This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi I am still new to Wireshark but I think that this should be an easy one:\

How can I monitor from a busy server (many GB of data/h) over an extended period of time (6h at least) the RTT times?

Since the data volume is massive I cannot store all sent data on disc. I am searching for latency issues where RTT > 0.1s. Ideally I would like to start a live capture and keep only the packets in memory which have such high RTT times to analyze later customer complaints with the monitored RTT times if the problems were network related or not. I have seen nice display filters like tcp.analysis.ack_rtt>0.1 which would do exactly that but when I look at the memory consumption of wireshark I see a steady increase which would bring down the server quite soon.

I have hoped that capture filters would help me to keep only the relevant packages which match the filter. Is this possible somehow? In general an option in Wireshark that drops all not visible packets would be great to achive that. If the feature is already there I would love to hear how I can use it.

asked 26 May '14, 02:41

akraus1's gravatar image

akraus1
26225
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×28

question asked: 26 May '14, 02:41

question was seen: 1,129 times

last updated: 26 May '14, 02:41

p​o​w​e​r​e​d by O​S​Q​A