SharkFest ‘16 Europe #sf16eu Top 5 False Positives Jasper Bongertz Wednesday, October 19th, 2016 Trace Wrangler | Packet-Foo
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
SharkFest ‘16 Europe
#sf16eu
Top 5 False Positives
Jasper Bongertz
Wednesday, October 19th, 2016
Trace Wrangler | Packet-Foo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Before we start…
• Packet-Foo Network Analysis blog: https://blog.packet-foo.com
• TraceWrangler Website: https://www.tracewrangler.com
• My Wireshark color profile:
https://goo.gl/hsoIKp
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Agenda
1. Negative Delta Times
2. Frame size and checksum problems
3. Retransmissions and Duplicate ACKs
4. Zero Window
5. Retransmission cost
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
1. Negative Delta Times
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
1 - Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
2. Frame size & checksum problems
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
2 - Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 2 explained
The offloading effect
Application
Operating System
NIC driver
Application
Operating System
NIC driver
Dum
pcap
Sender Receiver
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
3. Retransmissions & Duplicate ACKs
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
3 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (1/3)
Mirror
Port Monitor
Port
SPAN with a single port
mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (2/3)
Mirror
Port Monitor
Port
Mirror
Port
SPAN with two ports mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (3/3)
Mirror
Port Monitor
Port
Mirror
Port
SPAN with two ports mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
4. Zero Window
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
4 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
5. Retransmission cost
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
5 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Q&A Mail: [email protected]
Web: blog.packet-foo.com
Twitter: @packetjay
Related Documents
![SharkFest ’19 Europe - ntop · #sf19eu • Palacio Estoril Hotel, Estoril, Portugal • Nov 4 - 8 From Monolith to Microservices [3/3] •If a microservice crashes, the rest of](https://static.cupdf.com/doc/110x72/5f6042848261da2b1265ddb5/sharkfest-a19-europe-ntop-sf19eu-a-palacio-estoril-hotel-estoril-portugal.jpg)
