hands of a sophisticated protocol expert, Wireshark is indeed a useful tool – but we are struck by how using Wireshark is like using a sextant in a GPS world. Just as using a sextant to get your bearings requires years of practice, using Wireshark to puzzle out what’s happening in your network requires extensive protocol knowledge and experience. Today’s mariners use advanced GPS systems, and today’s network managers shouldn’t have to spend years mastering the nuances of low layer protocols. Wireshark simply is not sophisticated enough to meet the needs of most enterprises.
To illustrate Wireshark’s limitations, at SHARKFEST Sean Walberg described how to use Wireshark to troubleshoot VoIP problems. He explained how Wireshark’s packet timing capabilities can be used to capture VoIP signaling and estimate call quality latency, loss, and jitter metrics. We note that there are much more accurate latency, loss and jitter metrics already inside the RTCP packets, but Wireshark isn’t smart enough to decode them. Instead, it takes someone as skilled as Sean to craft the Wireshark data into a meaningful report.
Wireshark is designed for an individual contributor to troubleshoot problems by gathering information about low level protocol behavior. In the hands of a craftsman it is an excellent tool with many aids that help him or her – diagnose hard to find network problems. It’s a problem solving tool, not a problem prevention tool. Perhaps while troubleshooting a particular problem, a practitioner might also find evidence for other issues that should be addressed, but Wireshark does not lend itself to the ongoing performance monitoring and reporting needed to keep an enterprise out of trouble.
OK – so Wireshark is free. But after you factor in the years of experience required to make sense of Wireshark data, free doesn’t sound so good to your average enterprise. Add to that the fact that only a small cadre of network professionals has accumulated those years of experience, free sounds even less compelling. Something is missing from this picture.
The SHARKFAST conference was reminiscent of how protocol analysis was done about 15 years ago. Why has it not improved over that time? More on what is needed in a Wireshark-type tool in our next installment.
