This is our old Q&A Site. Please post any new questions and answers at

Hi, Question is related to delay calculation,lets say in a one session i have RTT of 1 ms and total time taken for session is 32 seconds due to delay,retransmission etc.Is there any way to find out total time taken by packets who have more than 10ms delay or accumulated time of all packets with more than 10ms delay.I can find out packets with more than 10ms delay with tcp.time_delta but it doesnt not show total time by all such packet but it just shows percentage of such packet.Help is really appreciated.

asked 08 May '14, 00:25

kishan%20pandey's gravatar image

kishan pandey
accept rate: 28%

I'm sorry, but I don't understand what you are asking. As nobody answered, I'm probably not the only one.

Please add or more details or a better description of your 'problem'.

(09 May '14, 11:25) Kurt Knochner ♦

What i want to know is that in a one tcp stream if we do summary it shows us multiple details like total conversation time,bytes/sec,packets/sec etc but if i add a filter tcp.time_delta ge 0.200 and if i see summary again it only shows total no. of displayed packet but not the accumulated time of all those filtered packets.This is just to see that how much delay is being added by all packets with more than 200 ms delay.

(10 May '14, 02:51) kishan pandey

You could filter for the tcp stream, export the packets as CSV and calculate the total delay in Excel or if you want something more complex use tshark in a script. For a quick sum under Linux try this command:

tshark -r file.pcap -R " eq 0" -T fields -e "tcp.time_delta" |  sort -rn | awk '$1 > 0.200' | awk '{sum += $1;} END {print sum;}'
permanent link

answered 10 May '14, 11:09

Roland's gravatar image

accept rate: 13%

edited 10 May '14, 11:23

Thanks roland,can we do the same thing with tshark in windows

(13 May '14, 23:10) kishan pandey

You should be able to do it in PowerShell, but I don't know the exact syntax.

(14 May '14, 09:31) Roland


Define your limit and stream index:

$limit = 0.2 $strm = 0

Then execute:

tshark -r file.pcap -Y " eq $strm" -T fields -e "tcp.time_delta" | sort | where { $_ -ge $limit } | Measure-Object -Sum | select -Expand Sum

Note I've switched to -Y for the filter expression as -R requires a -2 for a two pass read, and you also need the default profile to have set the option for TCP to calculate conversation timestamps.

(15 May '14, 03:11) grahamb ♦

Excellent,thanks graham,for your valuable help

(16 May '14, 22:16) kishan pandey
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 08 May '14, 00:25

question was seen: 2,464 times

last updated: 16 May '14, 22:16

p​o​w​e​r​e​d by O​S​Q​A