Using Wireshark to determine bandwidth needs and top bandwidth users

Today I'll show a couple of tricks to determine bandwidth of a conversation between two hosts and a trick to help quickly determine top bandwidth users on a network. To do this, download and install the massively powerful free Network Protocol Analyzer, Wireshark.

First, we'll look at how to determine the average bandwidth between two hosts. I first came across the need for this information when I was tasked to plan a move of a department from one site to another. The users of this department need to use a specialized application hosted at the original site, but bandwidth may be an issue. To test, we bought one user's computer to the second site and had him log in and use the software. Even if the test is successful, we need to know the bandwidth impact of not just one user, but of the entire department (in this case, ten users). We needed to find this one user's usage, then we could multiply by the number of users and get an approximate average bandwidth need. To find this:

1. Open Wireshark.
2. Click on Capture, then Interfaces.
3. Your available network interfaces will appear. Find the interface you wish to monitor, then click Options.
4. The Capture Options window will appear. Since we're monitoring the communication between two hosts, we only want to see the traffic between the two. Type host {IP of one host} && host {IP of other host} next to the Capture Filter button. This feature is actually really powerful, allowing you to monitor just per port, per network, exclude hosts or port or networks, etc. For a good list of capture filter options, look at The Wireshark Wiki or this site: http://home.insight.rr.com/procana/.
5. It's a good idea to save your capture to a file. To set this up, enter a location and file name next to the File field.
6. Click the Start button to start your capture.
7. At this point you'll start seeing the packets being captured. Start running your tests.
8. After you're done testing, click Capture, then click Stop. Depending on the size of the capture, it may take a minute or two for the capture to fully stop.
9. Now, click Statistics and click Summary. The Wireshark:Summary window will appear.



Here is the summary of the communications between the two hosts. In my example, the Avg bytes/sec is 4555.791, or approx 4.6Kbps. This can help you determine your bandwidth needs for an application or will help you recognize if one client is taking up more bandwidth than it should. When determining bandwidth needs, you have to realize that this is the AVERAGE bytes per second, not the maximum. There may be certain times that the host could take exceed that, such as on an application open or save. With proper testing, such as taking measurements during each section of the test, you can verify if this is the case and can help you plan accordingly.

You can also use this method to determine if a client is taking up much more bandwidth than it should. If you can capture all communications on a network, such as mirroring your WAN (or Internet) port, you can find out what host is transmitting the most packets or the most bytes. To do this:

1. Start a capture like listed above, but skip the Capture Filter.
2. Once you feel that you have an adequately sized sample, stop the capture.
3. Click Statistics and choose Conversations.
4. I typically choose the IPv4 tab.
5. You can sort by Packets or by Bytes.



In my example, you can see that the top conversation between Address A and Address B has sent many more packets and many more Bytes than the next host. This can help you find out your biggest bandwidth users and will show you whom they are talking to. I've actually used this method to find out some of my bigger users of my Internet bandwidth and was able to determine that the biggest bandwidth hog was those users listening to streaming Internet radio, which gave justification for web filtering.

Wireshark is powerful tool as shown above, but it is much more powerful if utilized well. Also to note, Wireshark was previously known as Ethereal. When searching for more information, most Ethereal information should be applicable to Wireshark.

Awesome Utility: TestDisk

So, a family member brought me a laptop from a small business owner who he helps with computer issues. Well, the laptop is broke. It looks like it'll boot into Windows (XP Home) and then blue screens. Safe mode does the same thing. Although the BIOS will see the disk, the Windows install media doesn't. And of course the laptop's owner really needs the company data off of it, can't afford data recovery, and, of course, has no backups.

We pulled the drive out of the laptop and used a IDE to USB converter to hook it up to my laptop. Windows recognizes the disk and assigns it a drive letter, but took forever (like 10 minutes) before it showed up in My Computer. Attempting to access the drive via My Computer, command prompt, or even by Run (e:\) would error out. So I figured the disk is in some way corrupt and a third party recovery software was needed.

I tried several recovery softwares, but the one that eventually worked was TestDisk. TestDisk is OpenSource freeware designed specifically for drives with lost partitions or recovering data from non-bootable drives.

From thier website, TestDisk can:

* Fix partition table, recover deleted partition
* Recover FAT32 boot sector from its backup
* Rebuild FAT12/FAT16/FAT32 boot sector
* Fix FAT tables
* Rebuild NTFS boot sector
* Recover NTFS boot sector from its backup
* Fix MFT using MFT mirror
* Locate ext2/ext3 Backup SuperBlock

It can also run under DOS, Windows, Linux, BSD, MacOS, and SunOS and can handle MANY different file systems.

For my issue in particular, I did the following:

1. Hook the drive up your computer. I used an IDE to USB adapter, but I'm sure setting the drive into slave mode and installing it into a PC will work as well.
2. Allow Windows to find the drive (I'm not sure if this is necessary since Windows XP found the drive for me. It may work without Windows recognition).
3. Open TestDisk (did I mention that no install is required?).
4. It asks to create a log file, I chose Create.
5. Select the drive and choose Proceed.
6. Choose the partition table type. Since this drive was running Windows, I chose Intel.
7. Here's the meat of the software. I chose Advanced.
8. Choose your partition you want to analyze. Some drives have more than one partition; even if there's only one presented to Windows, some manufacturers have a Diagnostic or Restore partition.
9. The next option I chose is List.
10. This should list the files on the drive. Select the drive by using the Up or Down arrows. Enter will bring you into a folder. The Left arrow will bring you up a level in the folder tree.
11. Select the file or folder you want to recover and hit the C key to copy. It will present you with an option to choose the directory on the local machine (the machine you're running TestDisk from) where you want to copy the file to. Hit Enter with your choice.
12. After the copy is complete, the text "Copy done!" will appear in green text. You can now choose another file or directory to copy or hit the Q key to quit.

Also be aware that if you copy a large amount of data it will be fairly SLOW. Or at least slower than most people's standards. But you will have your data, so a little time should be no big deal.

Seriously, add TestDisk to your Admin toolbox immediately.

lol 1 year hiatus

Seems that I took EXACTLY one year off of this blog. Well, maybe it's time to get back into it.. possibly make it less of a link dump and more personal... We'll see.

Here's a great tool:

MX Lookup Tool.

Do MX Lookups, Diagnostics, and test your mail server against 147 RBLs.

Retina MS06-040 NetApi32 Scanner

eEye Digital Security Retina MS06-040 NetApi32 Scanner: "The Retina MS06-040 NetApi32 Scanner is being made available free of charge by eEye. The tool will scan multiple addresses at once to determine if any are vulnerable to the Server Service flaw reported in the Microsoft Bulletin MS06-040. If an IP address is found to be vulnerable, the Retina MS06-040 NetApi32 Scanner will flag that IP address.

This tool does not require administrative privileges on the scanned machines in order to determine if the systems are vulnerable."

Much props to Marc Maiffret, the Chief Hacking Officer at eEye Digital Security. I applaud his company's community involvement.. It's nice to see a company ask the community if they have a need for a product and then go out of their way to deliver, free of charge.

Ultimate boot CD

A Linux boot diagnostic CD that has many different anti virus,hard disk,networking,bios,system info, and benchmarking apps

read more | digg story

ISO Recorder v 2

ISO Recorder v 2: "ISO Recorder is a tool (power toy) for Windows XP, 2003 and now Windows Vista, that allows (depending on the Windows version) to burn CD and DVD images, copy disks, make images of the existing data CDs and DVDs and create ISO images from a content of a disk folder."

10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery)

A summary of the 10 best LiveCD distributions dealing with security (pen testing, forensics & recovery). With links to download and a little information about each one.

read more | digg story