Protocol Analayzer Understanding..

Ok so i am new to using protocol analayzer i ahve a couple questsions for those that are expertise in it..

On which layer will will i be using to find whether information is being retransmitted ?

and

Which layer will i look to determine whether there is a routing problem ??

reason i ask this, is because i am trying to troubleshoot my network problem... between my current work area and our headquaters in a different city.. The data being transmitted from each other is taking twice as long as it usually did a week ago ? i was told to use a protocol analyzer to help further find the problem... well i am new to using analyzer so if anyone could help me answer these questions, would be greatly appreciated thanks..
Coupee36Asked:
Who is Participating?
 
vodkamilkshakeConnect With a Mentor Commented:
You should use Ethereal, its a free network analyzer. It can detect and display many anomalies regarding TCP traffic and it shows pretty user friendly messages too. As far as which layer to look at is concerned, pay attention to source and destination addresseses in physical layer, and the same in tcp layer. Just go around with it a little bit and you will find alot of useful information.
0
 
giltjrCommented:
Data retransmission can take place at many layers so the answer there is "It depends."

For routing problems, you don't need a protocol analyzer, you just need the ability to do traceroute (tracert in Windows) from source PC and the target PC.

What you want to look for in the the trace is the general packet flow between the two hosts.  You also need to know what protocol/application is being used to transmit the data.  Is it ftp, sftp, ftps, or SCP?

Even more generally typically you should see data going from the source to the target and ACK's everynow and then from the target to the source.  You want to look for delay's between the data and the ACK's.

0
 
giltjrConnect With a Mentor Commented:
Are you already using a analyzer?  If so which one?  If not you can use Ethereal as vodkamilkshake or its "replacement" Wireshark (http://www.wireshark.org)

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.