Create a baseline with Wireshark

Posted on 2011-10-14
Last Modified: 2012-05-12
Has anyone ideas on how to baseline a network with wireshark?

Span the port a workstation is on and then start capturing? Get the boot up, dhcp, start applications?

How about the network itself? With switches you only get broadcast and traffic to your computer.

How long should the capture last?

Do you need a capture for each model of workstation, laptop and server?

Question by:Dragon0x40
    LVL 21

    Accepted Solution

    To baseline a whole network, it would be best to span a primary link connecting to a core router.  That way, all traffic is captured.  If you do a capture on a desktop, then you'll only get traffic meant for that PC and only the VLAN's that the PC is communicating on.

    Author Comment

    Okay, so how do I use this baseline?

    Do I need to take one every day, week, etc.?

    How long should I capture the traffic for?

    I don't have huge amounts of disk space to play with and spanning on a core router would need authorization because of the possibility of an increased load or affecting traffic flow.

    Capture everything?
    LVL 21

    Assisted Solution

    With network captures, disk space is usually the issue.  I would try to capture a full 24 hours of data once a week, at least.  Then retain those captures for 6 months or 1 year, if disk space allows for it.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
    Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now