Real World Packet Analysis Case Studies Solving Real Problems for Real People

Packet A(nalysis)-Team Helping strangers on the Internet via packetbomb.com

Before We Get Started Add delta column Look at Statistics -> Conversations to identify connection of interest Review 3-way handshake iRTT MSS Window scale Adjust columns / config as needed

iPerf Throughput Data center new 1G connection to AWS Low throughput Help? Show me dat pcap

iPerf T-put Takeaway Know the basics! iRTT, MSS, Window size Think about behavior perspective Client side vs server side Know a little about expected application behavior Have a baseline to compare to

Slow Web Page Local TV news station uploading stories to CMS Intermittently slow to load Click around until the issue happens, note time and URL To the pcap!

Slow Web Page Takeaway Know protocol basics e.g. TTL, IP ID, TCP Seq Look for visual changes while scrolling Learn TCP sequence number analysis

Network Cameras 150 network cameras connect and upload data to a server They also maintain a long lived connection Sometimes they can’t connect and the long lived connection will die Router and HAProxy in play Let’s look at a pcap!

Cameras Takeaway If you feel overwhelmed, go SLOW Do the IPs look as expected? Do the TCP ports look as expected? Do the TCP sequence numbers look as expected? TTL? IP ID? GO SLOW and verify

Q & A Any questions?

Contact Fill out the survey! kary@packetbomb.com @packetbomb