Laura Chappell was the main shark trainer and star of the show at last week’s SHARKFEST. She runs the Protocol Analysis Institute along with Wireshark University . You can get her training in many ways including a massive collection of DVDs. We found her training both informative and entertaining. There were two tips she discussed that are worth passing on.
Watch the user
This is a point we have also preached for a long time. If you are called to an enterprise to figure out a performance problem, then it is imperative that you sit with and talk to a typical complaining user. Laura explained that most organizations want to keep you away from the complainers. We have actually seen instances where IT managers just do not talk to any users under any circumstances. They live in a technology ivory tower and have little to no interaction with real users. When the consultant arrives and asks to talk to the users, they often hear “you can’t talk to the users, we don’t even talk to the users”.
However, the best way to see the problem is to tap into a user’s Ethernet cable, watch what they are doing and take notes while Wireshark records a trace file. Later you can correlate events in the trace files with your observations and notes. This is the best and most direct way to see performance problems in the wild. Of course, if the problem is transient, then you may not see it while sitting with the user. However, you will learn enough about that user’s operations, desktop configuration, general conditions, and specific application procedures to get good context for the conditions surrounding the problem. You will at least discover facts that will eliminate many possible causes of the performance problem.
How to find a hub
You need an easy way to tap into the Ethernet traffic flow to capture packets for analysis. There are many ways to get access to the specific traffic flow you want to study – including connecting to a span port or mirror port on a switch along the way.
But the most valuable way to study a user complaint is to physically sit with the user and gather packets as you watch them in their native habitat. This way you can discuss the problem and see the user interact with the application while you capture packets. But you can’t get a fancy tap from the enterprise switch at the user’s desk. So here you need an old fashioned dumb hub. Just unplug the cable coming out of the wiring closet from the user’s PC and plug it into the hub. Then reconnect the user with an additional cable along with your own laptop into the hub. Now you can see all the traffic coming from and going to that PC.
But where can you get a hub? They are just not made anymore since even the cheapest consumer Ethernet boxes have become switches. Here’s a hint. You are likely to find old small hubs in your local schools. Laura’s solution to acquiring hubs is to donate new switches to the local public school, and then ask for the hubs during the upgrade. It’s a sort of friendly recycling program. If you need hubs, then the upcoming summer vacation is a perfect time to help your local school with that friendly upgrade.
