How to Capture Simultaneous Wireshark Traces from Client and Server for Network Troubleshooting

introduction:

I have seen clients troubleshoot issues with their IIS hosted applications on their networks. Often in network troubleshooting, you need to capture packets from both the client and the server to fully understand what is happening during the communication. Wireshark, an essential tool for network analysis, can help with this, but capturing from both sides simultaneously requires careful planning. This approach provides a complete view of the communication and helps identify the problem more effectively.

In this blog, we will walk through the process of capturing Wireshark traces simultaneously on both client and server sides, providing a clearer picture of network flows and potential issues.

Should we start with Wireshark?:

Wireshark is a free, open source network capture and network analysis tool that is widely used worldwide. It is not installed by default on any operating system, so customers must download and install it on their devices. Here’s what you need to use it for:

1. Tools on the official website Wireshark · Download
2. Administrator access to both clients and servers

Now we will capture the traces.

1. Launch Wireshark. On your Windows computer, open the Start menu and type: Wireshark Right-click on Wireshark in the search box and select Run as administrator
2. Wireshark captures traffic from all network adapters and network interface cards, but you can isolate one to capture using the capture menu that appears when Wireshark opens. A line next to the interface name indicates whether traffic is currently flowing through the interface, which can help you choose if necessary.

1. Select from the toolbar menu capture -> startAlternatively, you can select the blue shark fin button to start a network capture.

1. Set this on both client and server now. Reproduce the problem If you want to investigate, packet details will scroll through while the capture is running.
2. After reproducing the problem, from the toolbar menu, select: capture -> haltAlternatively, you can stop tracking by clicking the red square button.

1. Select from the toolbar menu file -> Save as. In the Save As dialog box, you can save the trace in the default Wireshark trace format, *.pcapng, or change it to: Save as type With drop down menu Microsoft Netmon 2.x Then save the trace as *.cap so that you can open it using Netmon.

Now you have a troubleshooting log ready for comprehensive review.