Hello, on tshark statistics I see that a whole packet 1514 bytes is in the time interval of 1 microsecond. It is proper behaviour? |---------------------------------------- | Interval | Frames | Bytes | |---------------------------------------- | 0.000000 <> 0.000001 | 1 | 1514 | | 0.000001 <> 0.000002 | 0 | 0 | | 0.000002 <> 0.000003 | 0 | 0 | | 0.000003 <> 0.000004 | 0 | 0 | | 0.000004 <> 0.000005 | 0 | 0 | | 0.000005 <> 0.000006 | 1 | 1514 | | 0.000006 <> 0.000007 | 0 | 0 | I have capture only headers to my trace pcap file. asked 08 Dec '13, 12:50  net16 edited 08 Dec '13, 13:03 |
One Answer:
It depends on the speed of the network. In a 1Gbit/s network, it takes ~ 1.5 microseconds to transmit a full frame. Your values are plausible in a Gbit network, as there is a time gap of 5 microseconds between the frames. Regarding the time frame 0-1 microsecond. That's just the calculation interval. It tells you the time slot of the arrival time of the frame. As there is no information in the capture file how long it took to transmit the frame, it does not mean that the frame arrived fully in that time frame. Regards answered 08 Dec '13, 13:19  Kurt Knochner ♦ edited 08 Dec '13, 13:25 showing 5 of 6 show 1 more comments |
Kurt, thank you for the opinion. Hmm, I have 100Mb/s link and gap is another (I write above values a bit random - for explanation purposes). It seems that all packets in my traces are received during 1 microsecond. It is normal on FastEthernet interfaces too? On the Wireshark display list we can see only arrival time and I cannot check if tshark fits 1514 bytes during 1 microsecond.
It would be possible in such scenarion that tshark divide 1514 on two part: 900 bytes during 1 us and the rest 614 bytes during next 1 us?
Regards
Ps. I just wrote your extended answer. I understand that my second question is unfounded. Thanks.
Are those two frames both incoming or outgoing?
It is incoming traffic, but I see the same (1514 during 1 us interval) on outgoing interface.
Can you post a capture file?
It can be problem. Maybe you have any trace which divides packet on two part - one to first microsecond and second part to second microsecond?
But I think that it is not possible - according to your answer about arrival times and time slots.
tshark does not divide frames. The arrival time is either in one interval or in another.