This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Performance: bandwidth + packets

Hi All,

I might sound like a noob but I had to ask after attempts after attempts for several hours to determine a simple thing.

I need to determine the rate (speed, bandwidth) at which a file(600MB) is transferred from PC-A to PC-B and whether any packets are dropped.

I've connected two computers together over Ethernet. Host A : 192.168.1.10 - running wireshark and downloading large file from Host B through Network drive. Host B : 192.168.1.20 - Having a large file in its network drive for Host A to download.

Question 1 - What's the most effective way to find out the speed of file transfer in MBps ? Question 2 - How can I tell if none of the packets are dropped.

Thanks ALOT in advance.

Note: I am not being lazy and trying to find a quick solution, I had actually spend hours and hours to go through guide and manuals but my brain just went numb. Thanks

bandwidth packet mbs

asked 02 Jun '14, 03:43

Andrea_89
1●1●2●1
accept rate: 0%

2 Answers:

Aside from the following, Wireshark really doesn't provide such a value:

tshark.exe filename.pcap -r -T fields -e "radiotap.datarate" > filename.datarate.txt
see "radiotap" WireShark documentation;
also search tshark documentation if you have issues running tshark;
this is best put into a batch file if coded properly.
Statistics >> Follow TCP Stream >> Look in header info
Statistics >> Conversations or Statistics >> Conversation List >> [Protocol] ; one of the colums contains the rate
Summary >> Avg. MBps
In an external program such as matlab, calculate it using ((cumulativedata/relativetime)* 8 / 10^6)

Other than that, through extensive research on this issue (3 Weeks of searching myself), I don't think there is any other forms of available information that Wireshark can give you as far as I am concerned.

answered 13 Jan '16, 08:55

Midimistro
11●6●6●10
accept rate: 50%

Τhe answer depends on the protocol/application you use to transfer the file.

If you use ftp, one tcp session is used for control and another one gets open ad-hoc for the file transfer itself, so it is easy to use Statistics -> Conversations to find the counts of packets and bytes and duration of the session and calculate the average transmission speed. Statistics -> TCP Stream Graphs -> Throughput will show you the throughput over time.

If you use protocols which use a single common tcp session for control and data, like SMB/SMB2 or scp, sftp, you may have to use information contained in the control messages of that protocol to identify the first and last packet of the particular file you are interested in (if you actually are only interested in a single file).

In both cases, I am also unable to find any method to provide summary information about the number of retransmitted (due to loss) packets. But if it is enough for you to know whether the total transfer time was longer than you've expected due to packet loss or due to something else: if, after applying a display filter tcp.analysis.retransmission , you can see some packets, then there were retransmissions. Otherwise, the reason of the slowness is something else.

answered 13 Jan '16, 11:02

sindy
6.0k●4●8●51
accept rate: 24%