This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Will capture size have bearing on throuput measurement?

0

When I limit the capture of packet to about 100 bytes (paer packet), there is visible change in throuput measurement (as indicated in the summary). Why would this happen?

asked 13 Jan '11, 01:28

Raghav's gravatar image

Raghav
1111
accept rate: 0%

Can you describe the actual difference (and confirm the traffic you are monitoring hasn't changed)?

That sounds like a bug.

(13 Jan '11, 03:03) martyvis

3 Answers:

1

The only thing I can imagine is that as soon as you limit the frame size to say 100 bytes that your throughput get better (you didn't mention if it goes up or down, but I think "up" is the only realistic thing to happen).

This is why: your link might really really be crowded with frames, and when Wireshark tries to capture those there is too much data too fast to be written to disk, resulting in dropped frames. As soon as you reduce the capture size to 100 byte there is much less data volume to be written to disk, so Wireshark can "record" more frames, and this results in a higher throughput reading.

If your throughput readings go down on 100 bytes per frame I'd agree with Martyvis that this is probably a bug.

answered 13 Jan '11, 12:00

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

0

I would imagine that it is actually calculating this based on the frame as seen in the capture. You could still get some idea of usage by opening "IO Graphs" under "Statistics". Set the units to "Advanced" and use Sum(x) and ip.len. Its a different view, but should be relative to frame size and throughput as long as most of your traffic is IP.

answered 13 Jan '11, 02:55

Paul%20Stewart's gravatar image

Paul Stewart
3018
accept rate: 6%

0

I experimented with this unscientifically and without a huge load. I actually found that only the "File" section of the summary screen seemed to be affected by limiting the packet size. I ran two instances of wireshark for about the same amount of time. The Avg bytes/sec were pretty consistent between the copy that was limiting the packet size and the one that wasn't. The pcap format might actually have a field for frame length even when it does not record the entire frame. I'm using 1.4.2.

answered 13 Jan '11, 13:19

Paul%20Stewart's gravatar image

Paul Stewart
3018
accept rate: 6%