This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to analyze pcap files for slow internet communication

0

Dear All,

I am a new user therefore I need some help. I need to analyze 2 pcap files for a job interview. Unfortunately I dont have experience on wireshark. Here is the given case and the given pcap files:

"There are complaints in a specific region from 3G customers that internet communication is slow. PS Core network is working on totally IP infrastructure. It is determined that this problem is related with customers that served by a specific RNC(Radio Network Controller). It is taken a Gn interface trace for complainant over SGSN (Serving GPRS Service Node). Also we request him to take a trace. These two traces are at the attachment.

Could you please prepare a report about how to analyse the problem and the result that you have reached. What can be the problem according to you?" link text - sgsn trace pcap file link text - ue trace pcap file

I dont know where to start on pcap files. I am welcome any comments and suggestions so at least I can have idea.

thanks in advance .

asked 05 Apr '15, 02:40

chndrkn's gravatar image

chndrkn
0●1●1●3
accept rate: 0%

One Answer:

1

The obvious thing here is packet loss, with retransmissions taking two or three digit numbers of milliseconds, which may add up to significant delay if it happens multiple times. The CRC errors on the GPRS tunneled segments can be ignored as the same packet has a correct CRC in the other trace, so it's probably caused by a local capture setup.

I have to add three things here here though:

  1. are you sure you were authorized to post those pcap files on public sites? It may contain sensitive data, e.g. internal network structures or user/customer data which should not be exposed to the public
  2. if they are interviewing you for a job which requires reading pcaps, all the help from this forum will not enable you to actually do it, as it is something that needs experience and can't be learned quickly
  3. are you aware that the guys giving you the files for the interview may be monitoring this Q&A site?

answered 05 Apr '15, 07:22

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Dear Jasper

thank you very much for your answer. Also thanks a lot for informing me about my mistake. I have removed the files. I am a fresh graduate student and dont have experience on wireshark. therefore I need some help to have idea at least.

(05 Apr '15, 09:57) chndrkn