How can I use Wireshark to analyze the data coming into the network and to determine where the network is not supporting the required QoS? Also, how can I use Wireshark to tell when the QoS I/O queue is full (and any other information about the queue)? How are packets assigned to that queue? asked 13 Oct '11, 21:19  iti edited 16 Oct '11, 11:13  helloworld |
3 Answers:
Wireshark can't actually give you a direct view into what is going on in a network device like a router or switch. (So you can't see internal entities like queues or buffers or routing tables). It can only capture traffic as it passes a particular point in monitoring. However from that viewpoint, you can obviously infer a lot. The easiest way to think of it is to imagine you a standing on a bridge above an expressway, just before the crest of a hill so you can't see what is happening further down the road. If a traffic accident occurs further ahead you won't know for sure, but you might see traffic slowing down as it goes past. Or you might see ambulances coming back in the opposite direction. All of these things are indicators to what might be going on. Similarly with Wireshark you can see if packets are being slowed in the throughput rate (using the graphs or round trip times and the like) and you can also see things like DiffServ marks in packets, dropped packets (or at least ones that are missing), retries and so on. But as Jaap has intimated to be able to correctly understand what you are seeing (in terms of observed behaviour) you need to gain some experience or at least some grounding in knowledge, as to how network devices, hosts (and even black boxes) respond the conditions in the network. answered 17 Oct '11, 04:38  martyvis |
You'll need to look into some serious training here. Join Wireshark University to learn of network analysis. Get your CCNA / CCNP to get on your networking gear. answered 13 Oct '11, 23:34  Jaap ♦ |
Thanks frds, I'll try. answered 17 Oct '11, 04:56 iti |
Do Wireshark University provide job called WCNA after the exam?
Thanks for your suggestion....but I want to knw "how to do that instead of doing any training".
Dive into free online resources. Like the Wireshark Users Guide, or any other resources listed on the Learn Wireshark page. Then there's the Wiki, with a presentation overview. Furthermore there is the TCP/IP Guide. Enough to keep you busy for a while.