(soft music)
- [Robert] We can analyze traffic
using a product like Wireshark
which is a free open source application.
So we can see here that I'm connected
to my EnGenius access point
and what I'm going to do is I'm going to open up Wireshark
and when you install Wireshark
make sure you choose to install the WLAN option
so that way it captures that wireless traffic.
The reason you would want to capture
and analyze wireless traffic
is so you can determine the IP addresses your wireless
is communicating with and on what ports.
The troubleshooting reasoning
for knowing this information
is that you can determine if your wireless card
is functioning properly
and also to see why it may be running so slowly compared
to other computers.
Take a look here is our Wi-Fi traffic.
If I double click on it
now we can see it running.
And it started automatically
I didn't even have to start it myself
but after a little while
what I'm going to want to do
is I'm going to want to stop it so I can analyze it.
And it's been running here for a little bit.
So I've chosen the red stop button
to stop the traffic from being monitored.
And here we can see a lot of different traffic.
Some is in blue, some is in pink.
So let's see what some of this means.
I am remoted in using a Remote Desktop
into this computer that's running wireless,
that's running Wireshark.
So we can see the source IP address of 1.21
is communicating with my host computer
which is 1.111.
And it's communicating on UDP 3389.
It's also doing this on TCP 3389.
So we see UDP traffic in blue
and we see TCP traffic
which is connection oriented traffic in pink.
And there's nothing more important here
than just letting you know
it's two different types of traffic.
When I highlight this UDP traffic
you can see it's coming in on port 3389
but then it's going out on port 53751.
And that's because typically you would want
to be able to have more than one computer
be able to communicate
and you can't do it on the same port
that another computer is communicating with.
Now in 3389 traffic
you can only have one computer connected at a time anyway
but the rule still stands.
You always want to redirect it
to a high level port say above 50,000
all the way up to 65,000
so that way you don't run
into any other computers that try to communicate
at that same port.
I can also see it's running a lot of TLS traffic
and that stands for Transport Layer Security.
And what's good about that is it means
that our stream between my computer
and the remote computer is being encrypted
because TLS is an encrypted service.
It's an advanced form of SLL or Secure Socket Layer.
Next what I'm going to do is I'm going to open up a web browser
and do some web browsing
just to see how that changes our capture.
So let's turn our capture back on again
and now it's capturing packets once again.
I'll go back into the web browser
and I'll just choose News
and it'll take us to this News site.
Now I'm going to minimize
and we should see some new traffic
besides just the 3389 traffic.
I'll pause that.
And here we can see the packet traffic going
to this public address on TCP
and we can see the acknowledgement
and everything looks good.
So how do we know if there's an actual problem
with any of the traffic in Wireshark
or we can apply a filter
and in the filter box at the top
you just go ahead and type in severity==error.
And if it sees any of those when you hit the enter key
then you're going to scroll through all the different errors.
When I hit enter, I get nothing
and that's because I have no errors.
So I just made sure that my wireless network traffic
my wireless network card, it does not have any problems.
So if I'm having slowness
it's not because I'm having a problem with the card itself.
However, if you see a lot of errors
it could be the network card.
It could be the site that you're trying to communicate with.
Maybe it's taking a bad path.
Maybe there's a DNS issue, lots of different things.
It doesn't necessarily mean
it's the wireless network card itself
but if you do see errors
it's going to point you in the right direction
to determine if this is a hardware problem
or DNS or some other issue.
Capturing wireless traffic
and searching for errors
can help you troubleshoot wireless problems quickly
to determine the source of the problem.
(upbeat music)