This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to track down the source of some browsing issues and I believe I have narrowed it down to a DNS issue. I can filter on a specific transaction ID and manually calculate the time between the first request and the reply, but I am looking for a way to automatically calculate the data and create an IO graph. Using dns.time only shows the time since the last request and the reply, whereas I would like to see the time between the first request and reply. For example if a DNS request is retransmitted twice, the time from the first request to the reply may be 3.5 sec, but dns.time will show .5 sec since that is the amount of time since the last retransmission. Any ideas?

asked 02 Jun '13, 15:50

John%20Moran's gravatar image

John Moran
1111
accept rate: 0%


You could try to create the required relation between the DNS request and the response with MATE, then add a field ('delta_time') and draw an I/O graph based on that field.

See also here:

http://wiki.wireshark.org/Mate/Manual
http://wiki.wireshark.org/Mate/Library (see DNS example)

HOWEVER: MATE is quite complex ...

Regards
Kurt

permanent link

answered 04 Jun '13, 12:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

I'm wondering if, more simply, something like tshark -R dns -T fields -e frame.time -e dns.id could just be piped to an awk script to take first and last of each dns.id value, subtract min from max frame time in the corresponding column, and output the results in a time-sorted x;y format that you could then plot out of excel.

That's probably just a few lines of code. I might look at it tomorrow night but this should be relatively straightforward.

(05 Jun '13, 20:54) Quadratic
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×109
×75
×2

question asked: 02 Jun '13, 15:50

question was seen: 3,709 times

last updated: 05 Jun '13, 20:54

p​o​w​e​r​e​d by O​S​Q​A