This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Anyone have any ideas on analyzing a purely IP based transfer? I'm analyzing a trace file supposedly of a low throughput for replication over the WAN. The trace only show IP with no TCP so I'm not sure what flags to look for. I believe the customer is using a Brocade storage router.

Screenshot

alt text

asked 18 Nov '12, 09:52

ws2006's gravatar image

ws2006
1121214
accept rate: 0%

edited 18 Nov '12, 14:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

1

The field Protocol in the IP header indicates the next protocol what does it say in your case?

(18 Nov '12, 10:55) Anders ♦

see screenshots

(18 Nov '12, 13:39) ws2006

I added your screenshot to the question, as it's easier to read that way

(18 Nov '12, 14:16) Kurt Knochner ♦

As the Protocol: field says, Wireshark interprets the IP protocol number 61 as SHIM6 header, that used to be the "old IP number" for SHIM6.

After checking the code...

The code for Wireshark 1.8.0 contains a definition for IP protocol 61:

IP_PROTO_SHIM6_OLD, "SHIM6 header" }, / 61 any host internal protocol [Internet_Assigned_Numbers_Authority] /

This leads to the following conclusion:

  • The IP protocol used (61) is something vendor specific and that's why you cannot dissect it with Wireshark, even with the latest version.

So, what can you do:

  • Ask the vendor about the protocol used and if they provide a Wireshark dissector plugin for that protocol or any other tool to analyze the protocol.
  • Analyzing the traffic with Wireshark might help a bit. You can still look at the throughput (see Statistics and IO Graphs), but that's basically it. Without insight into the protocol, you will have a hard time to figure out the reason for the performance problems. After all, it could be the MPLS network itself or the local connection to the MPLS (local router / link).

Regards
Kurt

permanent link

answered 18 Nov '12, 14:20

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 18 Nov '12, 14:31

Thanks Kurt.

(18 Nov '12, 19:38) ws2006
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178

question asked: 18 Nov '12, 09:52

question was seen: 3,306 times

last updated: 18 Nov '12, 19:38

p​o​w​e​r​e​d by O​S​Q​A