Using Wireshark to track down broadcast storms

I’m going to be talking to someone to see about possibly working for them. It will probably be for free, but getting some job experience sounds good to me.

I recently got an Associate’s in Network Technology, and I have my CCNA, but it’s rare that I’ve used Wireshark (I do have it on my computer though).

OK, long story short, I talked to somebody at my college who said there’s a chance for gaining work experience and it involved using Wireshark. I gave my contact info, and he gave it to the person looking for help. That person E-mailed me and said that he’s looking for some help in tracking down and controlling some broadcast storms on his network.

Because I don’t want to sound as clueless to him as I probably do to you guys :D, can you just give me some idea of what I’ll be expected to do and how I’ll be using Wireshark?

Thank you.

No idea re Wireshark but here’s an online intro course for $ 29.00 that might be of interest.

Wireshark has a pretty standard user interface so any packet sniffer you’ve used will let you quickly become familiarised with WS. What did you use in your training?

To track down a broadcast storm you have a few options.

One, you could look for the routing/switching loop that’s likely to be causing it. That depends on the topology and how they are using spanning tree, so I’m not going to detail that. You should have covered STP in your training so you’ll have a pretty good idea.

Second option is to sniff out the fault. In this scenario you’ll likely be plugging into various points of the core switches to see what traffic is flowing and whether you can derive any info on the source. If it is an STP loop causing the storm you should get some good clues from the sniff and/or the switch router logs.

If you have some specific questions then post back. Didn’t they do any network analysis on the CCNA?

t.

Yes, we did cover STP. And I’m pretty sure if it’s a loop as opposed to a DoS attack then it has to be switching, since routers break up broadcast domains.

OK, I think I’m getting the idea, thanks.

Sometime durring our CCNA courses we used Wireshark, but not for very long, and in my opinion it was poorly taught. The program didn’t seem to put very much importance in Wireshark, so neither did I. Basically we’d just capture some Web traffic, look at what it captured and go over the information a little. We never got too deep, and I don’t remember using it in any meaningful way in our assignments.

But anyway, I am familiar with it, and from what you told me, I have a good idea now of what to expect should I get chosen for the job. Thank you.

Money’s tight, but I book marked the site and will consider it. Thank you.