L17
Capture placement, tcpdump and flow tools
Cram this first — memory hook
Wireshark = conversation detail; flow = phone-bill summary; iperf = timed capacity trial.
Exam trap
A busy link may make a mirrored capture incomplete. Missing captured packets must be interpreted with capture limitations in mind.
The slide facts
Captures can use port mirroring or a test access point. Flow monitoring uses exporter, collector and analyzer roles. Traffic-testing tools include iperf, Ttcp, BWPing, speed tests and Wireshark.
If you have time — extra
On a switched network, an ordinary laptop port does not automatically receive every other device's unicast traffic. Switched Port Analyzer (), also called port mirroring, copies selected traffic to an observation port. A Test Access Point () provides another way to observe a link; capabilities and failure behavior depend on whether it is passive/active and on its design. tcpdump can collect traffic without a graphical interface: -i selects an interface, -w writes a capture file, -r reads one, and -v increases detail. NetFlow and Internet Protocol Flow Information Export () summarize conversations: who contacted whom, when, using which ports/protocol, and how much data. They normally do not provide every packet's contents. An exporter creates records, a collector receives them and an analyzer interprets them. iperf measures achieved throughput between test endpoints; internet speed checks also include the path to their chosen test server. Ttcp is another throughput-testing tool named in the deck; BWPing is present but deprioritized under your no-ping instruction.
Walkthrough
Choose packet capture for message-level evidence, flow analysis for top talkers over time, interface monitoring for device/port health, or controlled throughput testing for achieved transfer performance.