Capturing http response delays

I would do it this way.

Display filter: ip.addr eq 192.168.1.73 and (http.request or http.response)

Then set the Time column to the following format

View -> Time Display Format -> Seconds Since Beginning of Capture

As the client is also able to send several requests at the same time (in different TCP connections) you need to check the TCP Stream number as well. For this purpose, please add a new column in the GUI for the tcp.stream value. Here is how to do this

Edit -> Preferences -> User Interface -> Columns

Add a column called "TCP Stream". Then choose Custom as type and tcp.stream as value.

Then sort the GUI by the "TCP Stream" column.

Then use a Time Reference (CTRL-T in the GUI) for easy delta time calculation between request and response. As you can see the 'delay' (delta) between request and response is 2.144 seconds for the first request and 0.2605 for the second request.

You can also use tshark with some scripting:

tshark -nr input.pcap -R "ip.addr eq 192.168.1.73 and (http.request or http.response)" -T fields -e frame.number -e frame.time_relative -e ip.src -e ip.dst -e tcp.stream -e http.request.full_uri -e http.response.code -e http.response.phrase

Regards
Kurt