Simple Guide for analyzing web traffic for troubleshooting purposes

#troubleshoot #networking #trafficinspection #webtraffic

There are many tools out there that can help you to troubleshoot from free to paid tools which can help you identify where the problem is an help remediate, some examples are listed below:

Networking and traffic inspection tools:

Windows OS:

TCPView*
PsPing v2.1* *Important: from windows internals tools. Installation is required

Windows, Unix based, Mac OS:

WireShark
IPerf
Fiddler
Netstat
Nslookup
Solarwinds
Paessler (PRTG)
Much more

Every software and tool has its own pros and cons, and their selection will depend on scope, reason from troubleshooting and budget. In this article I will focus on a few of them that might help to get more concrete information where the problem is, whether you are in a cloud, hybrid and on-prem environment.

In one of my previous articles I discussed a little bit of the IPerf tool, which I believe is a great tool for testing connectivity and throughput between two points. Wireshark on the other hand I would say it is a network engineering tool par excellence, and there are many guides, documentation and videos that are super helpful so I decided that I will leave this tool out from my article for now. But I highly recommend using and getting familiar with both whether you are troubleshooting, learning concepts or only getting used to your service patterns, software or application's web traffic.
Before getting into the topic, I think is important to remind REST API codes (HTTP Status codes), so please review the reference below:

So in Summary, any 40X code is client problem, 50X code server problem, 30X redirections and 20X everything is alright :).

I've been trying different tools from paid to open source, in Linux and Windows environments. In this post, I decided to share some of the tools I've been using recently, which some use cases and examples.

PRGT:

While I was looking for a network traffic analyzer, I found Paessler, it was mentioned on most of the websites where tools are listed, and because I've never used it before I decided to try it.

It was convenient that they offer a trial option when you don't have a windows machine (which was my case), so having a sandbox was really easy and convenient in order to try it for the first time. Something t notice is that the downloadable version for Windows machine gives you a trial for 30 days in comparison with the hosted version which gives you 10 days.

Netstat:

This utility is largely used in Linux and Windows systems and will help you determine where the problem might be located or guide you through the troubleshooting process, some commands that I believe are good to keep under the sleeves are:

-netstat the simple command will show the transport protocol (Layer 4) state of the connection (ESTABLISHED, CLOSE_WAIT, FIN_WAIT, etc.) and foreign address

netstat –a –o –p tcp

-Other useful commands:

- 1. netstat –f –p tcp | findstr ESTABLISHED
- 2. netstat -na –o
- 4. netstat –a| findstr <_e.g. port number_>
- 5. netstat –a -o| findstr <_e.g.port number_>

where:
a => active connections
o => PID (Process ID)
p => protocol, ex. UDP, TCP.

TCPView

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections.
It gives us a graphical interface, easy to understand and manage lightweight, and also can help you to check UDP and TCP traffic