This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Round trip time direction

0

I have some basic questions about calculating round trip time in wireshark as I have some mis-understandings about it. After filtering my TCP session (http download), to get the RTT time, it looks like we need to select the source port from the server e.g. 80, then plot RTT graph.

If I was tracing from the server I guess I would select destination port of 80? to see the RTT time to the client.

From the client perspective if I was uploading e.g. a large post request and wanted to get RTT for that session, would I still select source port=80? i.e to get the RTT time that the server was acknowledged my requests?

What is the difference between selecting an ack packet in the tcp stream and plotting a RTT graph, and selecting "statistics/io graphs, filtering on source port=80, and then tcp.analysis.ack.rtt" ? I am asking as from the former I see higher values than the latter (even selecting MAX in statistics section).

asked 27 Feb '14, 06:27

Brummy's gravatar image

Brummy
1111
accept rate: 0%


One Answer:

0

Unless you are interesting in the 'internal' RTT through the TCPIP stack you typically need to select inbound packets to measure the 'network' RTT. So !ip.src == 10.11.1.10 and tcp.analysis.ack_rtt looks like a more generic filter for all sessions. If you are interested in the RTT to a certain destination address you'd select the remote address as ip.src

"What is the difference between selecting an ack packet in the tcp stream and plotting a RTT graph, and selecting "statistics/io graphs, filtering on source port=80, and then tcp.analysis.ack.rtt" ? I am asking as from the former I see higher values than the latter (even selecting MAX in statistics section)."

The statistics RTT Graph plots for every packet whereas the io graph builds the min/max/avg of all packets within the tick interval so to get realistic results you need to shrink the tick interval as much as needed depending on the packet rate of the acks..

answered 27 Feb '14, 13:44

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%