Data ReHab
Allow me to apologise for not posting for such a long time. Embarrassingly, I'd become a packet sniffing junkie, however, I'm sober now. As part of my therapy I would like to come clean on my story to you.
It all started after a hard days work troubleshooting a particular network fault. Our edge router kept crashing randomly and we just couldn't pin it down. Morris suggested that we stay back after-hours to kick back with some beer, sniff a few packets and get high. It was a stressful day and being open to experimentation I agreed to try it out.
I didn't learn until later that Morris had been a casual packet sniffer from way back. He started sniffing X.25 frames back with his mates at uni. However, unlike me, he never let things get out of control.
I'll never forget the rush I felt as the hex of my very first sniffed packet injected itself onto the screen. However, the euphoria didn't last long. It never does and soon your buffer is empty and you need another hit. Just a small amount to keep you going. Keep you alert and on your toes.
You convince yourself to increase your buffer size and take a bugger sniff. Management didn't seem to mind. On the contrary, they were happy to see me working back late and taking such committed action. If only they knew the toll it was taking on my sole. Pretty soon the hit I was getting from sniffing traffic at the edge was wearing pretty shallow and I thought that the only way I could get satisfaction was if I started sniffing the big stuff. You know, some of the Gigabit Ethernet trunks at the core. At the peak of my illness, I would sniff about 2-5 Gigabytes worth of traffic at a time and stay at work all night analysing it. It was my artificial paradise.
After one mammoth session consisting of sniffing 40 Gig of Ethernet frames, 5 Meg of SNMP traps, some router debug, syslog and half a dozen or so router configs, my body had enough and I passed out on the keyboard. When I woke up I was in data rehab.
The hardest part was admitting that I had a problem. At the time I just thought I was a diligent engineer, who was perhaps just a little was more committed than most. However, after listening to some of the other guys in rehab I came to realise that I was just like them. This particular guy, "Ernie", had been in and out of data rehab a number of times. He was recently readmitted for turning on all the SNMP traps on all of his network gear. This quickly overdosed his network management software and almost killed himself and his network.
The most important thing that data rehab taught me is that you can't solve network problems by sniffing packets. Sniffing is fun, it will give you a buzz but is a destructive waste of your life. No matter how much or how little you sniff the problems going to still be there and you're going to want more
It's not that I don't get the craving for sniffing anymore. I do and it's still as strong as it ever was. Heck, Morris still dabbles in SNMP from time to time and I hear that SNMP V3 is big with the security folk. Its just that I know that I'm better off without it.
I now have the confidence to solve my network problems without having to ever sniff again. Debug clean for 45 days.
Claude





