This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Using Wireshark to detect traffic shaping

0

i'm new to wireshark, i have a question for the wireshark pros:

i believe that my provider slows down/shapes my download speed if i use certain services / ports.

lets say if i use ftp i have full 18mb/s, if i try to download something from the usenet, it seesms that my max. speed is throttled to max 10mb/s.

is there a difference how the packets look like when throttled/not throttled ? or is there any other way to collect evidence ?

thx in advance!

asked 12 Nov '13, 13:37

supreme's gravatar image

supreme
16225
accept rate: 0%


One Answer:

1

"Traffic Shaping" is usually achieved by dropping packets to/from your IP address which then will trigger re-transmissions. So to answer your questions:

  • Is there a difference how the packets look like when throttled/not throttled ?

No

  • is there any other way to collect evidence ?

A higher than usual packet loss rate / re-transmissions. Of course, you need to have a basis to compare so maybe you can take another trace from a device that is not 'throttled' and see what's different.

THE filter number 1 filter is probably just "expert"
The Statistics -> FlowGraph will then give a nice overview on all suspicious packets.

alt text

answered 13 Nov '13, 13:09

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

edited 13 Nov '13, 22:20

can you please tell me what filters exactly i have to use to filter for the right informations ?

(13 Nov '13, 14:56) supreme
1

I updated my answer with the information about the filter I'd get started with.

(13 Nov '13, 22:22) mrEEde

thx you for your help!

(14 Nov '13, 01:47) supreme