Spotting Packet Loss in Wireshark

Рет қаралды 13,526

Жыл бұрын

This video will show you how to detect packet loss between a client and a server using Wireshark. We'll cover how to spot packet loss visually but also how to quantify how many packets are lost.
Resources:
www.thousandeyes.com/blog/a-very-simple-model-for-tcp-throughput

Пікірлер: 33

@usakott 6 ай бұрын

Great video, thank you! Was looking for the next one for troubleshooting steps, hope its coming soon

@stevek6396 3 ай бұрын

Another awesome video. Thank you !!

@plaintextpackets 3 ай бұрын

Glad you enjoyed it!

@lookwht5760 7 ай бұрын

That's helpful, thanks a lot!

@grabasandwich 6 ай бұрын

I've been a cable guy for almost 20 years, and wish every customer had something running in their home to monitor their connection and keep detailed logs for guys like me to find a smoking 🔫 when I go to a trouble call for slow or intermittent internet. There are so many variables that even with all the tools the ISP gives us (actual tools and internal diagnostic sites) it's usually difficult to be sure the problem is fixed. Repeat truck rolls negatively affect our metrics, so anything to reduce those is a win for us AND the customer.

@plaintextpackets 6 ай бұрын

I totally get it. I’ve worked as a network analyst for a small company with a bunch of branch sites and had the same challenge. Now I work at the enterprise level but it’s the same problem just at a bigger scale.

@mtnsolutions 3 ай бұрын

don't know if it's sad or just telling that I learn more watching your videos that I did while preparing for CCNA and even well into the CCNP

@plaintextpackets 3 ай бұрын

That's more a comment on how bad Cisco certs and training have become lol, but thank you!

@mtnsolutions 3 ай бұрын

@@plaintextpackets I definitely felt as though the test was pretty gatekeepery. And I walked out with cert in hand wondering why they didn't teach us anything about voip.

@plaintextpackets 3 ай бұрын

@mtnsolutions that’s exactly it. It’s just obscurely difficult to make it hard but doesn’t really help you understand network better

@train4905 7 ай бұрын

Exellent😊

@kevinmelton3771 3 ай бұрын

Thank you for the very informative video. I have used the technique you have discribed to analyze some packet captures i took using Cisco EPC. I have an extensive amount of packet loss from a client workstation to a server across an MPLS network. the packet loss is usually between 1.7 and 3.4%. We have compaints from our users connecting to that server that they drop their connection several times a day, which is why i started capturing the data. The main issue i am having is only seeing traffic in a unidirectional fashion. I always see the client workstation on the left and the server host on the right. i have manipulated the words on the EPC filter on the cisco switch from in , out, and both.. but it does not change anyting. Would you be able to comment 0n why i only see 1 way traffic in the trace file? Thank you!

@plaintextpackets 3 ай бұрын

If you can join the discord we can start a tread and share notes, would be happy to help

@simaobonvalot9141 6 ай бұрын

Hi, thanks for the video. What if I want to know my packet loss for UDP protocol ? Is it possible to know many were lost/dropped during the transmission ?

@plaintextpackets 6 ай бұрын

It depends on the UDP protocol. Some protocols like RTP have sequence numbers shown in plaintext. So even though there aren’t retransmissions of packets you can find gaps in the numbers. Another method is for UDP streams that should have a constant bitrate (like a webcam stream). You can graph the I/o rate in wireshark to look for dips in the bitrate

@daddyegaming 6 ай бұрын

Hello, if this was a SIP call, what layer should I be looking? TCP or UDP? Thank you!

@plaintextpackets 6 ай бұрын

SIP itself could be TCP or UDP, but then the audio stream will use a UDP protocol like RTP. This video focuses on TCP but there are other methods for spotting packet loss in UDP streams

@plaintextpackets 5 ай бұрын

Just posted a video on this!

@daddyegaming 5 ай бұрын

Thank you! Checking now @@plaintextpackets

@LokiEML 4 ай бұрын

So i have an packet loss in a game called valorant up to 45% looking at it with the game stats its mostly incoming up to 95% and outgoing up to 5% my internet company and the val support cant find what causing this

@plaintextpackets 4 ай бұрын

Are you on wifi or connected to your router via ethernet cable? If on wifi I would first test with an ethernet cable and see if it gets better (home wifi is notoriously bad). If it's still bad I would take a wide-open capture (kzfaq.info/get/bejne/ra9ipMmAm5fNdqs.html) and then look for packet loss. Feel free to join the discord to continue troubleshooting: discord.gg/4XE5jSGb

@samitpiku 4 ай бұрын

why divide the drop packets with 1400 ? is it the maximum segment size ?

@plaintextpackets 4 ай бұрын

What timestamp are you seeing 1400?

@samitpiku 4 ай бұрын

@@plaintextpackets ok got it.

@decipleofWu 2 ай бұрын

12:01 1418 is the total packets sent between the client and server. The 1400 was just that number rounded down so it would be easier to get a rough estimate of the % packet loss. 113/1418 would still give about 8% (0.079)

@Foxtrot1967 6 ай бұрын

HI, Can I hire you to take a look at my capture to troubleshoot LAN issues?

@plaintextpackets 6 ай бұрын

I wouldn’t mind looking at it pro bono, is it posted somewhere?

@Foxtrot1967 6 ай бұрын

@@plaintextpackets Hello! That would be fantastic. Basically, I'm curious if there are rouge DHCP servers or LAN issues that can be fixed to provide better overall network performace and reliabilty. How long of a capture would you like? 1 min, 5 mins, ? I can upload the file to Google Drive.

@plaintextpackets 6 ай бұрын

5 mins would be good to start, you can email the link to plaintextpackets@gmail.com

@plaintextpackets 5 ай бұрын

@foxtrot1967 I just setup Dropbox as well if you'd like to submit that way