Cisco & Wireshark measurement difference

Question

Hi guys. The first image is showing Bandwidth & Delay advertised by EIGRP Update message sent to other side over se 0/0 and captured by Wireshark. The second one shows Bandwidth & Delay for interface se 0/0, reported by "show interface" command. my question is; why those different??what's the scale for Bw & Dly in wireshark?? alt text

alt text

Accepted Answer

According to the master source code the packet details are as follows:

 * Dissect the TLV Versions 1.2 (legacy) and 3.0 (deprecated) metric
 * sections. The following represents the format
 *
 *    0                   1                   2                   3
 *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                       Scaled Delay                            |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                    Scaled Bandwidth                           |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |         MTU                                    |   Hopcount   |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   | Reliability  |      Load     |  Internal Tag   |    Flag      |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

So both the Scaled Delay and Scaled Bandwidth are dissected as big endian 32 bit values directly from the packet.

The delay field, as you can see if you select the field and look at the full field info in the status bar, is in "39.1 nanosec interments". So, 512000 * 39.1 nS = 20019.2 uS.

For the bandwidth field, the field info says it is in "units of 1Kbit/sec", but I can't think of a way to make the field value of 1657856 come out to 1544 KBit unless it's maybe counting for extra serial bits, e.g. start\stop\parity.