Monday, February 7, 2011

Using Network Monitor Captures in Wireshark

I'm a big fan of packet sniffing for troubleshooting. Just today I was trying to resolve a problem with a SharePoint site behaving inconsistently. Sometimes and only for some computers, the site would not open. After putting a packet sniffer on it, it appears to be a network problem as there are a lot of packets being resent and a lot of duplicate ACKs.

My two favorite programs for packet sniffing are both free:
  • Wireshark (open source)
  • Network Monitor (Microsoft)
Both of these packet sniffers are good, but each has difference strengths.

I was pleasantly surprised today to find out that if you save a capture in Network Monitor, that you can open it in Wireshark. This gives the ability to look at the same data in both tools. Sometimes the way one tool interprets or displays the data is easier to understand when you are looking at something specific.

1 comment:

  1. Hello all,

    Very good site you have created. I enjoyed reading this posting. I did want to publish a comment to tell you that the design of this site is very aesthetically delightful.