Managing Multi-GBs in Wireshark

This summer I wrote a short paper on a process that I developed to support some analysis of 54GBs of pcap data captured using Wireshark.

Prior to the capture (lesson learned), it was never investigated whether or not Wireshark could support analysis of this quantity of data. The short answer is NO. Depending on your computer’s resources, when attempting to open any significantly sized pcap file (500MB) you will likely experience the dreadful out of memory error.

This obstacle created an opportunity. I have captured what I learned using Wireshark to process this large pcap files here. If you find this process remotely useful or if you have any questions, feel free to contact me.

"A Network-Usage Baseline, within this paper, is defined as a profile of the characteristics of a communication network within a particular window of usage. For example, these characteristics can include utilization, network applications, number of users, etc. These baselines can be used for forecasting and planning, as well as optimization and troubleshooting. This paper is used to document a methodology for creating network-usage baselines using Wireshark, its packaged toolsets (e.g. dumpcap.exe, tshark.exe), an advanced text editing tool and a common spreadsheet application. Notwithstanding Wireshark’s many capabilities, there are limitations when attempting to analyze extremely large capture files (GB+). The task of creating a baseline on modern, multi-user networks normally requires the manipulation and analysis of many very large, multi-GB data captures. This methodology was developed based on roughly 72 hours of captured data, at three distinct intersections in the network architecture. The resulting data equated to 52GBs of libpcap capture files. All of these files were captured using the tool dumpcap.exe, which accompanies the Wireshark installed. During the capturing, each packet was intentionally “snapped” at 50 bytes to minimize the size of the resulting capture files. To the author’s current knowledge, this “snapping” at 50 bytes does not impact the statistics being generated. The example charts at the end of this paper support this understanding..."

In the Beginning…

After many failed attempts, I am attempting to use this mode of communication once more. Fundamentally it is my belief that I am a terrible writer. This is due, in part, to many years of vehemently avoiding the art form. I have always despised writing. To overcome this obstacle, I decided earlier this year that it was time to write a book.

A book - why take on such a daunting task? If the task isn’t difficult then it probably isn’t very rewarding, I’ve never written a book and lastly, I have so much to share.

Now, after a couple of months working off-and-on on the book, the research is slowing me down and not granting me the necessary practice. So I will now use this blog to practice the art and hopefully, as a good citizen of the Internet, to share something useful.

I'm Sleepy

Things have been good, but this lack of sleep thing is killing.  Goal for the next few weeks, attempt to go to sleep earlier and get up at the same time.

Graduation Has Arrived

Well, I have finally graduated with my MBA.  It has taken about 5 1/2 years.  Not much to say except, about time!!!

Long Time No Blog

The wife's grandmother was buried today. It was a surreal day. It just didn't seem real. This getting older thing is sortof depressing.

Are you alone?

The sadness of dying

I just heard that one of Stephanie's uncles, who has bone cancer, just went into the hospital and will not be leaving. Just the thought of that sounds so utterly depressing. Is that where we end up prior to death - the hospital? And we won't be coming home?

I have no idea what he is feeling. I don't know him very well. I pray the Lord lessens his suffering.

I hate bad moods

We'll I am gradually recovering from a bad mood. I am not sure what brought it on, but it was obvious. It is sad that I allow myself to get to that point. Rationally, I know that there is no point in it, but it feels good sometimes. Then I feel disappointed in myself after I am over the mood.

I hate it when I snap at the wife and shouldn't permit myself to do that just because I am ticked off at something. You want to know what I allowed to anger me? Do you?

Good Ol' Georgia Red Clay

It stains everything!!!

Is it ok to be strange?

To be strange in some eyes is a virtue. Some of the most intelligent and admired people (e.g. Einstein, Edison) were considered eccentric, odd, or strange. Why? Was it because they were strange? Who has the monopoly on that definition? No one. Is it wrong for you to think someone is strange? No. Its human nature to critique those different from you - its a defense mechanism.

Is it wrong to treat someone differently because you assess them as strange? Maybe. Do we consider murderers strange? Yes. Why? Because it is common for almost all people to preserve human life, not destroy it.

Strange is yet again something relative to perspective. What is strange to you might not be strange to someone else. To me it seems that everyone hungers to be different (or strange) than everyone else around them, while at the same time being accepted. The utter selfishness in humans drives us to want to stand out and be seen as unique. The guys in highschool wanted to be different tried to do everything to separate themselves from "in-crowd" and ended up finding safety amongst another group with a similar perspective (don't get started on the in-crowd - that'll be another post).

To be different you must take risks. With the risk can come pain, sadness, and loneliness. Most people are scared to be alone (again, another defense mechanism) because we are designed to depend on each other.

Is there any gain in being strange? I don't know. Probably. Maybe to be temporarily odd, without anyone knowing, some feel freedom. In some cases people just want the attention (hmm, maybe that's me). The most amazing thing about people that I see as strange, odd or different is that they challenge me to see the world from new eyes. In closing, I would like to say...

People fly kites to smell rainbows on hot summer asphalt

(Deep thoughts brought to you by NOBODYCARES)

NOTE: Everything is spelled correctly. More to come.

What is the significance of spelling words correctly?

Ok, so I conseed I suck at spealling. I find it a waste of time. I no, its incorract, and some peeple find it rude. I don't know. To me its important to communicate the message, write? However, does spelling effect that? Maybe it does. Granded, you can eaisly create ambiguities that convay a different message, but generrally, it doesn't madder. Furthermore, I would contend that if I didn't bother with spealling everything correcly, I would probly save enough thyme to mispell more wordz. So, for now on, I declair that I will misspell as often as possible on this blog whenever I get a chance. And for all of you "ENGLISH" types, just let goe of your mind, open the doors to the message being communicated, and welcome the freedom. The school days are over, the real world uses money, the not correctly spealled words. Soon, I will only comunicat through pictures. Soon I tell you soon.

A great mom and a random rant

The wife is an awesome mom. Tumbleweed and I have been blessed. And she is learning how to cook - that's a real plus. I know, I know. Short with words. Its strange, I don't really have anything to say when its just me writing. Now, commenting on some else's blog - yeah I can do that. I don't know, maybe I ate paint chips as a kid. Gosh, what freakin idiot, gosh. I think I am going to go build a cake.

I breathe and write nothing as my first blog...