2

Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time moment when Wireshark capture buffer runs out of memory?

2
  • Which buffer are you talking about? a switch buffer can be full during normal operations. – JFL Sep 14 '16 at 6:07
  • Hey sorry for the ambiguity. Capture buffer refers to the Wireshark pcap buffer. – Danis Fermi Sep 14 '16 at 13:28
1

If you are capturing to memory only and stopping when the buffer runs out, then in the case of a broadcast storm the last frame time will be when the buffer ran out of memory. I'm not sure why you'd want to do this instead of capturing to disk.

3
  • Okay I'll try this and let you know if it works. I'm doing this to analyse the relation between time taken for broadcast storm and the type of the router. – Danis Fermi Sep 14 '16 at 14:23
  • @DanisFermi I use wireshark extensively, typically capturing using the command-line tool dumpcap and a rotating file buffer: dumpcap -i 1 -B 1000 -b filesize:100000 -b files:5000 -w "D:\cap" for example. This captures from interface 1 with a 1G RAM buffer but writes to a circular file buffer with up to 5000 files of 100M each (500GB total) files called D:\cap_000nn_<datetime>. – marctxk Sep 14 '16 at 14:37
  • Hey thanks a lot man. It worked exactly the way you said it will. – Danis Fermi Sep 14 '16 at 22:28
0

first of all lets clear something
1. memory here means what??
a. it should mean interface buffer
2. which interface ?
a. it can be your interface or any active device interface (switch for example)
if you need to monitor broadcast ,there will be two ways .the first is to monitor your PC interface itself which may be not efficient cause you may suffer from any malware attack cause your interface to be congested . the second is to configure you active device (the switch ) to spin copy of traffic to the port where you are connected to then try to monitor via wireshark . any way if you decided to use any of them you must get this before.

Broadcast
Any packet destined for all stations on a network segment is considered broadcast traffic. Broadcast addresses are usually used by ARP, DHCP, and other protocols that do some sort of discovery.
for Ethernet (and other 802.x networks)
Ethernet has designated the all-ones address (ff:ff:ff:ff:ff:ff) for broadcast traffic; this is used for other 802.x networks as well.
for IPv4
Similarly, the all-ones IP address (255.255.255.255) is broadcast. If the host portion of an IP address is all ones (e.g. if the address is 192.168.0.255 and the netmask is 255.255.255.0), that address is also a broadcast address. The broadcast IP address in the early days were 0.0.0.0, but was a long time ago, and zeroes are no longer used in the wildcard section of broadcast addresses.

so you easily can monitor the traffic destine to ff:ff:ff:ff:ff:ff or 192.168.0.255

other way is capture all the traffic came through your interface and then sort it by traffic size and this way is more proper to un-managed network. here you may need to setup the proper filter to capture this broadcast. Adding onto the capabilities of Wireshark to find top broadcasters (or multicast packets which can also affect network activity) the following can be done:

  1. Set up a new "capture filter" as such:

Filter Name: Broadcast and Multicast

Filter String: broadcast and multicast

  1. Select the "Show the capture options" toolbar button.

  2. Select the "Capture Filter" button and double click on the "Broadcast and Multicast" filter.

  3. Select "Start" and then go into "Statistics", "Conversations" and select the "IPv4" tab.

  4. Finally, sort the list by bytes and attempt to find the culprit when stuff happens.

2
  • Hey sorry for the ambiguity, but the memory here refers to the pcap capture buffer. And I will be monitoring the PC's interface since the experiment is being performed in a controlled environment and hence, I'm not worried about any malware. – Danis Fermi Sep 14 '16 at 14:26
  • ok ,lets follow the steps . also make use of this link is very useful – Gadeliow Sep 15 '16 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.