This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Cisco & Wireshark measurement difference

0

Hi guys. The first image is showing Bandwidth & Delay advertised by EIGRP Update message sent to other side over se 0/0 and captured by Wireshark. The second one shows Bandwidth & Delay for interface se 0/0, reported by "show interface" command. my question is; why those different??what's the scale for Bw & Dly in wireshark?? alt text

alt text

asked 23 Aug '14, 12:18

M_Bazgir's gravatar image

M_Bazgir
16448
accept rate: 0%

edited 23 Aug '14, 20:47


One Answer:

2

According to the master source code the packet details are as follows:

 * Dissect the TLV Versions 1.2 (legacy) and 3.0 (deprecated) metric
 * sections. The following represents the format
 *
 *    0                   1                   2                   3
 *    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                       Scaled Delay                            |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |                    Scaled Bandwidth                           |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   |         MTU                                    |   Hopcount   |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 *   | Reliability  |      Load     |  Internal Tag   |    Flag      |
 *   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

So both the Scaled Delay and Scaled Bandwidth are dissected as big endian 32 bit values directly from the packet.

The delay field, as you can see if you select the field and look at the full field info in the status bar, is in "39.1 nanosec interments". So, 512000 * 39.1 nS = 20019.2 uS.

For the bandwidth field, the field info says it is in "units of 1Kbit/sec", but I can't think of a way to make the field value of 1657856 come out to 1544 KBit unless it's maybe counting for extra serial bits, e.g. start\stop\parity.

answered 24 Aug '14, 02:11

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

edited 24 Aug '14, 10:33

That's my answer,great. but I think you should pay more attention to your mathematical skills, because "512000*39.1 nS = 20019.92 uS " ;-) thanks alot.

(24 Aug '14, 06:02) M_Bazgir

Looks more like a typo to me, plus you should accept Grahams answer with the check mark button to make it clear to others ;-)

(24 Aug '14, 09:41) Jasper ♦♦

@M_Bazgir

It was a typo, both Windows calculator and Google agree the answer is 20019.2us. I've amended the answer.

(24 Aug '14, 10:33) grahamb ♦

@Jasper thanks for your mention. ;-) I did it. :)

(24 Aug '14, 11:00) M_Bazgir

@grahamb Again thanks, your answer was so perfect.

(24 Aug '14, 11:03) M_Bazgir