48
“IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

“IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

  • Upload
    others

  • View
    3

  • Download
    0

Embed Size (px)

Citation preview

Page 1: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

“IP Network Troubleshooting“ Part 3

Wayne M. Pecena, CPBE, CBNE Texas A&M University

Educational Broadcast Services - KAMU

February 2016

Page 2: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Today’s Outline: Focused Upon Protocol Analysis with Wireshark

• Review of Wireshark Basics & How to Capture Network Traffic

• Creating Custom Wireshark Views

• Creating Custom Pre & Post Wireshark Filters

• Detailed Capture Analysis Examples

• Alternatives to Wireshark & Why Might These Might Be Considered

• Additional Useful Tools

• Takeaways, Questions, and Maybe Some Answers

2

Page 3: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Review of Wireshark Basics & How to Capture Network Traffic

3

Page 4: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Obtain & Install “Wireshark” • Available for Windows, Mac OSx, & Linux

• Download (current v2.0.1): www.wireshark.org

• Be Sure to Include Libraries: – WinPcap (Windows)

– Libpcap (Unix/Linux)

• Install

• Start Wireshark

• Select Interface

• Click “Start”

• CTRL+E will Stop

• You Have Created a PCAP File!

• View & Analyze Results

• Save For Later Analysis

Page 5: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Wireshark Host Requirements • Windows 10, 8, 7, Vista, Server 2016, Server 2012, Server 2008 R2, and Server 2008

• Apple OSx, Debian GNU/Linux, FreeBSD, Mandriva Linux, NetBSD, Red Hat Enterprise/Fedora Linux, and several others………..

• 64-bit AMD64/x86-64 or 32-bit x86 processor.

• 400 MB available RAM. Larger capture files require more RAM.

• 300 MB available disk space. Capture files require additional disk space.

• 1024×768 (1280×1024 or higher recommended) resolution / 16 bit color minimum.

• A supported Network Interface

5

Keep in Mind:

Capturing on a 100 Mbps network can produce hundreds of megabytes of capture data in a very short time. A fast processor, lots of memory and disk space is always a good idea.

Don’t Use Your

“Old” Retired PC

As an Wireshark Capture

Host

Page 6: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Captured

Packet(s)

Selected

Header

Data Decoded

Payload

Data

Decoded Hexadecimal & ASCII

Page 7: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

7

Application

Session

Presentation

Transport

Physical

Data Link

Network

Application

Session

Presentation

Transport

Physical

Data Link

Network

Physical

Data Link

Physical

Data Link

Physical

Data Link

Physical

Data Link

Physical

Data Link

Physical

Data Link

Network NetworkLayer 2

Device Layer 2

Device

Layer 3

Device

Page 8: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Encapsulation

8

Transport

Physical

Data Link

Network

7

5

6

4

1

2

3

Segments

Bits

Frames

Packets

OSI

Model

Protocol

Data

Unit

Data

Flow

Layers

Page 9: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Where to Tap?

• Problem Nature Often Determines: – At Problem Host

– At Destination Host

– Mid-Network Locations

• Accessibility May Also Drive Tap Point

Remember: Interfaces are Bi-Directional

Page 10: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

How to Tap Ethernet & Capture Packets • Can Be Challenging!

• How to Capture?

– UTP Ethernet:

• Physical Passive Tap

• Active Tap

– Optical Ethernet:

• Physical Passive Tap

• Active Tap

– Ethernet Switch Port Mirror

– Run Wireshark on Client Host if Possible

Page 11: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Active Tap Devices

UTP Taps

Optical Taps

Page 12: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Shared Media Approach 100 Mbps Maximum – Half-Duplex Only

12

HostDevice

A

HostDevice

B

Wireshark CaptureHost

EthernetHub

Commonplace In

Wireless Environment

It Was Simpler

In The Past

Half-Duplex Shared Media

Networks

Not Commonplace

Today

Page 13: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Switched Media Approach

13

HostDevice

A

HostDevice

B

Wireshark CaptureHost

EthernetSwitch

Normal Ethernet Switch Operation

Prevents Network Traffic Between

Host A and Host B To-Be-Seen

by the Wireshark Capture

Host

Page 14: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Switched Media “Hub” Approach

14

HostDevice

A

HostDevice

BEthernetSwitch

Wireshark CaptureHost

EthernetHub

Works, But Downgrading Network

To Half-Duplex

Ethernet Switch Now Sees 2-MAC Addresses (problem if switch-port security is enabled)

Page 15: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Switched Media “Tap” Approach

15

HostDevice

A

HostDevice

BEthernetSwitch

Wireshark CaptureHost

EthernetTap

?? Works, But Often Costly

Especially When GigE UTP

Or Optical Network Involved

Page 16: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Switched Media “Monitor Port” Approach

16

HostDevice

A

HostDevice

B

Wireshark CaptureHost

EthernetSwitch

Monitor Port Enabled

Monitor Port

Recommended

Approach

(where possible)

Page 17: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Keep In Mind!

17

HostDevice

A

HostDevice

B

Wireshark CaptureHost

EthernetSwitch

Monitor Port Enabled

Monitor Port

500 Mbps Network Traffic 500 Mbps Network Traffic

1000 Mbps Network Traffic

Limitations:

“Bad’ Frames Not “Mirrored”

No VLAN Tags Passed

Caution With RTP Network Traffic

Remember:

Tapping a Network

Can Be Challenging!

Page 18: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

HostA

HostB

Wireshark Host

Port 1

Port 14

Port 23

Cisco Ethernet Switch “SPAN Port”

Switched Port Analyzer (SPAN) Port

config t

monitor session 1 source interface fa0/1

monitor session 1 source interface fa0/23

monitor session 1 destination interface fa0/14

exit

Page 19: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

HostA

HostB

Wireshark Host

Port 1

Port 14

Port 23

HP Procurve Ethernet Switch “Port Mirror”

“Mirror” or “Monitor” Port

config

mirror-port 14

int 1, monitor (int 1-12, monitor)

int 23, monitor

show monitor

exit

HP Procurve 2915

Page 20: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Creating Custom Wireshark Views

20

Page 21: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

frame 192 selected

Header Details Displayed

Payload Data Decoded (hex & ASCII)

Page 22: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

22

View Screen Layouts

Page 23: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Default View Colors

23

Page 24: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

24

Customize Columns

Page 25: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Creating Custom Pre & Post Wireshark Filters

25

Page 26: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Filtering

• Capture Filters – Selectively Capture Packets

– Pre-Capture Configuration

– Minimizes Amount of Captured Data

• Display Filters – Applied When Viewing

– Allows Focusing on Attribute(s)

– All Data is Retained

• Which One to Use? – Reason for Capturing Dictates Proper Filter Use

– Use “Capture” Filter When You Know What You Are Looking For

– Remember: You Can’t Display What Has Not Been Captured!

Page 27: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Using “Capture” Filters

27

Page 28: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Useful “Capture” (pcap) Filter Examples

• ip

• tcp

• udp

• host 165.95.240.130

• host 165.95.240.128/26

• host 165.95.240.128 mask 255.255.255.192

• src net 165.95.240.128/26

• dst net 165.95.240.128/26

• port 80

• not broadcast and not multicast

28 http://www.tcpdump.org/manpages/pcap-filter.7.html

Page 29: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Using “Display” Filters

29

Page 31: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Detailed Capture Analysis Examples

31

Page 32: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

TCP 3-Way Handshake

32

SYN

SYN, ACK

ACK

Find the 1st SYN Packet: “Edit>Find Packet”

Enter “tcp.flags.syn==1”

Right Click on Packet – Select “Follow TCP Stream”

Page 33: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

ICMP Example

33

Page 34: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Streaming Media Example

34

Page 35: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Wireshark Statistics

35

Page 36: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Alternatives to Wireshark & Why Might These Might Be Considered

36

Page 37: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Fluke Networks “Clearsight”

37

Page 39: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Additional Useful Tools

39

Page 40: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

“zenmap” nmap security scanner GUI

40

https://nmap.org/zenmap/

Page 41: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Wireless Networks & Wireshark

• Wireless is challenging!

• Most 802.11 Network Adapters Do Not Support “Promiscuous” Mode

• If Promiscuous Mode is Available – You Only See Packets To-From the Host Running Wireshark!

• You Must Select RF Channel (Wireshark capture options)

• You Will Only See Packets on That RF Channel

• Extensively Use Capture Filters! Focus Upon a Specific Client

41

Page 42: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Takeaways, Questions, and Maybe Some Answers

42

Page 43: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Takeaway Points & Concepts: Parts 1-3

• Establish a “Structured” Troubleshooting Approach – Avoid “Shooting from the Hip” Approach(s)

• Use the OSI Model as a Guide to a Structured Approach – Work You Way Up the “IP Stack”

• Verify Layer 1 Physical Connectivity

• Verify Layer 2 Connectivity is Error Free

• Verify Layer 3 Inter-Networking

• Use Protocol Analysis to “See” Network activity

• 80% of Network Problems is Physical Infrastructure Based – Standards Not Properly Applied

– Guidelines Not Adhered To

– Don’t Loose Sight of 100m Ethernet UTP Segment Limit!

43

Page 44: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Takeaway Points & Concepts ……….

• Use Protocol Analysis to “See” Network Host Interaction”

• “Wireshark” Is The Most Popular Protocol Analyzer

• Understanding the OSI Model & TCP/IP Protocol Action is Key to Understanding Wireshark Results

• Understand How & Where to Capture Network Activity

• “Filtering” is Essential to Find the Needle in the Haystack – Capture Filters (minimize captured data)

– Display Filters (minimize displayed info)

• Customize Your Wireshark Views

• Verify Everything Yourself

• Caution Trusting What You Are Told!

44

Page 45: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

References – Further Study

https://wiki.wireshark.org/

https://www.wireshark.org/docs/wsug_html/

Page 46: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

46

Utilize a Structured Process to Troubleshooting!

Page 47: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

47

Page 48: “IP Network Troubleshooting“ · “IP Network Troubleshooting“ Part 3 Wayne M. Pecena, CPBE, CBNE Texas A&M University Educational Broadcast Services - KAMU February 2016

Thank You for Attending! Wayne M. Pecena Texas A&M University [email protected] 979.845.5662

48

? Questions ?