This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all I'm posting to know how can I measure the system delay. for the details, please refer to attached picture. alt text

asked 24 Feb '14, 00:47

Ray_Han's gravatar image

Ray_Han
566611
accept rate: 0%


If you want 'real results', you should not rely on the mirror functionality of the switch for this, as you will never know how exactly (in which order) the switch copies the frames from 3+2 to the mirror port. The best option would be to capture the traffic of port 3 and 2 with a TAP for each port and with two systems with 'highly synchronized' clocks.

However: That's pretty much overhead (TAPs, two systems, etc.). If the expected delay is small (a few microseconds), you'll have to do it like described above, if you want to get 'real results'. If the expected delay is much larger (a few milliseconds) the approach with a switch mirror port and one capture system might be good enough.

Either way you need to calculate the delay between two identical frames in the capture file. That can be done with tshark and a script (perl, python, whatever).

tshark -nr input.pcap -T fields -e frame.number -e ip.id -e frame.time_relative

The output looks similar to this:

1       0xf038  0.000000000
2       0xf039  0.019413000
3       0xf038  0.02136700
4       0xf039  0.03316100

With the script you can find duplicate IP IDs and calculate the delta between the two time stamps. The delta values can be loaded into a spreadsheet software to create a chart.

Regards
Kurt

permanent link

answered 24 Feb '14, 10:01

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

appology late update. it's good help to get the delay but don't use tshark what you said. but I think your comments is very good. I'm studying tshrark. Thank you.

(18 Mar '14, 00:29) Ray_Han
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×43

question asked: 24 Feb '14, 00:47

question was seen: 1,647 times

last updated: 18 Mar '14, 02:51

p​o​w​e​r​e​d by O​S​Q​A