Nagios Conference 2014 - Gerald Combs - A Trillion Truths
-
Upload
nagios -
Category
Technology
-
view
184 -
download
2
description
Transcript of Nagios Conference 2014 - Gerald Combs - A Trillion Truths
![Page 2: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/2.jpg)
Why Am I Here?
Dunno. Ask Ethan.
![Page 3: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/3.jpg)
Nagios @ wireshark.org
![Page 4: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/4.jpg)
What's happening on your network?
![Page 5: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/5.jpg)
Nagios Is Paging Me
Is this the cause?
![Page 6: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/6.jpg)
Packet Analysis
![Page 7: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/7.jpg)
Wireshark is a Dissection Engine
![Page 8: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/8.jpg)
Wireshark is a Community
![Page 9: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/9.jpg)
Who uses it?Network engineer: Troubleshooting toolSecurity engineer: Forensics toolDeveloper: Debugging toolEducator: Teaching toolProtocol designer: Validation tool
![Page 10: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/10.jpg)
Open Source Business Models
Small? Use GitHub
Large? Get Google or IBM to give you piles of money
Medium? Uhhhh…
![Page 11: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/11.jpg)
Complementary Products
2006: CACE Technologies
2010:
![Page 12: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/12.jpg)
Finding Network Truths
![Page 13: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/13.jpg)
Your 5 Minute Average Is Full Of Lies
![Page 14: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/14.jpg)
14
Did the interval look like this…
![Page 15: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/15.jpg)
Copyright Riverbed Technology 15
…or this…
![Page 16: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/16.jpg)
16
…or this?
![Page 17: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/17.jpg)
17
Maybe this…
![Page 18: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/18.jpg)
18
…or this
![Page 19: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/19.jpg)
The Packets Never Lie
Different truths at different layers
What do you do with a trillion truths?
![Page 20: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/20.jpg)
Capturing At Zero Scale
1. Start tcpdump.2. Say "Try it now."3. Stop tcpudmp. scp the capture & analyze.
![Page 21: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/21.jpg)
21
Visibility You Want
Flows
Bits
NowDawn of Time
You'll have to make your own surveillance jokes. I have to go through a TSA checkpoint tomorrow.
![Page 22: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/22.jpg)
22
Visibility You Get
Flows
Bits
NowDawn of Time
![Page 23: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/23.jpg)
Retrospective Analysis
Cheap: Laptop or server running dumpcap or tcpdump
Fancy: Dedicated boxes
Time equals money. And disks. Time equals disks.
![Page 24: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/24.jpg)
Port Mirroring
Pros
Any1 switch does this…Just a config change…
Cons
…often poorly…requiring change control
1. Any switch you'd want to use in production.
![Page 25: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/25.jpg)
Taps
Pros
PassiveTime accuracyFilteringDuplication
Cons
CostExtra hardwareSometimes a switch
![Page 26: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/26.jpg)
VM Capture
Where do you want to kill performance today?
Jasper Bongertz:http://blog.packet-foo.com/2013/04/capturing-packets-of-vmware-machines/http://blog.packet-foo.com/2013/04/capturing-packets-of-vmware-machines-part-2/
![Page 27: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/27.jpg)
Cloud Capture
Like VM but with less control.
Back to tcpdump. Seriously?
![Page 28: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/28.jpg)
SDN, or Why Cloud Capture Annoys Me
Microsoft (Rich Groves): DEMonBig Switch: Big Tap
Distributed tap built on SDNScales to thousands of ports
![Page 29: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/29.jpg)
Using Wireshark For The First Time
http://en.wikipedia.org/wiki/File:Airbus_A380_cockpit.jpg
![Page 30: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/30.jpg)
Educational Resources
Wireshark Q&A · https://ask.wireshark.org/Laura Chappell · http://www.wiresharkbook.com/ Mailing lists · https://www.wireshark.org/lists/Sharkfest · http://sharkfest.wireshark.org/Bibliography · https://www.wireshark.org/bibliography.html
![Page 31: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/31.jpg)
More Educational Resources
Hansang Bae · http://www.riverbed.com/blogs/authors/Hansang-Bae.htmlMore Hansang · https://blog.wireshark.org/Tim O'Neill · http://www.lovemytool.com/Jasper Bongertz · http://blog.packet-foo.com/
![Page 32: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/32.jpg)
Latency – 2012
![Page 33: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/33.jpg)
Latency – 1996
![Page 34: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/34.jpg)
Latency – 1976
http://bitsavers.informatik.uni-stuttgart.de/pdf/xerox/ethernet/XeroxWireDraft_Dec1976.pdf
![Page 35: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/35.jpg)
…and yet…
![Page 36: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/36.jpg)
Wireshark Today
Large, vibrant ecosystemHundreds of authorsStatistics:
1500 protocols117k filter fields500k 1M downloads / month2M lines of codeRich web presence
Your network is not a black boxhttp://www.hanselman.com/blog/TheInternetIsNotABlackBoxLookInside.aspx
![Page 37: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/37.jpg)
What's Next?
![Page 38: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/38.jpg)
Challenges
To install on OS X you need a bucket and a screwdriverPacket analysis + tablet = sadness"The cloud" is not in the interface list400GBASE-OUCH-THAT-HURTSYou want process information? Too bad
![Page 39: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/39.jpg)
We made the news
![Page 40: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/40.jpg)
Demo Time
![Page 41: Nagios Conference 2014 - Gerald Combs - A Trillion Truths](https://reader034.fdocuments.net/reader034/viewer/2022051514/54932144b4795935518b4677/html5/thumbnails/41.jpg)