As long as the network analyzer you use can save its packet traces in pcap format, they can be read by a wide variety of software, including Wireshark; thus, meaningful and comparable results could be obtained using other software.
If you’re capturing packets on a device that can’t run Wireshark - such as a remotely-accessible server in a co-location facility with no graphical user interface - you should consider the tcpdump program, which is a standard part of many Unix-like operating systems and is available at http://www.tcpdump.org/.
It is important to be aware that some network analyzers default to capturing only a portion of each packet.
Wireshark’s option to “Limit each packet to 68 bytes” in the screen capture above is (correctly) disabled by default, but the corresponding option in some other programs could be (wrongly) enabled by default.
To meaningfully compare the resulting packet traces, the packet size limit should be set to the largest possible value (usually 65535 bytes) or disabled entirely. For example, using the tcpdump utility, an appropriate command line would be tcpdump -v -s 0 -w packet-trace.pcap
Setting -s 0 sets the packet size limit to “unlimited” instead of tcpdump’s default of 68 bytes.
(When running tcpdump on a computer with multiple network interfaces, it may also be necessary to specify a network interface with the -i option.)
No comments:
Post a Comment