This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi guys. The first image is showing Bandwidth & Delay advertised by EIGRP Update message sent to other side over se 0/0 and captured by Wireshark. The second one shows Bandwidth & Delay for interface se 0/0, reported by "show interface" command. my question is; why those different??what's the scale for Bw & Dly in wireshark?? alt text

alt text

asked 23 Aug '14, 12:18

M_Bazgir's gravatar image

M_Bazgir
16448
accept rate: 0%

edited 23 Aug '14, 20:47


According to the master source code the packet details are as follows:

 * Dissect the TLV Versions 1.2 (legacy) and 3.0 (deprecated) metric
 * sections. The following represents the format
 *
 *    0                   1                   2                   3
 *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                       Scaled Delay                            |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                    Scaled Bandwidth                           |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |         MTU                                    |   Hopcount   |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   | Reliability  |      Load     |  Internal Tag   |    Flag      |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

So both the Scaled Delay and Scaled Bandwidth are dissected as big endian 32 bit values directly from the packet.

The delay field, as you can see if you select the field and look at the full field info in the status bar, is in "39.1 nanosec interments". So, 512000 * 39.1 nS = 20019.2 uS.

For the bandwidth field, the field info says it is in "units of 1Kbit/sec", but I can't think of a way to make the field value of 1657856 come out to 1544 KBit unless it's maybe counting for extra serial bits, e.g. start\stop\parity.

permanent link

answered 24 Aug '14, 02:11

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 24 Aug '14, 10:33

That's my answer,great. but I think you should pay more attention to your mathematical skills, because "512000*39.1 nS = 20019.92 uS " ;-) thanks alot.

(24 Aug '14, 06:02) M_Bazgir

Looks more like a typo to me, plus you should accept Grahams answer with the check mark button to make it clear to others ;-)

(24 Aug '14, 09:41) Jasper ♦♦

@M_Bazgir

It was a typo, both Windows calculator and Google agree the answer is 20019.2us. I've amended the answer.

(24 Aug '14, 10:33) grahamb ♦

@Jasper thanks for your mention. ;-) I did it. :)

(24 Aug '14, 11:00) M_Bazgir

@grahamb Again thanks, your answer was so perfect.

(24 Aug '14, 11:03) M_Bazgir
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×57
×43

question asked: 23 Aug '14, 12:18

question was seen: 1,081 times

last updated: 24 Aug '14, 11:03

p​o​w​e​r​e​d by O​S​Q​A