Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very short duration. Network snoop of the duration could have helped a lot to understand the behaviors of all nodes in that duration.

One approach I'm planning to take is monitoring SCTP Re-transmission using a network sniffer, tcpdump, ngrep, wireshark etc every 1-2 minutes dump 15-30 seconds of data in a file and check if re-transmissions are above a certain threshold then trigger above actions. Additionally, I would like to monitor any abnormal situations like higher re-transmissions, long delays, packet-drops etc and take a few measures before even things actually fail (may be I'm being too optimistic here)

one major problem with above approach this will run every few minutes, can't keep it running because it will also consume resources and may impact application performance or do we have sniffers with very low performance impact ? and fluctuation may occur when sniffer is not running.

Monitoring network and fluctuations sounds like a common problem other may have already worked upon, hoping to get some pointers to save some time :)

  • Removed the off-topic request for a recommendation.
    – Ron Maupin
    Oct 11, 2017 at 13:05
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19, 2018 at 19:43

2 Answers 2


You didn't say what kind of network this is running over (any tunnelling?) or what speed things are running at, but on the assumption it's not very high (relative to your equipment) ...

Consider using the monitor port of an ethernet switch and doing continuous sniffing on a standalone computer. This keeps your live system insulated from the investigation -- don't want to get too Heisenberg!

Running a continuous sniff for a long enough period is much better than snapshots.

Hope that helps

EDIT: wireshark has good explanations https://wiki.wireshark.org/CaptureSetup/Ethernet

  • Hi, apologies for delayed response. I would like to go with continuous sniffing on standalone machine as the last resort because it poses additional complexities e.g triggering actions on nodes running our software from the sniffer machine, also convincing customers to add a new box for sniffing would be a challenge.
    – amitp
    Oct 13, 2017 at 9:12

Consider using a hardware netwrork tap instead of a software tap. I can understand that it poses additional complexities and convincing your customers to add a new box for sniffing would be a challenge, but I think it would be worth it.

A network tap is a reliable and an efficient way to sniff traffic. Taps are passive splitting devices placed between two nodes in a network, therefore they don't introduce delay or alter the content or structure of the data.

Setting up the network tap is also not a complex task, all you need is a few wires and jacks, network interfaces and a standalone computer.

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.