This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Analyze PCAP file

0

Hello - sorry if this is beating a dead horse. I have 2 PCAP files captured during a write between two hosts. I am needing someone to look at these PCAP files and help analyze them and possibly see where the issue lies. Long story short - we are only achieving about 20% BW on 10GB local LAN pipe. Any suggestions for a newbie would be great.

Thanks for you time.

CM

asked 26 Mar '14, 08:19

chrissezhi's gravatar image

chrissezhi
11112
accept rate: 0%


2 Answers:

0

well, I don't think that someone here will be able/willing to look at two capture files taken on 10GB links, as that's quite a lot of data and a time consuming task. How would you even provide those capture files for download??

I think it's better to look for a networking guru in your 'neighborhood' who is able to check your capture files and your network setup.

We can (probably) help you to look at the capture files yourself.

To start with some simple things first:

  • how do you know it's only 20% BW?
  • how did you create the capture file?
  • how did you ensure that the capture system did not drop frames due to 'overload'?
  • what kind of application is that?
  • did you enable jumbo frames on you network equipment and servers?

Regards
Kurt

answered 26 Mar '14, 08:53

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 26 Mar '14, 08:54

Thanks Kurt for the reply.

The setup was as followings. Used Lan Speed Test to write a 10GB file from host a to host b. In Wireshark, I filter the capture to only listen for Host A to Host B. Ran the test and stopped the capture.

Only 20% - because I can not get over 2GB when looking at performance. Via Wireshark Not sure, that is what I was hoping to find out. Using LAN Speed Test - simple write file. No Jumbo Frames.

(26 Mar '14, 09:05) chrissezhi

so, the 20% is a metric printed by Wireshark?

(26 Mar '14, 09:07) Kurt Knochner ♦

0

With TCP you have a maximum possible troughput between two hosts regardless of the bandwith. In the packet capture look at the Window Size and Round Trip Time of the connection and use the link below to calculate the maximum troughput and optimal TCP buffer size:

https://www.switch.ch/network/tools/tcp_throughput/index.html

answered 27 Mar '14, 14:45

Roland's gravatar image

Roland
7642415
accept rate: 13%