CloudLabBox
Try the free demo

Packet analysis lab 12 of 12

Capstone: the network is slow

The branch says the stock page is slow. You capture at three points at once (the client, the branch router and the server), build a time budget for one request, and find three separate causes: a dead DNS server, a lossy provider circuit and a slow application. You fix the two that belong to the network and hand the third over with proof.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 12 - Capstone - the network is slow

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
5 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

Monday morning, Penrith branch: "The stock page is really slow. The network's been bad all week." That's all you get. The page is http://stock.fellside.lab/stock, served by SRV at head office across the provider's circuit. Nobody knows whether to blame the branch, the circuit, DNS or the application, and every team says it's someone else's. You'll capture at three points at once, account for every second of a request, and come back with facts: what's wrong, where, and who must fix it.

DeviceInterfaceAddressRole
WSeth010.130.1.10/24, gateway .1the branch PC (and your workstation); DNS servers from its settings
R1Gi0/0 / Gi0/110.130.1.1/24 / 10.130.12.1/30branch router
WANeth0 ↔ eth1bridge, no addressthe provider's circuit (a WAN emulator)
R2Gi0/1 / Gi0/010.130.12.2/30 / 10.130.2.1/24head-office router
SRVeth010.130.2.10/24stock application (HTTP 80), DNS for fellside.lab, file share (8080)

Your workstations. WS and SRV are both remote desktops (root / eve) with Wireshark (Applications > Internet > Wireshark) and a terminal. Write answers in /root/answers.txt on WS (pluma /root/answers.txt &).

What you’ll practise

  • Plan and run a multi-point capture: client, infrastructure device and server
  • Identify each capture point from TTLs and align the same packets across files
  • Break a slow request into DNS, connection, server and transfer time
  • Locate packet loss between two capture points
  • Fix what belongs to the network, measure again, and report the rest with evidence

The tasks

  1. Recreate the circuit
  2. Plan the captures and reproduce the problem
  3. The time budget, and DNS
  4. The server's share
  5. Where are packets lost?
  6. Fix what's yours, report the rest

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - the network is slow5 nodes, 4 links. Every link is listed as text below the diagram.WSR1WANR2SRVeth0Gi0/0Gi0/1eth0eth1Gi0/1Gi0/0eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • WS eth0 to R1 Gi0/0
  • R1 Gi0/1 to WAN eth0
  • WAN eth1 to R2 Gi0/1
  • R2 Gi0/0 to SRV eth0
Nodes in Capstone: the network is slow, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
WSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
SRVEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Packet analysis with Wireshark and tcpdump guided labs.

  3. Open 12 - Capstone - the network is slow and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Packet analysis labs

All Packet analysis labs

Related labs in other courses

CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.