This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark install seems to improve performance

0

We have a web based system (HTTP) which seems to be having performance issues. In our UAT environment performance is fine, in production, there is a significant reduction. These are typically request / response type messages for data lookups (i.e. search a data cache for filtered data).

UAT and Prod reside on the exactly the same infrastructure, only differecne is the hardware. I installed wireshark to moinitor network traffic and performance.

I know it sounds wierd but since I have installed wireshark, the web based applications performance has significaly improved. We have a few users, some with and some without wireshark. All those with wireshark dont seem to have the same slow performance. I know that wirehsark is simply a monitoring tool, but is there nothing that occurs that will change network parameter in some way?

asked 07 Jun '12, 02:03

jarrow's gravatar image

jarrow
1112
accept rate: 0%

edited 07 Jun '12, 02:05


One Answer:

0

I KNOW it sounds weird, but I have seen similar effects. As soon as the interface of a machine runs in promiscuous mode (sniffing), some applications behave differently. I cannot recall the details, but I have seen this several times. I don't have any explanation as I never tried to track it down. That is one reason why you should not sniff ON the target system you are trying to analyze.

To verify if your observation is not just a psychological effect (seeing what you believe), I suggest to do this:

  1. Find a computer with the symptoms of slow performance
  2. Capture the slow traffic in front of that computer: http://wiki.wireshark.org/CaptureSetup/Ethernet
  3. Install wireshark on that computer and repeat step 2.
  4. Compare the two capture files

After step 4. you will see, if there is a measurable effect, or if it's just some sort of network (wind) chill factor ;-))

Regards
Kurt

answered 08 Jun '12, 01:46

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 08 Jun '12, 05:19

Hi Kurt

Fantastic thanks, great plan. I will give it a go.

(08 Jun '12, 04:11) jarrow

good luck!

(08 Jun '12, 04:35) Kurt Knochner ♦