using a network tap

I would like to use a network tap and some type of packet capture utility to analyze the traffic between my customers PC and their satelite modem. Can anyone give me a quick explaination of what to do?

Here is my problem. I install satellite internet access systems and sometimes the customers connection is slow. The system will work fine while connected to my laptop, but when I connect the system to my customers PC it is noticable slower. So then the customer gets upset and does not want to pay me for the install. I am trying to find a way to show the customer what is going on.

Quote:

---

I would like to use a network tap and some type of packet capture utility to analyze the traffic between my customers PC and their satelite modem.

---

I like etherape (Linux) for that kind of job. It gives you (and your clients) a visual of network traffic. I can't say I know of an equivalent app for Windows.

You might also consider some kind of clause or warning in your contract(s) that performance results may vary depending on the software installed on a client's PC. Many (if not most) Windows-based PC's are going to be infected with some kind of spyware or virus and these can easily inhibit network performance. Even regular apps can slow a PC.

I'm guessing you're in a rural or semi-rural area where folks are jumping from dial-up to satellite. The PC's I see still on a dial-up are typically badly-infected and without updates. An infected PC is going to be slow on a dial-up, and it's still going to be relatively slow on broadband.

If you're familiar with "msconfig", run that on a client's PC just to show them what's slowing things. Or try hijackthis. You might also consider a sideline cleaning up infected PC's.

Good luck...

Thanks for suggesting etherape. I am not well versed in Linux so I would like to find a windows app.

You described my situation perfectly. And the condition of my customers PC's. I dread call backs and learned early on that it is my best interest to never touch the customers PC. That way I don't get blamed for "doing something to their computer." I would rather just put the dish on the pole and leave.

always cover your a$$ man

ive learned working for geeksquad unless you are perfectly clear on what you are doing, what can happen, and what should happen...

being a PC tech, or a tech at all has a learning curve on how to handle the work enviornment

You could use Ethereal.


Its got a windows version to it. Just download it..let it install, make sure you let it install WinPCap as well...then fire it up, select your ethernet adapter, and it will capture all packets being sent to and from that specific PC.

http://www.ethereal.com/

sort of old news.. Ethreal is now known as WireShark

http://www.wireshark.org/

Quote:

---

Sniffing Problems A Mile Away
Same developers, same code, different name. The Ethereal network protocol analyzer has changed its name to Wireshark.

Wireshark's powerful features make it the tool of choice for network troubleshooting, protocol development, and education worldwide.

Wireshark was written by an international group of networking experts, and is an example of the power of open source. It runs on Windows, Linux, UNIX, and other platforms.

---

Guess I'm a little behind on that news. lol

I didn't think about it when I posted earlier, but linux is gonna be tough to config on a satellite connection. I worked on one once and it was pretty complicated on the PC/Windows side: an app for pulling data down from the satellite, a dialup internet connection for pushing data up onto the net. It wasn't very cut-n-dry as I recall.

You might put together a brochure or fact sheet explaining what goes on with PC's that don't get updated or scanned for viruses (and that you're not responsible for that). Maybe point customers to apps like Spybot and Ad-Aware. Earlier this year, I had a site contact ask me to come out to her house 40 miles out of town to fix her family's PC. I begged off because of the distance and the fact she was on a dialup connection (I didn't tell her the latter). Just told her to download Spybot, install and run it ("you can do it"), letting it remove EVERYTHING it finds. She called me back to say the computer was running much better.

You gotta tell people: maintaining PC's are a lot of work. Just for kicks, take a look at some folks' startups in msconfig sometime. It can be a nightmare.

The PC to satellite connection is much easier now. Once apon a time, there was some compression algorithms in the PC that combined the all the packets into one big satellite ready packet and transmitted it to the modem. Now it is just TCP/IP between the PC and modem and the packet conversion take place in the modem. The dial up part is long gone.

I got a quote from netoptics for one of their 10/100 aggregator taps and it was around $1000. Too much. The non-aggregator tap was only $390 and the home brew tap that snork details is almost free. No big deal. I can add another NIC to the laptop.

Can wireshark and/or ethereal deal with data from two NIC's or do I have to combine the packets before?

Depending on budget, the market you are in, and your expertise I would recommend either Ethereal/Wireshark (both the same) or Network General Sniffer Portable. Both you can put on a laptop and decode packets in real time, and both are very good. Sniffer Portable is not free as Wireshark is though, we pay well over $1K for our licenses.

The above are ideal for a market of home users. If you work in a corporate environment you would have to look at solutions that fit into the data centers. We do a lot of IDS/IPS and network monitoring so in our data centers we use 1ru 50 micron optical taps from a vendor known as NetOptics. We also use Gigamon Matrix switches that feed all captured data into a sniffer (Infinistream, Niksun, whatever.)

Like I said, it depends on your which market you are in, your budget, and your expertise.

But for just basic use for home customers Wireshark or Sniffer Portable outstanding.


--EOF

Just get a 4 port hub and plug the clients pc, the satelitte connection and the interface you are going to sniff with into the hub. Then use wireshark was previously mentioned to sniff the traffic. No need for network taps in this situation.

Wireshark's gonna be a lot of work. It's going to entail leaving a PC on your customer's network to monitor packets, then sorting thru those packets, and for what? Only to find out these people are infected with spyware and viruses? It's not worth it, IMHO.

If I had to do anything in your sit, I'd just get on their machine, run msconfig and pull up their startups and simply point out that there's a big part of their problem, and that there's hidden apps running beside those in all likelihood. Then, if need be, run msconfig on your own machine and compare them.

Quote:

---

Originally posted here by brokencrow
Wireshark's gonna be a lot of work.

---

Don't know what the big deal is:

Auditor

Fire it up run, it for MAYBE AN HOUR and deal with the results. Doesn't seem like much work to me (especially) when your getting paid. ;)

Cheers:

Fire it up Auditor, run it for MAYBE AN HOUR and deal with the results?

First, you're assuming sundep knows TCP/IP and how to use Wireshark. So we got a learning curve in there, drive times, and jawboning with the customer. That's gonna be more than an hour.

Second, you're assuming sundep's being paid on a callback. Likely the only reason he's doing a callback is so he gets paid for the original installation. He'll probably be lucky to get paid for following up on a complaint.

Third, you're assuming his customers will know what he's talking about when he gives them a breakdown of the network traffic. They aren't going to know what a .cap file is. I can almost guarantee most will think he's BS'ing them around.

Another thought, sundep: have your customers run an online AV scan like
Panda or Trendmicro. The online scans pick up most spyware and it demonstrably puts the onus on the customer.

I dread dealing with folks on dialups. I've had them insist they didn't need Windows updates because it's not on a broadband connection, therefore somehow immune. I've had them insist they were less vulnerable to viruses and spyware just because they're on a dialup. I appreciate that you need to demonstrate to some how compromised their PC's may be. No doubt, there's a lot of ways to do that, but the best way is to take it to their level.

Hey guys, Thanks for all the your help and ideas.

I do not know everthing about TCP/IP and I have never used Wireshark, but I am not afraid to learn or make an effort to try something new. I do like to spend my time wisely, so that is why I am on this forum. To find out what I should or should not do before I waste a lot of time trying. That is where all of you guys/gals and your experience helps. A big thank you to every one for sharing.

Brokenclaw,
One of the problems that I have with "those dialup people" is that they think that "I am BS'ing them around." The goal of this exercise to to find a way to show the customer that there is extra traffic on their connection. Okay, I will confess that I also want to play with some new gadgets.

I know that scanning for spyware and viruses and installing all of the updates would solve 99% of the problems, but I am just "the cable guy" and I do not want to turn into "the computer guy." Especially, not for joe homeowner. I do not even what to touch their computers. I am thinking that some basic scans should become part of the installation and that I should require the customer to perform the scans and updates before I turn on their connection.