SharkFest ‘16 Europe · 2017-04-26 · SharkFest ’16 Europe • Arnhem, Netherlands • October...
18
SharkFest ‘16 Europe #sf16eu Top 5 False Positives Jasper Bongertz Wednesday, October 19th, 2016 Trace Wrangler | Packet-Foo
Transcript of SharkFest ‘16 Europe · 2017-04-26 · SharkFest ’16 Europe • Arnhem, Netherlands • October...
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
SharkFest ‘16 Europe
#sf16eu
Top 5 False Positives
Jasper Bongertz
Wednesday, October 19th, 2016
Trace Wrangler | Packet-Foo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Before we start…
• Packet-Foo Network Analysis blog: https://blog.packet-foo.com
• TraceWrangler Website: https://www.tracewrangler.com
• My Wireshark color profile:
https://goo.gl/hsoIKp
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Agenda
1. Negative Delta Times
2. Frame size and checksum problems
3. Retransmissions and Duplicate ACKs
4. Zero Window
5. Retransmission cost
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
1. Negative Delta Times
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
1 - Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
2. Frame size & checksum problems
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
2 - Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 2 explained
The offloading effect
Application
Operating System
NIC driver
Application
Operating System
NIC driver
Dum
pcap
Sender Receiver
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
3. Retransmissions & Duplicate ACKs
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
3 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (1/3)
Mirror
Port Monitor
Port
SPAN with a single port
mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (2/3)
Mirror
Port Monitor
Port
Mirror
Port
SPAN with two ports mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
False Positive 3 explained (3/3)
Mirror
Port Monitor
Port
Mirror
Port
SPAN with two ports mirrored
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
4. Zero Window
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
4 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
5. Retransmission cost
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
5 – Wireshark Demo
SharkFest ’16 Europe • Arnhem, Netherlands • October 17-19, 2016 • #sf16eu
Q&A Mail: [email protected]
Web: blog.packet-foo.com
Twitter: @packetjay
