Software

Ask something
Question Locked

Reading a capture file

0 helpful
4 replies

by jiminpa

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Does anyone know of a place I can go to get a crash course on reading a TCP capture file? I am using a web app that keeps timing out. I ran Ethereel to try to see what is going on right around the timeout. I was looking at the file and I may as well be reading Chinese. Can anyone help?

4 replies

by robo_dev

Well for starters, begin to sort out a couple of things:

The source and the destination.
Then sort out the protocols.

In ethereal, http is purple. Click on the protocol column to show only http.

If you look at the http packets closely, you can see the http posts and gets...also note the time indicators on the left hand side....those are thousanths {sp?} of a second. If something is timing out, you will see the delta-time go into several seconds.

There is also a feature called 'follow tcp stream' which lets you see both sides of the conversation between your web server and your workstation web browser. Click on the first http packet that looks like a request from your browser, then choose follow TCP sstream.

I could not find any 'crash-course' but here is a start.

http://www.pcsupportadvisor.com/TCP_IP_tutorial_page1.htm

by jiminpa

That should at least get me enough information to extract what I need. You are a gentleman and a scholar!

by robo_dev

And have spent many hours at 'Sniffer University' (Network General Sniffer). Post any additonal questions....

This discussion is closed to new replies.