Where should Ethereal be used? 1

[Isha321]

Hi everybody,
I am new to this forum. Hoping to get answer to my question. I work for an ISP and we do troubleshoot network connectivity issues. we never used any packet analyzers but i am curious to know if i have to use it for packet capture, do i need to have access for customer's workstation or can i run it at my side? At which side of network is Ethereal used? is it on CPE(cust premise) or DTE side? Thanks.

Isha

 

[LawnBoy]

You use Ethereal (now called WireShark) wherever the data you want to examine exists. Without knowing your topography I can't say where that is for you.

Say a user can't view your website, and the webserver logs don't show them even trying to connect. Obviously you can't sniff his traffic at the webserver (since it's not getting there), you'll have to sniff further upstream closer to the user, like maybe at your router. In this case it would probably be easiest to sniff at the client pc.

Also remember that if the traffic passes through a switch you will have to be on the same switch segment in order to sniff it.

Does that help at all?

 

[Isha321]

Hi, Thanks so much for the response.

Yes that helps but i have one more question. So as an ISP, how would i gain access to the client PC? Do i use Remote Desktop Connection for Windows, or SSH for UNIX etc or are there any other more efficient ways to login to client PCs? and do we assume that Client already has Ehereal installed on their machines? ....


Isha

 

[LawnBoy]

So as an ISP, how would i gain access to the client PC?

You'll have to ask whomever makes the policies at your company. As an ISP, do you have any responsibilities regarding the client pc? Depends on the level of service you offer. It'd be a rare thing to offer more than phone support to the user side. You can assume the user will not have Wireshark installed, as it is well beyond the average user's technical ability to use.

So the thing to do is to find the point where the user's traffic enters your network and sniff from there. If he can't get to you, it's his problem.

My example was based on more of a simple LAN topology (since that's what I do) and isn't a good match for what you're doing. Hopefully it does give you a better idea of how to use a packet sniffer.

 

[Isha321]

That helped very much, Thanks!

Actually we take assistance from the client's network admin to troubleshoot their side but in some instances its being difficult to trace the packet, so we just had this thought of using Ethereal. Thanks again.