Re: finding the smoking gun for traffic spikes

["David H. Lipman" <DLipman () Verizon Net>]

From: "Rogelio" <scubacuda () gmail com>

> On Sun, Jul 17, 2011 at 11:00 PM, Rogelio 
> <scubacuda () gmail com>
> wrote:
> > I've got several L2TP tunnels hitting a Cisco 7201 and am trying to
> > use Wireshark to determine what inside my tunnel responsible  queue
> > drops on one of interface responsible for the L2TP termination. I
> > inserted a Wireshark laptop in a hub between  the LAC and the LNS, and
> > I got a good 24 hour sniff of L2TP traffic.
>
> Looks like I've found a good clue!  Out of one big file (200 MB, about
> 38,000 seconds), I see that 336 / 528 MBs is "ip.dst ==
> 239.255.255.250" !

Universal Plug 'n Play (uPnP) traffic.



-- 
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp 



___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe