ETHERNET TECHNOLOGIES

Ethernet Technologies



Ethernet Technologies

Introduction

With the growing complexity of IP networks, it has become increasingly difficult to determine the source of network problems. Packet loss can occur due to any number of sources, from congestion to poorly written firewall rules or routing problems. It can sometimes be difficult to determine where in the network packets are lost, and system administrators often find it useful to view the traffic goes on the line. The following sections will explain the operation of a packet sniffer, the inadequacies of current packet-sniffing technologies, and the motivation for the E-Sniff project.Traditional network sniffing on an Ethernet network is fairly easy to set up. In a shared environment, an analysis workstation running Wireshark starts a new packet capture, which configures the card in promiscuous mode and waits until the desired amount of traffic has been captured (Charles, 2000).

In a switched environment, you need to configure a span port that mirrors the traffic sent to other stations, before initiating the packet capture. In both of these cases, it is easy to initiate a packet capture and start collecting traffic for analysis. When you switch to wireless analysis, however, the process of traffic sniffing becomes more complicated and requires additional decisions up front to best support the analysis you want to perform.

Interference and Collisions

Another challenge of sniffing wireless networks is the risk of interference and lost packets. Unlike an Ethernet network that can transmit and monitor the network simultaneously, wireless cards can only receive or transmit asynchronously. As a result, wireless networks must take special precautions to prevent multiple stations from transmitting at the same time (Jamie, 1992). While these collision-avoidance mechanisms work well, it is still possible to experience collisions between multiple transmitters on the same channel, or to experience collisions with wireless local area ...