Ramy Al Damati

Review a checklist of analysis tasks


Analysis tasks can be considered preventive or reactive. Preventive methods include base-lining network communications to learn the current status of the network and application performance. Preventive analysis can also be used to spot network problems before they are felt by the network users. For example, identifying the cause of packet loss before it becomes excessive and affects network communications helps avoid problems before they are even noticed.



Reactive analysis techniques are employed after a complaint about network performance has been reported or when network problems are suspected. Sadly, reactive analysis is more common.




The following are some of the analysis tasks that can be performed using Wireshark:

• Find the top talkers on the network.

• Identify the protocols and applications in use.

• Determine the average packets per second rate and bytes per second rate of an application or all network traffic on a link.

• List all hosts communicating.

• Learn the packet lengths used by a data transfer application.

• Recognize the most common connection problems.

• Spot delays between client requests due to slow processing.

• Locate misconfigured hosts.

• Detect network or host congestion that is slowing down file transfers.

• Identify asynchronous traffic prioritization.

• Graph HTTP flows to examine website referral rates.

• Identify unusual scanning traffic on the network.

• Quickly identify HTTP error responses indicating client and server problems.

• Quickly identify VoIP error responses indicating client, server or global errors.

• Build graphs to compare traffic behavior.

• Graph application throughput and compare with overall link traffic seen.

• Identify applications that do not encrypt traffic.

• Play back VoIP conversations to hear the effects of various network problems on network traffic.

• Perform passive operating system and application use detection.

• Spot unusual protocols and unrecognized port number usage on the network.

• Examine the start-up process of hosts and applications on the network.

• Identify average and unacceptable service response times (SRT).

• Graph intervals of periodic packet generation applications or protocols.

Networks vary greatly in the traffic they see. The number and type of network analysis tasks you can perform depends on your network traffic characteristics.