Network Analysis Using Wireshark 2 Cookbook - Second Edition

There's more...

There are many network problems that will simply pop up when using the conversations list.

In the Ethernet conversations statistics:

• Look for large numbers of broadcasts—you might be seeing a broadcast storm (a minor one; in a major one, you might not see anything)

What usually happens in a severe broadcast storm is that, due to thousands, or even tens of thousands, of packets/seconds sent received by Wireshark, the software simply stops showing us the data, and the screen freezes. Only when you disconnect Wireshark from the network will you see it.

• If you see a lot of traffic coming from a specific MAC address, look at the first part of it—this is the vendor ID that will give you a clue to the troublemaker

Even though ...