Tomi Engdahl’s ePanorama blog

Packet capture is one of the most fundamental and powerful ways to do network analysis.

If you think that tcpdump has been made obsolete by GUI tools like Wireshark, think again. Wireshark is a great application; it’s just not the right tool for the job in every situation.

tcpdump uses a “one-off-command” approach that lends itself to quick, on-the-spot answers. You can run it through an SSH session, doesn’t need X and is more likely to be there when you need it. And, because tcpdump uses standard command-line conventions (such as writing to STDOUT, which can be redirected), tcpdump can be used in all sorts of creative, interesting and extremely useful ways.

You can even use tcpdump and Wireshark together by capturing the network data with tcpdump for viewing with Wireshark. To ensure that you capture complete packets, use the following command:

tcpdump -i <interface> -s 65535 -w <some-file>

tcpdump fu article introduces some of the basics of packet capture and provide a breakdown of tcpdump syntax and usage. Manual page of tcpdump lists you all the command line options you can use.

If you are embedded Linux system developer, remember that you can easily fit the tcpdump program inside a small embedded Linux system without too much problem (which is not the case with Wireshark, because it is a huge program that needs GUI and has many dependencies).

There are many cases when need to emulate various networking conditions and scenarios. Usually the most practical way to test the application on different networking conditions is to use some kind of WAN emulator that lets you control the various networking characteristics. WANem is a free WAN emulator suitable for this task. WANem allows the application development team to setup a transparent application gateway which can be used to simulate WAN characteristics like Network delay, Packet loss, Packet corruption, Disconnections, Packet re-ordering, Jitter, etc.

WANem is a Wide Area Network Emulator that is designed to provide a real experience of a WAN/Internet during application development and testing. WANem works over an Ethernet LAN environment. WANem is available in bootable CD and VMware virtual appliance versions at an affordable cost (for FREE!). Award winning (FOSS INDIA AWARDS 2008) WANem is built on top of Linux and many open source component. From a functionality perspective WANem hooks into the Linux kernel towards provisioning the network emulation characteristics and extends the functionality with additional modules.

Setup is pretty straight forward. WANem is normally launched through a LiveCD, which is based on a re-mastered Knoppix. Another option is to use VMware virtual appliance. I have used both versions. Both versions allow a quick and easy setup in any development environment with an intuitive web interface for purposes of configuration. You don’t need to be a network and Linux guru to use WANem because the provided easy and very quick. There are many example configurations you can easily select and you can modify them as needed.

In advanced mode you have option to set all necessary network performance parameters you can think of. If you are a networking expert and know what are the right setting for different parameters, this is the way to go. You can see the supported settings (in advanced mode) on the picture below.

WANem has even tool (WANalyzer is distributed along with WANem) that allow you to measure the performance of an existing real network, and then it can simulate how that network performed.

WANem has to be located between two hosts, between each we want to simulate a network link. The routing parameters which need to be configured on the clients and/or on the WANem machine. The preferred and most straightforward configuration uses a PC with two Ethernet cards and connect that between the two hosts.

It is possible to work also with only one Ethernet card (with some limitations), but for this to work you need special configuration on the end hosts to make sure all traffic they send gets sent to the WANem machine that forwards the traffic to other host. I have personally used this approach only when I have wanted to use the virtual machine version of WANem.

Installing and Configuring WANem Virtual Appliance and Using the WANem WAN Emulator Virtual Appliance articles tells that setup is pretty straight forward. After the WANem Virtual Appliance has been started and setup in your network environment, all you have to do is to route your traffic through it.

WANem is an excellent tool.