Wireshark - capture data
From Zenitel Wiki
Sometimes it is useful for debugging purposes to analyze the data on the IP network. This article describes how to use the PC program Wireshark to capture data from the ethernet port of the AlphaCom.
In order to capture data you need the following equipment:
- A PC with Wireshark installed
- A network hub (or a managed switch)
Wireshark
Wireshark (formerly known as Ethereal) is a packet analyzer (also known as Ethernet sniffer) that can intercept and log traffic passing over the ethernet port. As data streams flow across the network, the sniffer captures each packet and eventually decodes and analyzes its content according.
Wireshark is freeware and can be downloaded from http://www.wireshark.org/.
Use network hub or switch?
A protocol analyzer connected to a switch does not always receive all the desired packets since the switch separates the ports into different segments. Connecting the protocol analyzer to a hub allows it to see all the traffic on the segment. Managed switches can be configured to allow one port to listen in on traffic from another ports. This is called port mirroring. However, these cost much more than a hub or an unmanaged switch.
- HUB - A network hub is a fairly unsophisticated broadcast device. Hubs do not manage any of the traffic that comes through them, and any packet entering any port is regenerated and broadcast out on all other ports. The availability of low-priced network switches has largely rendered hubs obsolete but they are still seen in older installations and more specialized applications. A hub can be used for network analysis.
- Unmanaged switches — These switches have no configuration interface or options. They are plug and play. They are typically the least expensive switches, found in home, SOHO, or small businesses. They can be desktop or rack mounted. This type of switches are not suitable for network analysis.
- Managed switches — These switches have one or more methods to modify the operation of the switch. They can be used for network analysis.
So to capture the data a HUB or a managed switch must be used, an unmanaged switch cannot be used.
How to capture data
- Download and install Wireshark on a PC
- Connect the hub between the AlphaCom and the IP network
- Connect the PC to the hub
- Start the Wireshark program
- From the menu in Wireshark select 'Capture -> Options..', and in the field 'Interface' select your network card
- Press 'Start' to start the capture. Now a smaller window opens showing the number of packets received.
- When you have finished the capture, press 'Stop'
- Save the captured data by selecting 'File -> Save As..'. Save the file with extension .cap. The file can be opened and the content analyzed on any PC having the Wireshark program installed
