This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I’ve some ftp-data frames which I am plotting in IO graph under statistics. The bytes/sec in Wireshark is considering the header of Ethernet + IP + TCP as well but I want only TCP payload (not the entire frame) to be taken to calculate the throughput, is there any way to do this?

asked 21 Oct '14, 23:32

Vish777's gravatar image

Vish777
26113
accept rate: 0%

edited 22 Oct '14, 02:06

grahamb's gravatar image

grahamb ♦
19.8k330206


You could use the Advanced graph within the IO graphs.

"regular" Bytes/sec graph:

"regular" Bytes/sec graph

Advanced graph for tcp.len, showing bytes/sec for the TCP payload only:

alt text

As you can see, the shape of the graph is the same. However the values for the second graph are lower, as it shows only the TCP payload.

And no, you cannot show it in bit/s, only in byte/s. At least I don't know a way to do that.

Regards
Kurt

permanent link

answered 22 Oct '14, 05:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 22 Oct '14, 05:21

Thanks Kurt. I think it is working fine now (showing only the TCP payload). By the way what is tcp.len actually? Does it mean the payload of TCP for every case?

(26 Oct '14, 23:33) Vish777

tcp.len is the length of the TCP segment (amount of data that was sent).

(28 Oct '14, 02:10) Kurt Knochner ♦

Thanks very much Kurt.

(28 Oct '14, 02:27) Vish777

You're welcome.

(28 Oct '14, 02:40) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×56
×25

question asked: 21 Oct '14, 23:32

question was seen: 17,636 times

last updated: 28 Oct '14, 02:40

p​o​w​e​r​e​d by O​S​Q​A