This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

total delay by all packets with more than 10 ms delta

0

Hi, Question is related to delay calculation,lets say in a one session i have RTT of 1 ms and total time taken for session is 32 seconds due to delay,retransmission etc.Is there any way to find out total time taken by packets who have more than 10ms delay or accumulated time of all packets with more than 10ms delay.I can find out packets with more than 10ms delay with tcp.time_delta but it doesnt not show total time by all such packet but it just shows percentage of such packet.Help is really appreciated.

asked 08 May '14, 00:25

kishan%20pandey's gravatar image

kishan pandey
221●28●29●36
accept rate: 28%

I'm sorry, but I don't understand what you are asking. As nobody answered, I'm probably not the only one.

Please add or more details or a better description of your 'problem'.

(09 May '14, 11:25) Kurt Knochner ♦

What i want to know is that in a one tcp stream if we do summary it shows us multiple details like total conversation time,bytes/sec,packets/sec etc but if i add a filter tcp.time_delta ge 0.200 and if i see summary again it only shows total no. of displayed packet but not the accumulated time of all those filtered packets.This is just to see that how much delay is being added by all packets with more than 200 ms delay.

(10 May '14, 02:51) kishan pandey

One Answer:

3

You could filter for the tcp stream, export the packets as CSV and calculate the total delay in Excel or if you want something more complex use tshark in a script. For a quick sum under Linux try this command:

tshark -r file.pcap -R "tcp.stream eq 0" -T fields -e "tcp.time_delta" |  sort -rn | awk '$1 > 0.200' | awk '{sum += $1;} END {print sum;}'

answered 10 May '14, 11:09

Roland's gravatar image

Roland
764●2●4●15
accept rate: 13%

edited 10 May '14, 11:23

Thanks roland,can we do the same thing with tshark in windows

(13 May '14, 23:10) kishan pandey

You should be able to do it in PowerShell, but I don't know the exact syntax.

(14 May '14, 09:31) Roland
2

Powershell:

Define your limit and stream index:

$limit = 0.2 $strm = 0

Then execute:

tshark -r file.pcap -Y "tcp.stream eq $strm" -T fields -e "tcp.time_delta" | sort | where { $_ -ge $limit } | Measure-Object -Sum | select -Expand Sum

Note I've switched to -Y for the filter expression as -R requires a -2 for a two pass read, and you also need the default profile to have set the option for TCP to calculate conversation timestamps.

(15 May '14, 03:11) grahamb ♦

Excellent,thanks graham,for your valuable help

(16 May '14, 22:16) kishan pandey