CCIE Written Blueprint: 1.3.c Interpret packet capture

Thu 09 October 2014

This is a very short section! I didn't see the point in harping on about wireshark, I use it most days at work. And the IOS embedded packet capture was discussed in length further up the blueprint (i.e. in a previous blog post).

1.3.c Interpret packet capture

1.3.c (i) Using Wireshark trace analyzer

Packet capture can be obtained using a hub, or more commonly a SPAN / RSPAN port. Functionality includes filtering, tracing sessions, reassembling conversations, etc. Knowing the protocols, and therefore what to expect to see, is key. Actually using wireshark is a whole other video series!

1.3.c (ii) Using IOS embedded packet capture

As described above in 1.3.a (iii) Embedded packet capture. In my experience it is almost always better to save this as a PCAP, export and open in Wireshark. If needed, show monitor capture can provide the information.

Share this post

  • Share to Facebook
  • Share to Twitter
  • Share to Google+
  • Share to LinkedIn
  • Share by Email