Wireshark 101: Understanding High Latency; HakTip 136 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of pack tip is brought to
you by HipChat welcome to hack tip the
show where we break down concepts tools
and techniques for hackers gurus and IT
ninjas I'm Shannon Morse and today we
are checking out Wireshark and
understanding high latency issues we
have discussed high latency a little bit
my previous hack tip but I wanted to get
into a little bit more detail now as you
look at packets in a wireshark capture
you'll notice that with a normal
connection your transmission happens in
under a second and this is completely
normal now if I look at something like
the ones that are on my computer I did a
couple of packet captures and I found
some great examples online you will
notice that throughout all my different
packets they all happen in under a
second so this is totally normal right
okay cool now if you look at a few
packets with slow communication they
show up to be almost a second each now
that's not something that you would
normally find in most of your packet
captures now in my second example if we
look at all the different packets on
here most of them are just fine but
you'll see number two in number five are
almost a second each number five being
over a second now obviously that's not
good but we want to figure out what is
causing that slow connection or that
high latency now in this case this would
be called wire latency because the
slowness is happening on the wire not
the source or the destination now what
happens if the slow one happens to be an
HTTP GET request if I look at my third
example down here you'll notice that the
high latency is occurring over at that
gate get slash HTTP slash 1.1.1 now we
have discussed HTTP in a little bit in
the past on my hat tip so definitely
check out that that episode if you're
confused about what that protocol does
now in this case the only latent latency
is happening from the client and you'll
also notice that the source here is dot
one to eight the destination is dot 104
and it's HTTP so it's sending from the
client over to the destination so that
HTTP is happening on the client now
lastly let's say that there's a slow
pack
happening that that happens to be from
the server as an HTTP a packet now if I
look at an example of that we would
notice that it's the very very last
packet on here okay so that one is 0.9
seconds so that's pretty high too
we know that HTTP has to go through the
application layer and it does take some
processing the server must be having an
issue with processing that packet now
what does all this mean we're actually
going to be looking at something called
a network baseline right after the break
so stay tuned how is your team
communicating are they using a variety
of email texting I am cloud storage and
document sharing apps tip chat puts
everything in one place and is designed
specifically for businesses they let you
integrate I am video chat document
sharing screen sharing system updates
code sharing all integrated into one
simple platform emails to slow meetings
gets sidetracked and regular ions just
don't work well for groups HipChat keeps
your team in sync and it works from any
device no matter where you are they
integrate with top developer tools like
github JIRA Zendesk and more in fact
there's 57 services that HipChat will
play nice with if chat brings your
entire project and your team
communications together it's not so easy
to set up fun to use and makes your team
wildly productive I've been using hip
chat here in our offices to send Darren
code snippets for my stuff my Arduino
segments over on hack 5 there is a
freemium per ton which you can use for
free forever but for the next 30 days
you'll get the full version of HipChat
which includes the bonus features a
video and screen sharing
you can try hip chat for free no credit
card required visit HipChat comm / hack
tips signup click on start chatting
invite abuse team members and try it for
free for 30 days
remember HipChat comm / active but for
the first 100 signups hip chat is going
to extend their 30 day free trial offer
to 90 days HipChat your team your
project in sync instantly
and we're back with high latency issues
yay Wireshark so next next up is this
thing called a network baseline knowing
what your network baseline is is very
important figuring out a network issue
so a baseline is an understanding of
what your kind of latency your network
usually runs at and what you should
normally expect from your network if you
need a site baseline you'll probably
want to record normal protocols and use
broadcast traffic authentication
sequences and data transfer rates if
you're doing a hosts baseline for
whatever your host machine is record the
protocols the idle and busy traffic and
times startups and shutdowns
authentication sequences and
associations and dependencies also if
you're doing an application baseline for
some kind of different application you
would want to pay attention to protocols
startup and shutdown again associations
and dependencies and data transfer rates
now depending on how busy your network
might become for example a bank has
busiest hours during lunchtime at least
I did when I worked in a bank and it
dies off in late morning or whenever
they are closed obviously you might want
to make several baselines for different
times of the day keeping your baseline
secure of course that's very important
and making your own little peak app
Wireshark files of each is very very
important so that you have all that
research already done whenever a problem
does arise and you'll actually be able
to determine when something is actually
a problem as opposed to just normal
network traffic now of course let me
know what you think and if you have
created network baselines for your own
network send me a comment below or email
us tips at hack 5 org and be sure to
check out our sister show hack 5 for
more great stuff just like this I'll be
there guess what reminding you to to do
what that's right trust your Titan list
back
you