This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

graph time on the x axis vs, time between frames on y axis

0

How can I graph time on the x axis vs, time between frames on y axis? I will filter my display on only 1 side of the conversation, A -> B Then I want to see when the time between frames spikes up. It will allow me to see when the Source has 'paused' so to speak.

asked 23 Oct '13, 11:32

condor27's gravatar image

condor27
6113
accept rate: 0%


One Answer:

2

How about something like:

Statistics -> IO Graph -> Unit: Advanced... -> Filter: *filter*, Calc: AVG(*), frame.time_delta -> X Axis Tick interval: 0.1 sec

... where *filter* is the display filter of only the packets you're interested in. If you want all packets, just leave the *filter* blank. Change the tick interval to suit your needs and feel free to experiment with the other "Calc's" such as MAX(*).

answered 24 Oct '13, 09:53

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

In Statistics | IO Graph | When I graph... Filter = frame.time_delta_displayed I was hoping to get the Y Axis to show the values for the time_delta between each frame. But it says the Y Axis Unit is "Packets/Tick". Why doesn't it say something like "Time in ms" or just plane "Data Value"?

Oh, maybe if I do this: UNIT = Advanced , and SET Filter = blank, Calc = AVG(*) = frame.time_delta_displayed I don't understand why I'd need to use the AVG function. Is it doing an AVG for each tick on the X axis, so if each tick is 1s then I get the AVG delta over all frames that were sent in the whole 1 second?

I have about 500k packets in the capture, so I guess there is no way to graph all those data points, so we have to use AVG, correct?

(25 Oct '13, 14:23) condor27

Thanks cmaynard! Now I just need to confirm my understanding of what the AVG function is doing exactly? or what the MAX function would do? Its all in relation to the tick size, right?

(25 Oct '13, 14:29) condor27

You are correct. AVG(*) will plot the average delta time for all packets that passed the specified filter and fall within the tick interval. Similarly MAX(*) will plot the maximum delta time of all the packets that passed the specified filter and fall within the tick interval. The bigger the tick interval, the more packets are included in the AVG(*) calculation or taken into account to find the MAX(*); the smaller the tick interval, the fewer packets will be included in the AVG(*) calculation or taken into account to find the MAX(*).

If you want the actual plot values themselves, you can click the "Copy" button in the lower-left corner of the IO Graph and then paste those values into a spreadsheet for further graphing, processing, analysis, whatever.

(26 Oct '13, 07:46) cmaynard ♦♦