Wireshark-users: Re: [Wireshark-users] How to systematically determine where my network bottlenec
Wireshark is great for lots of things. Unfortunately though it can be a bit like using a microscope to do landscape photography - in that you take sample "images" at a particular place in time and space, and need to glue it all together to get the full picture. I would certainly use it for instance at the client side of various workstations (maybe port-mirror some of the access switch ports) to answer questions like, who is the workstation talking to and what for? Are their application bottle necks like slow authentication processes or name lookups, is the workstation using a web proxy for internal traffic when it shouldn't. You should be able to measure the response times. In the core of network you might look for obvious indicators of bad things - lots of unanswered ARP requests, ICMP "warnings" like redirects or port unreachables. If you have a fast capture box you might be able look at what peak traffic loads are (but probably only a port at a time). At the server end you also work out how successful your server is at responding to request - eg do my HTTP request to response time seem slow, or SQL response, or am I limited in how fast I can stream traffic towards the client by delay in ACKing my traffic.
Ultimately it is just one tool in your box. You probably also want to look at properly instrumenting your network via SNMP or logging etc, Also getting an experience consultant simply walking through your architecture and configs will help a lot.
