Re: Question on measuring on both sides of a masquerading server.

[Sake Blok | SYN-bit <sake.blok () SYN-bit nl>]

> On 24 Apr 2019 (Wed), at 00:44, L A Walsh <wireshark () tlinx org> wrote:
> On 4/23/2019 12:32 PM, Sake Blok | SYN-bit wrote:
> > Please note that RTT calculations are done from the view of the capture point. So if you capture near system A, the 
> > roundtrip times for traffic being sent from A to B will be showing the 'real' roundtrip times, as the data packets 
> > are seen at the capture point just slightly after they have left system A. Then the ACK comes in after the packet 
> > has traversed the network over to system B and B sent the ACK back. But when system B sends data, it has already 
> > travelled the network all the way to system A, then A sends the ACK and it is seen by the capturing machine before 
> > it travels all the way back to system B.
> >
> > So, unless you are able to capture on the remote side, you will only be able to deduct the TCP RTT times by looking 
> > at the traffic that is sent from our side to the remote side.
> If the measuring machine in your example is between A+B would I only see
> the RTT time because of 'A's ACK or would I see it as the packet passes
> through the "router" (masquerade box)?

The TCP RTT calculation is done by looking at the ACK's. If there is only data flowing in one direction, you would not 
even see any RTT values for the other direction.

So in your example where B is close to A, all data packets sent from C to A will pass the part of the network where 
there is substantial delay before passing capture point B. The the data will be acked by A and the time between the 
data packet from C and the ack from A will be short (because your capture point B is close to A). For the reverse RTT 
calculation, when A sends data to C, it will pass past B before hitting the part of the network that does have 
substantial delay. Then the data packet travels to C (with latency), C acks the data and the ACK travels back to A over 
the part of the network with substantial delay before capture point B gets to see the ACK. Hence, the RTT in one 
direction is only measuring the RTT between B and A and the RTT in the other direction is only measuring the RTT 
between B and C. None of the graphs is showing you the RTT between A and C.

Cheers,
Sake
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe