Wireshark mailing list archives
Re: Question about seeing Latency in TCP conversations
From: "Sheahan, John" <John.Sheahan () priceline com>
Date: Wed, 4 Jan 2012 20:19:12 -0500
Thanks Martin, I have never done any graphing at all and didn’t know about the ack_rtt. In this case, It seems that the ack_rtt shows the rtt between the SYN and the next packet, I need to know if there were any packets in the conversation (from SYN to FIN) that have a high RTT…..is there a way to do that? johnny From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Martin Visser Sent: Wednesday, January 04, 2012 5:45 PM To: Community support list for Wireshark Subject: Re: [Wireshark-users] Question about seeing Latency in TCP conversations Johnny, The easiest way is to examine the calculated field "tcp.analysis.ack_rtt". This appears in the details window if you have TCP Sequence Analysis on. [cid:image001.png@01CCCB1E.1E450940] You have to be a little careful when using this though, as Wireshark sometimes miscalculates this in the prescence of Duplicate ACKs. The best way to use it (taking out effects of the server processing delay), is during the initial handshake. So what I do is filter for "tcp.flags == 0x12" (which is the SYN/ACK) and plot tcp.analysis.ack_rtt or add it as a column. [cid:image002.png@01CCCB1E.1E450940] Regards, Martin MartinVisser99 () gmail com<mailto:MartinVisser99 () gmail com> On 5 January 2012 08:20, Sheahan, John <John.Sheahan () priceline com<mailto:John.Sheahan () priceline com>> wrote: I have been given a sniffer trace by our application guys and they want me to look through it to see if any of the TCP conversations have higher than normal latencies. The file is kind of big and too much data for me to filter and look at each conversation. Is there an easy way to do this in Wireshark? Thanks Johnny ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org<mailto:wireshark-users () wireshark org>> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org<mailto:wireshark-users-request () wireshark org>?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Question about seeing Latency in TCP conversations Sheahan, John (Jan 04)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 04)
- Re: Question about seeing Latency in TCP conversations Sheahan, John (Jan 04)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 04)
- Re: Question about seeing Latency in TCP conversations Andrej van der Zee (Jan 04)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 04)
- Re: Question about seeing Latency in TCP conversations Andrej van der Zee (Jan 05)
- Re: Question about seeing Latency in TCP conversations Sheahan, John (Jan 07)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 07)
- Re: Question about seeing Latency in TCP conversations Sheahan, John (Jan 08)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 08)
- question about sniffing wireless IPOD conversations John S (Jan 19)
- Re: question about sniffing wireless IPOD conversations Jaap Keuter (Jan 19)
- Re: Question about seeing Latency in TCP conversations Sheahan, John (Jan 04)
- Re: Question about seeing Latency in TCP conversations Martin Visser (Jan 04)