This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have some basic questions about calculating round trip time in wireshark as I have some mis-understandings about it. After filtering my TCP session (http download), to get the RTT time, it looks like we need to select the source port from the server e.g. 80, then plot RTT graph.

If I was tracing from the server I guess I would select destination port of 80? to see the RTT time to the client.

From the client perspective if I was uploading e.g. a large post request and wanted to get RTT for that session, would I still select source port=80? i.e to get the RTT time that the server was acknowledged my requests?

What is the difference between selecting an ack packet in the tcp stream and plotting a RTT graph, and selecting "statistics/io graphs, filtering on source port=80, and then tcp.analysis.ack.rtt" ? I am asking as from the former I see higher values than the latter (even selecting MAX in statistics section).

asked 27 Feb '14, 06:27

Brummy's gravatar image

Brummy
1111
accept rate: 0%


Unless you are interesting in the 'internal' RTT through the TCPIP stack you typically need to select inbound packets to measure the 'network' RTT. So !ip.src == 10.11.1.10 and tcp.analysis.ack_rtt looks like a more generic filter for all sessions. If you are interested in the RTT to a certain destination address you'd select the remote address as ip.src

"What is the difference between selecting an ack packet in the tcp stream and plotting a RTT graph, and selecting "statistics/io graphs, filtering on source port=80, and then tcp.analysis.ack.rtt" ? I am asking as from the former I see higher values than the latter (even selecting MAX in statistics section)."

The statistics RTT Graph plots for every packet whereas the io graph builds the min/max/avg of all packets within the tick interval so to get realistic results you need to shrink the tick interval as much as needed depending on the packet rate of the acks..

permanent link

answered 27 Feb '14, 13:44

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×28

question asked: 27 Feb '14, 06:27

question was seen: 6,245 times

last updated: 27 Feb '14, 13:44

p​o​w​e​r​e​d by O​S​Q​A