-1

I need to obtain statistics about the network traffic of an mpls link between two sites. The main purpose of this is detect the 'top flooders' at the end of the day and at precise moments when the network is 'overloaded'.

At this time i have a sniffer with Ubuntu and i'm using wireshark to capture packets. The built-in statistics are awesome, but i can only use them with not bigger files than 150mb (it hungs for memory leaks with bigger files). So i use them for precise moments to detect in 'live mode' any instant flooder. But its impossible for me to leave wireshark capturing traffic all day long because of the hungs.

What tools are better suited to use them for these purposes? (detect any 'instant' flooder and take statistics of top talkers and top conversations between computers for the entire day)

Thank you.

Knave
  • 57
  • 7

1 Answers1

0

Preliminary important note:

wireshark does not "hang for memory leaks with bigger files". The (very annoying) problem is that when opening a file, wireshark dissect it entirely from first to last packet before doing anything else and 1/ that can take a very very very long time and 2/ this imply that wireshark will have the entire file in memory e.g. the wireshark process will weight 1GB of memory for a 1GB trace (plus its own internal memory data of course), which may becomes a problem not only for wireshark but for the whole OS. Hence yes, it can become so unresponsive for so long that it looks like it's "hanged". Not a bug - rather a missing very complicated feature to dissect in "lazy" mode. The same goes with live capture, it dissect and put to relation everything (so that it knows and follow TCP dialog for instance) on the fly, and will hold the entire capture in memory. Which can quickly becomes quite heavy, both on memory and CPU.

And this will not the fixed implemented tomorrow, so now to your problem:

An option would be not to save to a file and latter process it, but doing it "live". You can do so using tshark (a terminal base version of wireshark) that will do the capture just like wireshark, and pipe its textual output to a dissecting/statistic analysis of your own.

https://www.wireshark.org/docs/man-pages/tshark.html

It has a -Y <displaY filter> option, so you should be able to use the MPLS filters from wireshark:

https://www.wireshark.org/docs/dfref/m/mpls.html

The -z <statistics> option will not be usable since it display the result after finishing reading the capture file, and you'll be piping live.

And tshark by default work in "one-pass analysis" mode, which of course limit a lot the analysis it can do, but alleviate the wireshark issue of "I want to dissect everything".[*]

So that would look like:

$ sudo tshark -i <your interface> -Y <your display filters> etc etc | your_parsing_and_statistical_tool

Of course, you'll have to write your own code for "your_parsing_and_statistical_tool". I'm not familiar with MPLS, nor know the statistics your interested in, but that may just be a couple of hours (or days) or Python coding? So if that's worth it for your job...

[*]: tshark also have an option -2 to perform a two-pass analysis, but that would not work here since the first-pass must be completed first, which will never occur since your not reading a file but capture and analyse live.

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
jbm
  • 3,063
  • 1
  • 16
  • 25
  • Thank you for your answer and sorry if i was wrong in my concepts. I'm quite new with Wireshark and I tried to express myself in the 'most understandable way' (or what i thought it was) =) – Knave Apr 26 '16 at 20:41
  • i thought that -maybe- there was a 'light capturing way' with Wireshark, one that saves only the packet headers for example... The fact is that I just have to take a look at ipv4 conversations, and check the top conversations ordered by Bytes. – Knave Apr 26 '16 at 20:55