wire shark

leigh_boy · 22 Apr 2014 at 11:46

Hi guys im trying to trace an issue and im using wireshark, but i am failing to understand how to see the route it is taking throught the network.

any 1 able to explain.

DJMK4 · 22 Apr 2014 at 11:51

Wireshark is mainly for capturing and doing deep analysis of packets coming in to a specific interface or interfaces, it can tell you exactly what each packet is doing.

I am not sure how effective it would be or doing trace routes, other than source and destination address that show up on the captures.

leigh_boy · 22 Apr 2014 at 11:56

we have a network enginer in the US who uses it but i think he does it from the router side. basicaly it seems like the router drops packets but the connection never drops so i have a ping going out to 8.8.8.8 and i am seeing it live in wire shark but i dont see how to see how its getting out. maybe i am approaching it wrong.

visibleman · 22 Apr 2014 at 12:44

Sounds like you're wanting to find the route of the traffic, which case you want trace route.

Steveocee · 22 Apr 2014 at 12:52

Rather than a trace route try doing a pathping from CMD.
It's like a trace route but pings each hop 100 times in the process.

leigh_boy · 22 Apr 2014 at 13:30

i have done a tracert and a ping path.. il try it again when the line appeared to have droped.

thanks

leigh_boy · 22 Apr 2014 at 13:34

path ping cant seem to tell me the route its taking... just get * * * * i guess because it should work like this.

pc > switch > vllan> cisco ASA > cisco 2900 > dsl or mpls dependant on rules
and its all on different subnets

Steveocee · 22 Apr 2014 at 13:50

pathping should complete through but will occasionally have starred out hops if they are set to not respond to ping etc.

leigh_boy · 22 Apr 2014 at 13:57

Steveocee said:
pathping should complete through but will occasionally have starred out hops if they are set to not respond to ping etc.

ye thats the issues nothing in our network replys to ping including servers