[Last Call] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1071
  • Last Modified:

Create a baseline with Wireshark

Has anyone ideas on how to baseline a network with wireshark?

Span the port a workstation is on and then start capturing? Get the boot up, dhcp, start applications?

How about the network itself? With switches you only get broadcast and traffic to your computer.

How long should the capture last?

Do you need a capture for each model of workstation, laptop and server?

  • 2
2 Solutions
To baseline a whole network, it would be best to span a primary link connecting to a core router.  That way, all traffic is captured.  If you do a capture on a desktop, then you'll only get traffic meant for that PC and only the VLAN's that the PC is communicating on.
Dragon0x40Author Commented:
Okay, so how do I use this baseline?

Do I need to take one every day, week, etc.?

How long should I capture the traffic for?

I don't have huge amounts of disk space to play with and spanning on a core router would need authorization because of the possibility of an increased load or affecting traffic flow.

Capture everything?
With network captures, disk space is usually the issue.  I would try to capture a full 24 hours of data once a week, at least.  Then retain those captures for 6 months or 1 year, if disk space allows for it.

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now