Create a baseline with Wireshark

Has anyone ideas on how to baseline a network with wireshark?

Span the port a workstation is on and then start capturing? Get the boot up, dhcp, start applications?

How about the network itself? With switches you only get broadcast and traffic to your computer.

How long should the capture last?

Do you need a capture for each model of workstation, laptop and server?

Who is Participating?
eeRootConnect With a Mentor Commented:
To baseline a whole network, it would be best to span a primary link connecting to a core router.  That way, all traffic is captured.  If you do a capture on a desktop, then you'll only get traffic meant for that PC and only the VLAN's that the PC is communicating on.
Dragon0x40Author Commented:
Okay, so how do I use this baseline?

Do I need to take one every day, week, etc.?

How long should I capture the traffic for?

I don't have huge amounts of disk space to play with and spanning on a core router would need authorization because of the possibility of an increased load or affecting traffic flow.

Capture everything?
eeRootConnect With a Mentor Commented:
With network captures, disk space is usually the issue.  I would try to capture a full 24 hours of data once a week, at least.  Then retain those captures for 6 months or 1 year, if disk space allows for it.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.