1. Real World Packet Analysis Case Studies
Solving Real Problems for Real People

2. Packet A(nalysis)-Team
Helping strangers on the Internet via packetbomb.com

3. Before We Get Started Add delta column
Look at Statistics -> Conversations to identify connection of interest
Review 3-way handshake
iRTT
MSS
Window scale
Adjust columns / config as needed

4. iPerf Throughput Data center new 1G connection to AWS Low throughput
Help?
Show me dat pcap

5. iPerf T-put Takeaway Know the basics! iRTT, MSS, Window size
Think about behavior perspective
Client side vs server side
Know a little about expected application behavior
Have a baseline to compare to

6. Slow Web Page Local TV news station uploading stories to CMS
Intermittently slow to load
Click around until the issue happens, note time and URL
To the pcap!

7. Slow Web Page Takeaway Know protocol basics e.g. TTL, IP ID, TCP Seq
Look for visual changes while scrolling
Learn TCP sequence number analysis

8. Network Cameras
150 network cameras connect and upload data to a server
They also maintain a long lived connection
Sometimes they can’t connect and the long lived connection will die
Router and HAProxy in play
Let’s look at a pcap!

9. Cameras Takeaway If you feel overwhelmed, go SLOW
Do the IPs look as expected?
Do the TCP ports look as expected?
Do the TCP sequence numbers look as expected?
TTL? IP ID?
GO SLOW and verify

10. Q & A
Any questions?

11. Contact Fill out the survey! kary@packetbomb.com @packetbomb