This is our old Q&A Site. Please post any new questions and answers at

Would it be beneficial to capture traffic before and after a Riverbed Steelhead appliance?

Is there any tips anyone can provide when reading packets from one of these appliances?


asked 02 Mar '11, 09:39

scottmildy's gravatar image

accept rate: 0%

scottmildy, are you trying to see how much RB will help or trying to figure out what the "secret sauce" is? Before I get into a long drawn out answer, I wanted to see what you were after.

(06 Mar '11, 09:06) hansangb

You might want to capture traffic before and after any appliance if you suspect that the device is responsible for problems in your network. I haven't encountered any Riverbed appliances so far, but I had my share of captures at other traffic management appliances that messed up some network packets really good. One example was a traffic shaper adjusting the TCP window size to ridiculous values that led to total communication breakdown between client and server.

So if you suspect any appliance to mess up packets you can capture on both sides of the appliance (if it's not a one armed device, otherwise you can only do one capture) and compare traces to see what happens. Comparing traces is a time consuming process, but if you know of a specific communication between two stations that has trouble and you know IP addresses and TCP ports you can find the TCP flows quite easily by looking for those, maybe including the initial TCP sequence number.

permanent link

answered 03 Mar '11, 02:31

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 02 Mar '11, 09:39

question was seen: 5,813 times

last updated: 06 Mar '11, 09:07

p​o​w​e​r​e​d by O​S​Q​A