One of the most of basic, and powerful, is of course tcpdump. However, when you don’t have access to a desktop or can’t export a complete dump, working with the available tools may be your only option. It has no end of fancy GUI knobs click randomly long enough you are bound to find something noteworthy. Wireshark is the kind of tool that most administrator-types would have on their desktop. As a result, the tools are pretty universal. However, instead of an OS written in assembly by virgin albino programmers, it’s usually a headless Linux distribution with a fancy web GUI. We’d like to think that those expensive “AcmeFoo Widget 5000” appliances use a custom built operating system. For example, when troubleshooting remote systems without a full desktop or limited privileges. Whilst Solarwinds have some excellent tools for network performance management, there will be occasions where they won’t be available. I’ll focus on troubleshooting but no doubt we’ll wander into security and performance as well. This time I thought I would dust off my old-timey packet analysis skills and share some practical applications. In my last series of blogs I talked about the use-cases for Deep Packet Analysis but conspicuous by it’s absence was a lack of real world applications. Well hello there, returning like a bad penny, I am here to talk again about Deep Packet Analysis.

Packet capture analysis