Packet sniffers?

I'm trying to figure out why my XBox Live performance is so horrible, since I always shut down all internet activities on the PC's before trying to connect.

I found out about packet sniffers today, and installed Wireshark.

With every thing that I know of (email, web, download managers, etc.) shut down, I still have tons of packet activity. Is that normal?

I have no idea how to make sense of what's going on, but there are many different IP's as the source, with the IP of my PC as the destination.

Reply to
Mitch
Loading thread data ...

Wireshark, formerly known as Ethereal, is a free and excellent protocol analyzer. I encourage anyone involved in networking to use this product. I should also mention that Microsoft Windows has a free network protocol analyzer available. In the downloads section of the Microsoft website, look for Network Monitor 3.0. This is the packet sniffer that can be installed to Windows XP.

Remember that a packet sniffer only shows data going through the switchport which you are connected to. If you are using an ethernet switch, you will not be able to see data going between other switchports. You need to be connected to a hub in order to see data from all ports. If your switch has a feature to allow a port to see all data on another port, then you can properly sniff another computer's traffic. Otherwise you need to put your sniffer software on the PC which is connected to the port that you want to monitor. If this is unclear, reference how an ethernet switch communicates unicast, multicast, and broadcast traffic for a more clear reason for sniffing complications.

There will be ethernet frame activity even if the hosts (PCs, Xbox, etc...) are not actively trying to make a connection. You need to be aware of what frames and packets are going across the network when the hosts are idle: - ARP resolves MAC addresses for IP addresses. Hosts will broadcast to determine the MAC address to send traffic to for certian IP addresses or determine the MAC address of their default gateway for IP addresses outside of their IP subnet. - DHCP traffic will exchange when hosts without a static IP address boot - DNS traffic will exchange - Cisco routers and switches, by default, will send Cisco Discovery Protocol (CDP) every minute - Cisco routers and switches may send loop packets to determine if loops exist and if interfaces are up - Ethernet switches supporting spanning-tree protocol will send bridge protocol data units (BPDU) every 2 seconds to check for other spanning-tree switches and ethernet loops - Microsoft PCs running NetBIOS processes will advertise for a browse master every so often and perform election processes Also, Microsoft Windows Update will run after Windows PCs boot. This is attempted even if the PC is not connected to the Internet because the computer checks for a connection after booting.

----- Scott Perry Indianpolis, IN

-----

Reply to
Scott Perry

Very helpful stuff. Thank you. Give me an internship where you work. :-)

Reply to
Mitch

You would have to live in the same city. Then again, there are no internships for IT/MIS where I work or in my past positions. Even if so, then you would be better searching CareerBuilder, Dice, and a few other sites for CCNP, not CCNA. Too often companies list CCNA for Microsoft server jobs - do not ask me why. Several companies around here are still looking for networking, specifically Cisco, and not all of them are involving voice systems. Yeah, Cisco networking and voice are the ticket right now.

----- Scott Perry Indianapolis, IN

-----

Reply to
Scott Perry

My house if for sale as we speak. :-)

I would love to get something where I could learn on-the-job, but I know that's a pipe dream these days.

Reply to
Mitch

Wireshark allow you to filter traffic based on destination and source mac address or IP address. Find out your XBox`s mac or IP address and filter these packets using source OR destination addresses (MAC or IP).

And you must use a hub to do that.

Regards,

Brunno Lopes

Reply to
bnlopes

Thanks. This stuff is more fascinating than I expected it to be. After reading about the OSI and TCP/IP, I have a whole new respect for what goes on when I click a link.

Reply to
Mitch

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.