Monitor Network Traffic

[crussellp]

Hello,

I would like to first say that it is amazing to see a site like this that has such a wealth of information and direction from industry professionals. Love it!!

I run a Polycom MGC100 Plus with 6 PRIs and a large bandwidth internet connection on the ORION network. This is at a mojor Canadian University that has its own "In House" network security department.

For the past two years or so I have noticed periodic burps and hic-ups in H323 calls. It looks like a bandwidth issue. Hard to say definitively.

We have frequently contacted our network department when these things happen and they invariably say that there are no identifiable problems that they can see on the network. They have finaly advised me to use a packet sniffer to watch the bridges IP and see what is happening during these odd lag times.

Problem I have is I have no idea how to monitor the bridges IP using these things. I have only been able to in the past monitor the IP of the PC that the packet sniffer is installed on...

I have been told that I should us WireShark. I did set it up with a filter specifying the bridges IP. Nothing ever showed up even while having the bridge loaded with 15+ H323 calls @768.

What am I doing wrong?

[sjuris]

I had a similar issue, but with much less traffic...

This article explains your problem pretty well, since its a switch and not a hub each port only sees the traffic destined for it...

Setup a PC with Wireshark on a dedicated port on the LAN switch
Then use a SPAN (Cisco) or port Mirror command to have the switch copy traffic from specific port(s) or the entire LAN to that port...

The problem is that you will see A LOT of packets, did I say A LOT, I mean A S_itload...... especially in an H.323 setup with a MGC...

I think you can easily capture the data but the volume will quickly overrun your ability to make sense of it, unless you are very adept at filters in wireshark.... I see wireshark for deep level protocol debugging or single workstation tracing.

http://articles.techrepublic.com.com/5100-1035-6153401.html

There may be better tools out there, I like the Look@LAN product its free and gives you some good info...... google it and download it, its free...

What ever software you end up with I think a good start is to setup a dedicated Net Analizer workstation.

Good luck and let us know if the find the problem

SCJ