Тёмный

Troubleshooting a One-Way Performance Issue 

PacketBomb
Подписаться 6 тыс.
Просмотров 6 тыс.
50% 1

Here's a fun case study on troubleshooting a one-way performance issue. Of course, the root cause for every one-way performance issue won't be the same as this one, but it's a bit of experience to add to your bag.
It's very important when analyzing packets to take on the perspective of the host from which you captured the data. If it's the receiving side, then think like the receiver. If it's the sender side, then think like the sender. To do that and have it lead you to a root cause requires knowledge of what you should expect to see and just plain ol' experience. So keep at it.
Let me tell you, there was over an hour's worth of TCP goodness to talk about in this case study so I tried to focus only on the issue at hand to keep it to a reasonable time. I will be coming back to this case study to talk about TCP behavior in-depth in the future.
packetbomb.com/...

Опубликовано:

 

2 окт 2024

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 6   
@timothybrown697
@timothybrown697 7 лет назад
After sequence analysis by sorting on ACK#, For both server and client, the flow of SYNC# and ACK# were correct and agree with initialized numbers. Client correctly map and follow SYNC# and ACK sequence numbers with server. However, it failed to map or translate SACK SEQ# for the server. Instead, client was using SACK SEQ# in the range of 3839XXXXXX, while server was in the range of 1820XXXXXX. Client should deduct 2018746535 from SACK SEQ# to get correct reply/packet. I guess Code fixing on SACK for client would work and settle the issue. Thank you for the excellent video.
@Timon460
@Timon460 9 лет назад
Hi Kary! Could you make few videos on Kali Linux? Any pentests, MITM, exploitation of router vulnerabilities. Hope to see it from you.
@meetpiboogy3627
@meetpiboogy3627 8 лет назад
I discovered this issue as well but it took me a week, not 20 minutes ;) i am much more adept now. Thanks so much for taking the time to make this video.
@utubeacoount
@utubeacoount 8 лет назад
Awesome video.Keep them coming!!!😃
@meetpiboogy3627
@meetpiboogy3627 8 лет назад
Oh, how rude of me...I also found out why it was dropping those packets. I see you have a redhat linux server on one side. What I am sure is happening is that the linux box is dropping those packets at the IPtables but not from a written policy. The Kernel sees these packets as INVALID and makes a command decision. You can disable iptables for a test and it will work. The solution seems to be disabling seq number randomization on the cisco device (s)....
@HamzahAbusamak
@HamzahAbusamak 9 лет назад
looks like it's complicated to troubleshoot networks at packets level and it's matter of personal skills thus nobody going to teach you the exact how to gain the required skills to achieve something...