IC Knowledge Base

Wireshark Trace for Fault Finding

How do I perform a Wireshark trace?

If you have been asked to complete a wireshark trace this is because your reported fault needs further inspection from site, these are typically asked for when the report is call quality or transfer difficulties.

Requirements

  • Ethernet Hub or Port mirror capable switch
  • Wireshark installed on a decent computer with a large drive capacity that can see the phones

Hub

An unsophisticated device plugged into your existing network, in this case between phone and Internet connection.  As a hub does not intelligently switch or manage packets a pc plugged into the same hub can view everything passing through making monitoring 100%

If you do not already have a hub, one can be purchased for around £20 from online stores such as Misco, Dabs, Ebuyer or Maplin.

There has to be an element of downtime as the hub is connected into the network.

Port mirroring

To forward the copy of all in-bound and outbound traffic (packets) from one port (or multiple ports) to another port designated by an administrator, simultaneously without affecting the normal operation of a switch.  This is required for monitoring the network traffic, monitoring the performance of a switch and other applications.  

There are disadvantages, port mirroring can cause buffer overflow and dropped packets since all the packets go through a buffer in the switch.  So, accurate time sensitive measurements like jitter, packet gap analysis or latency measurement can become difficult.  Also, there is additional load imposed on the CPU of the switch affecting the operational performance of the switch.

It is known the Mikrotik devices, in partiular RB951 perform this function well.

Wireshark

The application Wireshark is a well known free support utility and available for download at Wireshark Download, you will need to select the most appropriate version for your computer.

When running all seen packets are dumped into a .pcap file which can then be saved and sent to administrators for inspection.  As all packets are dumped the saved file can become very large, below are instructions on how to configure for best practices.

Configuring Wireshark

To ensure the file is sent without issue and easily identifiable please follow below steps;

  1. Under the Capture Menu, select Options
  2. Select the Interface used, more than likely Ethernet
  3. Leave promiscuous mode on all interfaces checked
  4. Save the file as CustomerName_Date in a memorable location, where CustomerName is your business name and todays date.
  5. Tick Use Multiple Files and increase to 2 megabytes
  6. Stop capture after 2 hours, just in case forgotten to stop.  Removes accidental fill up of your hard disk, previous captures show 1MB per minute.
  7. Click Start

Perform test calls to simulate the issue

To stop the capture click the red square in the toolbar of Wireshark.

Submit troubleshooting files

Assuming you have successfully experienced the issue whilst Wireshark was running, you will need to send an email to support@ic.co.uk with the attached files

0 (0)
Article Rating (No Votes)
Rate this article
Attached Files
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Name
Email
Security Code Security Code
Related Articles RSS Feed
Compatible Routers and Firewalls - old for reference
Viewed 591 times since Tue, Jul 25, 2017
IPVS Auto Attendant Message Setup
Viewed 311 times since Wed, Dec 12, 2018
Modems Vs Routers
Viewed 776 times since Tue, Aug 22, 2017
Voicemail in IPVS
Viewed 686 times since Thu, Dec 14, 2017
I have a new ADSL Max service and am experiencing some short breaks and slow-downs in my connection. Why is this?
Viewed 686 times since Thu, Jul 27, 2017
Approved Equipment List v.36
Viewed 633 times since Tue, Jul 25, 2017
SIP Response Codes
Viewed 1047 times since Wed, Nov 15, 2017
No Internet Connection / Access
Viewed 788 times since Wed, Jul 26, 2017
Connectors
Viewed 1914 times since Tue, Jul 25, 2017
Out of office site intercept
Viewed 551 times since Tue, Dec 5, 2017
Internet Central Limited, Innovation Centre, Keele Science Park, Keele, Staffordshire ST5 5NB
Registered Office: Ivy House Foundry, Hanley, Stoke-on-Trent, ST1 3NR
Registered in England: Reg No. 03079542 VAT Reg No. GB 278 923 705
Contact Us |Terms & Conditions |Legal, Privacy and Cookies
All prices exclude VAT E.&O.E © 2015 Internet Central

All trademarks and logos appearing on the site are the property of their respective owners