

Some of them are very basic, some of them are advanced. The thing I'm commenting on is that for a lot of networking pros I run into, their hammer looks like: Imgurįor those asking about getting started or more info on packet analysis. Later, that hammer only comes out when it needs to. Break out Wireshark! That's cool, it's fun, it's part of the process. Once you start picking up packet skills, every network problem looks like a nail to your new hammer. I mean, you can go digging if you have to, but ugh. But then after a while and you've picked up some solid skills? You kinda just want that shit to work. You actually kinda love it when stuff doesn't work right because it gives you a chance to get your hands dirty. Every time you have to dig in and fix something you get a lil thrill. It's kinda like when you first start learning Linux. It may seem like a have a boner for packet analysis, and, well, I kinda do. Why don't more people do this? Is it intimidating? Overwhelming? Don't know the protocols well enough? I'm probably preaching to the choir here, but can I get a witness? I know I can take the knowledge and skills I've learned by staring at pcaps for hours and hours over the last several years to any other job (except maaaaybe barista), but there aren't any letters after my name. I understand that someone can be knowledgable about networking and troubleshooting in terms of products or vendors, but I've interviewed CCIEs that can't tell me when/if an IP address or MAC address changes when traveling from point A to point B. I run into smart people who are solid troubleshooters but when they feel like a packet capture is the next logical step (usually the last one for them), they will open Wireshark, scroll, scroll, scroll, shrug, and close Wireshark. I don't usually say those things to customers. IT'S YOUR TERRIBLY TERRIBLY WRITTEN APP, YOU GIT" IT'S ALMOST NEVER THE NETWORK AND HERE'S THE PROOF.

I don't have to spin my wheels wondering "is it this? could it be that?" I know packet analysis doesn't always solve the issue, but you can know better where to dig in and definitively be able to say "IT'S NOT THE NETWORK, YOU JERKS.

But in this job where I have to troubleshoot our networking product that touches every layer of the stack, I've learned a great deal in quickly analyzing problems with packet analysis (Wireshark, basically) where to point the finger and what the likely culprits are. Admittedly, as a sysadmin, my packet analysis skills were next to nil. I've been a support engineer for going on 6 years and a sysadmin before that.
